# List of RPMs for HyperScale X Platform Version 3.2601

The following RPMs are included in this version:

RPM | Issue
--- | ---
augeas-libs-1.12.0-8.el8.x86_64.rpm | - New upstream version 1.10.0 (RHBZ#1538846).
- Remove upstream patch.
- New tool ‘augmatch’.
- New version
- New upstream release (RHBZ#1709416)
* Fstab: allow leading whitespaces (RHBZ#1671950)
- Update to 1.4.0
- Add simple tests (RHBZ#1653994)
- New version
- Fix ownership of /usr/share/augeas. BZ 569393
- Install fadot
- Update to 1.6.0
- New version
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Remove upstream patches
- Grub: handle '+' in kernel command line options (RHBZ#1769314)
- Grub: better handle invalid grub.conf files (RHBZ#1649262)
- Sudoers: handle "always_query_group_plugin" option (RHBZ#1649299)
- Remove patch vim-ftdetect-syntax.patch. It's upstream
- New version
- Backport some upstream commits to fix few memory leaks, and potential
memory issues (RHBZ#1602446)
- Update to 1.8.0
- Rebuild for readline 7.x
- Fix /etc/sysconfig/network (RHBZ#904222).
- New version; remove all patches
- Upstream patch proposed to fix GCC optimization bug (RHBZ#651992).
- Rsyslog: support multiple actions in filters and selectors (RHBZ#1660884)
- New version
- New version
- New version
- Fix completion with special characters in augtool. (RHBZ#1232224)
- Krb5: improve handling of [dbmodules]; allow include/includedir directives
everywhere (RHBZ#1798486)
- Systemd: improve parsing of quoted variables of Environment (RHBZ#1798922)
- Disable static libraries, not needed in RHEL.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Add patch for Krb5, parse braces in values (RHBZ#1079444)
- Add patch to resolve missing libxml2 requirement in augeas.pc.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- fadot isn't being installed just yet
- New program /usr/bin/fadot
- New version
- Ssh: parse Match options (RHBZ#1716359)
- Initial specfile
- Add patch pathx-whitespace-ea010d8.patch to fix BZ 700608
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Include new xorg lens from upstream
- New upstream version 1.9.0 (RHBZ#1482713)
- Add -static subpackage (RHBZ#1405600)
- riscv64: Disable gnulib tests on riscv64 architecture.
- Update to 1.1.0; remove all patches
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- New version
- Rsyslog: support include() directive (RHBZ#1652832)
- Patches based on upstream fix for BZ 600141
- Don't package lenses in tests/ subdirectory.
- Update to version 0.7.4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update to 1.7.0
- New version; removed patch pathx-whitespace-ea010d8
- Update to 1.5.0
- Install vim syntax files
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Add patches for bugs 247 and 248 (JSON lens)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Remove separate xorg.aug, included in upstream source
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Anaconda: new lens (RHBZ#1657192)
- New version
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Semanage: new lens (RHBZ#1652840)
- Add "Provides: bundled(gnulib)" to augeas-libs, as it embeds gnulib
(RHBZ#1653768)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- New upstream version 1.10.1
- New upstream version 1.8.1.
- Fixes CVE-2017-7555 (RHBZ#1482340).
- Update to 1.2.0, add check section
- Update source URL to download.augeas.net (RHBZ#996032)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Fix parsing of semanage.conf ignoredirs
resolves: rhbz#1931058
- Fix ftdetect file for vim
- Update to 1.3.0; remove all patches
- Fix parsing of mke2fs.conf files
resolves: rhbz#1807010
autofs-5.1.4-114.el8_10.6.x86_64.rpm | - Incorporate patch from Ian which fixes an infinite loop seen by those
running older versions of the kernel patches (triggered by non-strict mounts
being the default).
- another fix for don't fail on empty master map.
- Correction to host name validation test for connectathon tests.
- Pass --libdir= to ./configure so we get this right on 64 bit platforms that
support backwards compat.
- add patch to initialize sasl callbacks unconditionally on autofs
LDAP lookup library load.
- cthon more parser corrections and attempt to fix multi-mounts
with various combinations of submounts (still not right).
- use spec file systemd unit file location.
- fix ipv6 name lookup check.
- fix ipv6 rpc calls.
- fix ipv6 configure check.
- add piddir to configure.
- add systemd unit support.
- fix MNT_DETACH define.
- fix function to check mount.nfs version.
- bz2161336 - Users can trigger a simple autofs DoS with wildcard automounter maps
- fail on empty trailing replicated host name.
- Resolves: rhbz#2161336
- bz1858742 - autofs share doesn't mount when using nobind over RDMA where
nfs-server and nfs-client are the same systems.
- mount_nfs.c fix local rdma share not mounting.
-Resolves: rhbz#1858742
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- fix included map lookup.
- fix directory cleanup on expire.
- fix task cancelation at shutdown.
- fix included map wild card key lookup.
- Fix some bugs in the parser
- allow -net instead of /etc/auto.net
- Fix a buffer overflow with large key lengths
- Don't allow autofs to unlink files, only to remove directories
- change to the upstream reentrant syslog patch from the band-aid deferred
syslog patch.
- Get rid of the init script patch that hard-coded the release to redhat.
This should be handled properly by all red hat distros.
- fix ext4 "preen" fsck at mount.
- add libsss_autofs as a build dependency.
- fix get_query_dn not looking in subtree for LDAP search.
- allow syntax "--timeout " for backward compatibility
(bz 193948).
- make masked_match independent of hostname for exports comparison
(bz 209638).
- add free for working var in get_default_logging.
- add inialisation for kver in autofs_point struct.
- fix sources list corruption in check_update_map_sources.
- fix memory leak in walk_tree.
- fix memory leak in rpc_portmap_getport and rpc_ping_proto.
- fix memory leak in initialisation of lookup modules.
- alter nfs4 host probing to not use portmap lookup and add options
check for "port=" parameter (bz 208757).
- correct semantics of "-null" map handling (bzs 214800, 208091).
- bz2069097 - libnss_sss: threads stuck at sss_nss_lock from initgroups
- dont use initgroups() at spawn.
- Resolves: rhbz#2069097
- updated hesiod patch.
- Somehow the -browse patch either didn't get committed or got reverted.
Fixed.
- RHEL-111930 - automount blocked when attempting to lookup ldap maps
- fix missing unlock in sasl_do_kinit_ext_cc().
- Resolves: RHEL-111930
- fix restart not working (bz624694).
- check for path mount location in generic module.
- dont fail mount on access fail.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Removed ineffective lock stuff
- Added -n to bind mount to prevent mtab update error
- Added retry to autofs umount to clean matb after fail
- Redirected messages from above to debug log and added info message
- Fixed autofs4 module reentrancy, pwd and chroot handling
- Fixed autofs4 ghosting patch for 2.4.19 and above (again)
- Fixed autofs directory removal on failure of autofs mount
- Fixed lock file wait function overlapping calls to (u)mount
- fix typo in patch for incorrect pthreads condition handling patch.
- add mutex call return check in defaults.c.
- Only read one auto.master map (instead of concatenating all found sources).
- Uncomment Ian's experimental mount expiry patch.
- fix incorrect changelog entry for bug 1802251.
- Related: rhbz#1802251
- fix expire calling kernel more often than needed.
- fix unlink of mount tree incorrectly causing autofs mount fail.
- add miscellaneous device node interface library.
- use miscellaneous device node, if available, for active restart.
- device node and active restart fixes.
- update is_mounted to use device node ioctl, if available.
- bz2214444 - The sss lookup modules handles error return incorrectly
in some cases
- fix some sss error return cases.
- Resolves: rhbz#2214444
- misc man page fixes (bz948517).
- Update to autofs-5.1.1.
- fix stale initialization for file map instance.
- RHEL-90238 - autofs fails to mount shares when using kerberised LDAP (RHEL 8)
- fix ldap sasl reconnect problem.
- always recreate credential cache.
- fix always recreate credential cache.
- Resolves: RHEL-90238
- Update to 4.1.1, as it fixes problems with wildcards that people are
seeing quite a bit.
- fix parsing of bad mount mount point in master map (bz 215620).
- fix use after free memory access in cache.c and lookup_yp.c (bz 208091).
- eliminate use of pthread_kill to detect task completion (bz 208091).
- Fix bug in get_best_mount, whereby if there is only one option, we
choose nothing. This is primarily due to the fact that we pass 0 in to
the get_best_mount function for the long timeout parameter. So, we
timeout trying to contact our first and only server, and never retry.
- fix compile error in defaults.c.
- add serialization to sasl init.
- dont allocate dev_ctl_ops too early.
- fix incorrect round robin host detection.
- fix race accessing qdn in get_query_dn().
- fix leak in cache_push_mapent().
- fix config entry read buffer not checked.
- fix FILE pointer check in defaults_read_config().
- fix memory leak in conf_amd_get_log_options().
- fix signed comparison in inet_fill_net().
- fix buffer size checks in get_network_proximity().
- fix leak in get_network_proximity().
- fix buffer size checks in merge_options().
- check amd lex buffer len before copy.
- add return check in ldap check_map_indirect().
- check host macro is set before use.
- check options length before use in parse_amd.c.
- fix some out of order evaluations in parse_amd.c.
- fix copy and paste error in dup_defaults_entry().
- allow global macro defines to override system macros.
- correct spelling error in default config files missed by
previous update.
- misc correctness and a memory leak fix.
- fix bad token declaration in master map parser.
- make use of spaces and tabs in spec file consistent.
- escape embedded macro text in %changelog.
- eliminate redundant %version and %release.
- remove redundant conditional check from %clean.
- remove redundant exit from %preun.
- correct %defattr spec.
- remove empty %doc and redundant %dir misc lines.
- combine program module spec lines into simpler one line form.
- update the "task done race" patch to fix a deadlock.
- added URL tag.
- removed obsoletes autofs-ldap.
- replaced init directory paths with %{_initrddir} macro.
- promote to beta5.
- correct buffer length setting in autofs-5.0.3-fix-ifc-buff-size-fix.patch.
- use intr option as hosts mount default.
- sync kernel includes with upstream kernel.
- dont umount existing direct mount on master re-read.
- fix incorrect shutdown introduced by library relaod fixes.
- improve manual umount recovery.
- dont fail on ipv6 address when adding host.
- always read file maps multi map fix.
- always read file maps key lookup fixes.
- add support for LDAP_URI="ldap:///" SRV RR lookup.
- fix get_query_dn not looking in subtree for LDAP search (missed
econd occurance).
- allow additional common LDAP attributes in map dn.
- Resolves: rhbz#205997
- Add a sysconfig entry to disable direct map support, and set this to
1 by default.
- Disable the beta map expiry logic so I can build into a stable distro.
- Add defaults for all of the sysconfig variables to the init script so
we don't trip over user errors (i.e. deleting /etc/sysconfig/autofs).
- Changed to sort -k 1, since that should be the same as +0.
- dont fail on master map self include.
- fix wildcard multi map regression.
- fix file descriptor leak when reloading the daemon.
- depricate nosymlink pseudo option.
- add symlink pseudo option.
- update kernel include files.
- fix requires in spec file.
- fix libtirpc build option.
- fix systemd unidir in spec file.
- document browse option in man page.
- fix automounter support on parisc.
- bz1912106 - Using -hosts option does not resolve host from /etc/hosts and mount
failes
- Coverity fixes
- add missing free in handle_mounts().
- remove redundant if check.
- fix possible memory leak in master_parse().
- fix possible memory leak in mnts_add_amdmount().
- fix double unlock in parse_mount().
- add length check in umount_subtree_mounts().
- fix flags check in umount_multi().
- dont try umount after stat() ENOENT fail.
- remove redundant assignment in master_add_amd_mount_section_mounts().
- fix dead code in mnts_add_mount().
- fix arg not used in error print.
- fix missing lock release in mount_subtree().
- fix double free in parse_mapent().
- refactor lookup_prune_one_cache() a bit.
- cater for empty mounts list in mnts_get_expire_list().
- add ext_mount_hash_mutex lock helpers.
- Related: rhbz#1912106
- cthon corrections for shutdown patch below and fix shutdown expire.
- fix lsb init script header.
- fix memory leak reading ldap master map.
- fix st_remove_tasks() locking.
- reset flex scanner when setting buffer.
- zero s_magic is valid.
- fix flag file permission.
- fix directory create permission.
- bz2139504 - segfault due to lookup_mod->context address being freed
and reused while multiple threads were using it
- fix hosts map deadlock on restart.
- fix deadlock with hosts map reload.
- Related: rhbz#2139504
- Fix potential double free in cache_release. This bug showed up in a
multi-map setup. Two calls to cache_release would result in a SIGSEGV,
and the automount process would never exit.
- fix incorrect committer changelog entries.
- add current released upstream patches.
- bz1743442 - getmntent returns additional "-hosts" entries when
automounter is used with "hosts" map (userspace part)
- also use strictexpire for offsets (mounts).
- change expire type naming to better reflect usage.
- remove unused function has_fstab_option().
- remove unused function reverse_mnt_list().
- remove a couple of old debug messages.
- fix amd entry memory leak.
- fix unlink_mount_tree() not umounting mounts.
- add ignore mount option.
- use ignore option for offset mounts as well.
- add config option for "ignore" mount option.
- use bit flags for autofs mount types in mnt_list.
- use mp instead of path in mnt_list entries.
- always use PROC_MOUNTS to make mount lists.
- add glibc getmntent_r().
- use local getmntent_r in table_is_mounted().
- refactor unlink_active_mounts() in direct.c.
- don't use tree_is_mounted() for mounted checks.
- use single unlink_umount_tree() for both direct and indirect mounts.
- move unlink_mount_tree() to lib/mounts.c.
- use local_getmntent_r() for unlink_mount_tree().
- use local getmntent_r() in get_mnt_list().
- use local getmntent_r() in tree_make_mnt_list().
- fix missing initialization of autofs_point flags.
- Resolves: rhbz#1743442
- bz1841456 - automount program crashes with "malloc(): invalid next size
(unsorted)
- fix autofs mount options construction.
-Related: rhbz#1841456
- correct configure test for ldap page control functions.
- fix directory creation for browse mounts.
- fix wildcard map handling and improve nsswitch source map update.
- Fixed tree mounts.
- Corrected transciption error in autofs4-2.4.18 kernel module
- Fixed an error in the init script which caused duplicate entries to be
displayed when asking for autofs status.
- deal with changed semantics of mkdir in recent kernels.
- Add patch to allow customization of arguments to the
autofs-ldap-auto-master program (bz #187525).
- Add patch to escap "#" characters in exports from auto.net
program mount (bz#178304).
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- fix "null" domain netgroup match for "-hosts" map.
- bz2149206 - RHEL9: automount does not handle null option string after
"-" anymore
- fix changelog entry.
- Related: rhbz#2149206
- fix timeout in connect_nb().
- bz1703876 - [RFE] Enable additional logging information for autofs
- add NULL check for get_addr_string() return.
- use malloc(3) in spawn.c.
- add mount_verbose configuration option.
- optionally log mount requestor process info.
- log mount call arguments if mount_verbose is set.
- Resolves: rhbz#1703876
- add back test for nested mount in program map lookup.
- I must have commented this out for a reason. I guess we'll
find out soon enough.
- Add the /etc/sysconfig/autofs file, and supporting infrastructure in
the init script.
- Add support for UNDERSCORE_TO_DOT for those who want it.
- We no longer own /net. Move it to the filesystem package.
- Fix tag confusion.
- amd lookup update lookup ldap to handle amd keys
- inadvertantly drop from initial series.
- amd lookup update lookup hesiod to handle amd keys
- inadvertantly drop from initial series.
- fix wildcard key lookup.
- check for non existent negative entries in lookup_ghost().
- fix nonstrict multi-mount handling (bz 219383).
- correct detection of duplicate indirect mount entries (bz 220799).
- fix LDAP lookup delete cache entry only if entry doesn't exist.
- add missing socket close in replicated host check (Jeff Moyer).
- Fix ldap init code to parse server name and options correctly.
- Add a BuildPrereq for cyrus-sasl-devel
- fix an RPC fd leak.
- don't block signals we expect to dump core.
- fix pthread push order in expire_proc_direct().
- fix libxml2 non-thread-safe calls.
- fix direct map cache locking.
- fix patch "dont umount existing direct mount on reread" deadlock.
- dont probe rdma mounts.
- fix default path used for unitdir.
- fix changelog inconsistent dates.
- fix handling of autofs filesystem mount fail on init.
- add patch to use "cifs" instead of smbfs and escape speces
in share names (bz #163999, #187732).
- bz1613630 - On Red Hat 7.x systems if you try to access local
filesystems using the automounter through /net then the shell
and mount could lock up *if* the filesystem your accessing is
double exported.
- set bind mount as propagation slave.
- add master map pseudo options for mount propagation.
- Resolves: rhbz#1613630
- lookup_init cleanup and fix missed memory leak.
- use nis map order to check if update is needed.
- fix couple of memory leaks in lookup_yp.c.
- fix pasre error in replicated server module.
- Make autofs understand -[no]browse. Addresses fz #113494.
- bz1954430 - Please, rebuild autofs-5.1.4-66.el8
- rebuild with fixed binutils.
- Resolves: rhbz#1954430
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- add missing sasl mutex callbacks.
- add after sssd dependency to unit file (bz984089).
- fix included map read fail handling.
- refactor ldap sasl authentication bind to eliminate extra connect
causing some servers to reject the request.
- add mount wait parameter to allow timeout of mount requests to
unresponsive servers.
- special case cifs escape handling.
- fix libxml2 workaround configure.
- more code analysis corrections (and fix a typo in an init script).
- fix backwards #ifndef INET6.
- update hesiod module (Jeff Moyer).
- add mutex to protect against overlapping mount requests.
- update return from mount request to give more sensible NSS_*
values.
- remove URL tag as there is not official autofs wiki (bz529804).
- add configuration variable to control appending of global options (bz 214684).
- add command option to set a global mount options string (bz 214684).
- Update to autofs-5.0.1-beta1.
- bz2148872 - autofs: errors in autofs-5.1.4-83.el8.x86_64 when restarting
autofs with busy directories
- fix incorrect path for is_mounted() in try_remount().
- Resolves: rhbz#2148872
- bz1681956 - autofs changes blocked until gating tests are added
- add gating.yaml for manual gate testing.
- Related: rhbz#1681956
- bz2149206 - RHEL9: automount does not handle null option string after
"-" anymore
- fix concat_options() error handling.
- fix minus only option handling in concat_options().
- Resolves: rhbz#2149206
- fix mntent.h not included before use of setmntent_r().
- misc fixes for things found while investigating map re-read problem.
- fix memory leak on reload (bz545137).
- Add openssl-devel to the BuildRequires, as it is needed for the LDAP
authentication bitsi also.
- change mount "device" from "automount" to the map name.
- check for buffer overflow in mount_afs.c.
- replace tempnam with mkdtemp.
- rebuilt
- Added work around for O(1) patch oddity.
- bz1577700 - automount leaves FDs in half-open state
- fix fd leak in rpc_do_create_client().
- Resolves: rhbz#1577700
- Implemented LDAP direct map handling for nisMap and automountMap schema
- Fixed autofs4 ghosting patch for 2.4.19 and above (again)
- Added locking to fix overlapping internal calls to (u)mount
- Added wait for mtab~ to improve tolerance of overlapping external calls to (u)mount
- Fixed ghosted directory removal after failed mount attempt
- Code cleanup and fixes for connectathon tests.
- Fixed a problem with backwards compatability. Specifying local
maps without '/etc/' prepended to them now works. (bz #136038)
- RHEL-84118 - autofs hang - autofs-5.1.4-114.el8_10.2
- fix lock ordering deadlock in expire_cleanup().
- change spec file %patchN to %patch -P N as required by rpm(8).
- Resolves: RHEL-84118
- fix stale initialization for file map instance patch was not applied.
- add correct patch for "fix improve mount location error reporting".
- add correct patch for "fix fix wait for master source mutex".
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Removed the /misc entry from the default auto.master. auto.misc has
an entry for the cdrom device, and the preferred method of mounting the
cd is via udev/hal.
- correct test for existence of auth config file.
- add export access list matching to "hosts" lookup module (bz # 193585).
- Fix a socket leak in the rpc_subs, causing mounts to fail since we are
running out of port space fairly quickly.
- improve hostname lookup error logging.
- remove fullstop from Summary tag.
- change Buildroot to recommended form.
- replace Prereq with Requires.
- Ian has a new fix for replicated server and multi-mounts. Updated the
patch for testing. Still beta. (Ian Kent)
- Add in an error case that was omitted in the multi-over patch.
- Update our auto.net to reflect the changes that went into 4.1.4_beta2.
This fixes a problem seen by at least one customer where a malformed entry
appeared first in the multimount list, thus causing the entire multimount
to be ignored. This new auto.net places that entry at the end, purely by
luck, but it fixes the problem in this one case.
- expand export access checks to include missing syntax options.
- make "-hosts" module try to be sensitive to exports list changes.
- correct mkdir command in %install section, bz481132.
- bz1611866 - autofs reload is unable to activate new map entries,
it is autofs restart which shows new map entries.
- fix update_negative_cache() map source usage.
- bz1613621 - [autofs]Removed entries still can be accessed
- mark removed cache entry negative.
- Resolves: rhbz#1611866 rhbz#1613621
- Remove old crufty coreutils requires
- Add bad chdir patch from Ian Kent.
- Add a typo fix for the mtab lock file.
- Nuke the stripdash patch. It didn't solve a problem.
- make default installed master map for /net use "-hosts" instead
of auto.net.
- fix included map recursive map key lookup.
- consolidate to beta6, including:
- mode change update for config file.
- correction to get_query_dn fix from beta5-4.
- add patch to ignore the "bg" and "fg" mount options as they
aren't relevant for autofs mounts (bz #184386).
- Update to upstream version 5.0.7.
- correct check for busy offset mounts before offset umount (bz 222872).
- fix directory cleanup at exit.
- fix probe each nfs version in turn for singleton mounts (bz973537).
- update to upstream release, 5.1.0.
- fix reset flex scan buffer on init.
- fix fix negative status being reset on map read.
- fix out of order amd timestamp lookup.
- fix ldap default schema config.
- fix ldap default master map name config.
- fix map format init in lookup_init().
- fix incorrect max key length in defaults get_hash().
- fix xfn sets incorrect lexer state.
- fix old style key lookup.
- fix expire when server not responding.
- fix ldap_uri config update.
- fix typo in conf_load_autofs_defaults().
- fix hash on confg option add and delete.
- add plus to path match pattern.
- fix multi entry ldap option handling.
- cleanup options in amd_parse.c.
- allow empty value for some map options.
- allow empty value in macro selectors.
- fix install permissions of auto.net and auto.smb.
- fix portmap not trying proto v2.
- dont allow trailing slash in master map mount points.
- fix libresolv configure check.
- add fedfs-getsrvinfo.c.
- add mount.fedfs.c.
- add fedfs-map-nfs4.c
- add conditional inclusion of fedfs binaries.
- add an example fedfs master map entry to the installed master map.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- update systemd scriplet macros (bz850040).
- check for nohide mounts (bz 442618).
- ignore nsswitch sources that aren't supported (bz 445880).
- add upstream bug fixes
- bug fix for mtab check.
- bug fix for zero length nis key.
- update for ifc buffer handling.
- bug fix for kernel automount handling.
- warning: I found a bunch of patches that were present but not
being applied.
- fix libxml2 version check for deciding whether to use workaround.
- bz1835547 - [RHEL8]autofs cannot mount samba/cifs shares that end with a
dollar sign
- fix trailing dollar sun entry expansion.
- Resolves: rhbz#1835547
- Make local options apply to all maps in a multi-map entry.
- update multi map nsswitch patch.
- fix a couple of compiler warnings.
- remove empty command line arguments (passed by systemd).
- fix master map lexer to admit "." in macro values.
- Change LDAP message severity from crit to degug (bz# 183893).
- Corrections to INSTALL and README.v5.release.
- Add patch to fix segv on overlength map keys in file maps (Jeff Moter).
- Add patch to restrict scanning of /proc to pid directories only (Jeff Moyer).
- bz2033552 - Using -hosts option does not work after upgrading from 8.4 to 8.5
- fix root offset error handling.
- fix nonstrict fail handling of last offset mount.
- dont fail on duplicate offset entry tree add.
- fix loop under run in cache_get_offset_parent().
- simplify cache_add() a little.
- fix use after free in tree_mapent_delete_offset_tree().
- fix memory leak in xdr_exports().
- avoid calling pthread_getspecific() with NULL key_thread_attempt_id.
- fix sysconf(3) return handling.
- Resolves: rhbz#2033552
- improve mount location error reporting.
- fix paged query more results check.
- fix dumpmaps not reading maps.
- fix result null check in read_one_map().
- Fix LDAP result leaks on error paths.
- code analysis fixes 1.
- fix not bind mounting local filesystem.
- update dir map-type patch for changed patch order.
- fix wait for master source mutex.
- fix submount shutdown race
- fix fix map source check in file lookup.
- add disable move mount configure option.
- expire individual submounts.
- add ino_index locking.
- fix nested submount expiring away when pwd is base of submount.
- more expire re-work to cope better with shutdown following cthon tests.
- allow hostname to start with numeric when validating.
- bz1630190 - yum update hanging while restarting autofs
- fix incorrect locking in sss lookup.
- bz1630194 - after upgrading to autofs-5.0.7-83.el7.x86_64 on
RHEL 7 clients, amd maps /defaults key mount options are no
longer working
- fix amd parser opts option handling.
- Resolves: rhbz#1630190 rhbz#1630194
- enable hesiod support over libbind
- add LSB init script parameter block.
- fix libtirpc name clash (bz821847).
- bz2177998 - deadlock while reading amd maps
- rebuild to avoid possible NVR problems.
- Related: rhbz#2177998
- Program maps can repeat the last character of output. Fix this.
Addresses bz #138606
- Return first entry when there are duplicate keys in a map. Addresses
bz #140108.
- Propagate custom map variables to submounts. Fixes bz #143074.
- Create a sysconfig variable to control whether we source only one master
map (the way sun does), or source all maps found (which is the default for
backwards compatibility). Addresses bz #143126.
- Revised version of the get_best_mount patch. (#146887) cfeist@redhat.com
The previous patch introduced a regression. Non-replicated mounts would
not have the white space stripped from the entry and the mount would fail.
- Handle comment characters in the middle of the automount line in
/etc/nsswitch.conf. Addresses bz #127457.
- bz1638487 - Drop dependency on hesiod
- better handle hesiod support not built in.
- exclude hesiod support from configure options
- remove hesiod depends.
- Resolves: rhbz#1638487
- fix typo in libtirpc file name.
- fix rework error return handling in rpc code.
- allow MOUNT_WAIT to override probe.
- improve UDP RPC timeout handling.
- fix segfault in get_query_dn().
- use strtok_r() in linux_version_code().
- fix sss wildcard match.
- fix dlopen() error handling in sss module.
- fix configure string length tests for sss library.
- use weight only for server selection.
- fix isspace() wild card substition.
- auto adjust ldap page size.
- fix prune cache valid check.
- fix mountd vers retry.
- fix expire race.
- add lsb force-reload and try-restart.
- consolidate to rc2.
- fix colon escape handling.
- fix recusively referenced bind automounts.
- update kernel patches.
- I reversed the checking for multimount entries, breaking those configs!
This update puts the code back the way it was before I broke it.
- bz1841456 - automount program crashes with "malloc(): invalid next size
(unsorted)
- initialize struct addrinfo for getaddrinfo() calls.
- fix quoted string length calc in expandsunent().
-Resolves: rhbz#1841456
- fix rpc build error.
- add sss lookup module.
- teach automount about sss source.
- The sort command no longer accepts options of the form "+0". This broke
auto.net, so the option was removed. Fixes bz #172111.
- Perform an icmp ping request before rpc_pings, since the rpc clnt_create
function has a builtin default timeout of 60 seconds. This could result
in a long delay when a server in a replicated mount setup is down.
- For non-replicated server entries, ping a host before attempting to mount.
(Ian Kent)
- Change to %configure.
- Put version-release into .version to allow for automount --version to
print exact info.
- Nuke my get-best-mount patch which always uses the long timeout. This
should no longer be needed.
- Put name into changelog entries to make them consistent. Add e:n-v-r
into Florian's entry.
- Stop autofs before uninstalling
- dont use array for path when not necessary.
- fix prefix option handling in expand_entry().
- fix sublink option not set from defaults.
- fix error return in do_nfs_mount().
- bz2025509 - Autofs auto.smb awk script fails on shares with dollar signs
- fix double quoting in auto.smb.
- fix double quoting of ampersand in auto.smb as well.
- Resolves: rhbz#2025509
- tidy up directory cleanup and add validation check to rmdir_path.
- make the init script only recognize redhat systems. Nalin seems to remember
some arcane build system error that can be caused if we don't do this.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Check the return code of is_local_addr in get_best_mount. (bz #169523)
- replace GPLv3 code with GPLv2 equivalent.
- fix schema selection in LDAP schema discovery.
- check for "*" when looking up wildcard in LDAP.
- fix couple of edge case parse fails of timeout option.
- add SEARCH_BASE configuration option.
- add random selection as a master map entry option.
- re-read config on HUP signal.
- add LDAP_URI, LDAP_TIMEOUT and LDAP_NETWORK_TIMEOUT configuration options.
- fix deadlock in submount mount module.
- fix lack of ferror() checking when reading files.
- fix typo in autofs(5) man page.
- fix map entry expansion when undefined macro is present.
- remove unused export validation code.
- add dynamic logging (adapted from v4 patch from Jeff Moyer).
- fix recursive loopback mounts (Matthias Koenig).
- add map re-load to verbose logging.
- fix handling of LDAP base dns with spaces.
- handle MTAB_NOTUPDATED status return from mount.
- when default master map, auto.master, is used also check for auto_master.
- update negative mount timeout handling.
- fix large group handling (Ryan Thomas).
- fix for dynamic logging breaking non-sasl build (Guillaume Rousse).
- eliminate NULL proc ping for singleton host or local mounts.
- fix syncronize of handle_mounts() shutdown.
- fix submount tree not all expiring.
- fix nobind man page description.
- ignore duplicate exports in auto.net.
- add kernel verion check function.
- add function to check mount.nfs version.
- reinstate singleton mount probe.
- rework error return handling in rpc code.
- catch EHOSTUNREACH and bail out early.
- systemd support fixes.
- fix segmentation fault in do_remount_indirect().
- cthon fix expire of various forms of nested mounts.
- rebuilt for new gcc4.1 snapshot and glibc changes
- Fixed the duplicate map detection code to detect if maps try
to mount on top of existing maps.
- bz1973025 - /net mount being not cleanly mounted and unmounted
- fix nonstrict offset mount fail handling.
- Resolves: rhbz#1973025
- fix cache entrys not being cleaned up on submount expire.
- fix changelog message commit dates.
- actually apply fix use after free in do_master_list_reset().
- fix deadlock in dumpmaps.
- fix rpcgen dependency problem.
- Bug 426401: CVE-2007-6285 autofs default doesn't set nodev in /net [rawhide]
- use mount option "nodev" for "-hosts" map unless "dev" is explicily specified.
- fix negative caching of non-existent keys.
- fix ldap library detection in configure.
- use CLOEXEC flag functionality if present.
- fix select(2) fd limit.
- make hash table scale to thousands of entries.
- fix master map source server unavailable handling.
- add autofs_ldap_auth.conf man page.
- fix random selection for host on different network.
- make redhat init script more lsb compliant.
- don't hold lock for simple mounts.
- fix remount locking.
- fix wildcard map entry match.
- fix parse_sun() module init.
- dont check null cache on expire.
- fix null cache race.
- fix cache_init() on source re-read.
- fix mapent becomes negative during lookup.
- check each dc server individually.
- fix negative cache included map lookup.
- remove state machine timed wait.
- bz1615782 - autofs master map age is incorrectly set
- fix age setting at startup.
- Resolves: rhbz#1615782
- bz1969210 - autofs: already mounted as other than autofs or failed to unlink
entry in tree
- fix empty mounts list return from unlink_mount_tree().
- Resolves: rhbz#1969210
- change file map lexer to allow white-space only blank lines (bz 229434).
- update to beta4.
- should address at least bzs 193798, 193770, 193831 and
possibly 193832.
- fix a bug in the program map parsing routine
- Version 3 of Ian's map expiry changes.
- bz1593492 - Ignore trailing slashes at the end of executable maps in
auto.master config file
- add-man page note about extra slashes in paths
- Resolves: rhbz#1593492
- revert fix libtirpc name clash patch (an old 5.0.6 patch).
- update master map tokenizer to admit "slasify-colons" option.
- update location validation to accept "_" (bz 219445).
- set close-on-exec flag on open sockets (bz 215757).
- bz1958487 - autofs amd mounts present in the configuration get umounted
on reload
- fix amd section mounts map reload.
- bz1958485 - autofs amd type host mounts fail for certain host names
- fix amd hosts mount expire.
- Resolves: rhbz#1958487 rhbz#1958485
- force disable browse mode for amd format maps.
- fix hosts map options check in lookup_amd_instance().
- fix memory leak in create_client().
- fix memory leak in get_exports().
- fix memory leak in get_defaults_entry().
- fix out of order clearing of options buffer.
- fix reset amd lexer scan buffer.
- ignore multiple commas in options strings.
- fix typo in flagdir configure option.
- clarify multiple mounts description.
- gaurd against incorrect umount return.
- update man page autofs(8) for systemd.
- remove ancient kernel Requires.
- fix deadlock in alarm manager module.
- fix install mode of autofs_ldap_auth.conf.
- bz1912106 - Using -hosts option does not resolve host from /etc/hosts and mount
failes
- fix unapplied patch.
- remove unused variable from get_exports().
- Related: rhbz#1912106
- fix rpc fail on large export list (bz543023).
- fix fix gcc5 complaints.
- update libtirpc workaround for new soname.
- rebuilt
- fix mount point directory creation for bind mounts.
- add quoting for exports gathered by hosts map.
- Added a variable to determine if we created the directory or not
so we don't accidently remove a directory that we didn't create when
we stop autofs. (bz #134399)
- correct auto.net installed as auto.smb.
- update LDAP auth - add autodectect option.
- remove ERR_remove_state() openssl call.
- re-instate v4 directory cleanup (bz# 193832 again).
- backout master map lookup changes made to beta3.
- change default master map from /etc/auto.master to auto.master
so that we always use nsswitch to locate master map.
- change default installed master map to include "+auto.master"
to pickup NIS master map (all bz# 193831 again).
- Ported forward Red Hat's patches from 3.1.7 that were not already present
in 4.1.0.
- Moving autofs from version 3.1.7 to 4.1.0
- configure: allow cross compilation update.
- fix date in changelog entry.
- enable mtab locking until I can resolve the race with it.
- bz1689469 - [autofs] The log no longer print PID of automount process
- remove autofs4 module load code.
- add NULL check in prepare_attempt_prefix().
- update build info with systemd.
- use flags for startup boolean options.
- move close stdio descriptors to become_daemon().
- add systemd service command line option.
- Resolves: rhbz#1689469
- bz1664561 - incorrect of start service command in autofs man page
- fix incorrect systemctl command syntax in autofs(8).
-Resolves: rhbz#1664561
- RHEL-7997 - multi mount detection fails for share with blank+dash
causing SEGV crash
-fix multi-mount check.
-Resolves: RHEL-7997
- add ldaps support.
- note: it's no longer possible to have multiple hosts in an ldap map spec.
- note: to do this you need to rely on the ldap client config.
- Fix a call to spawnl which forgot to specify a lock file. (nphilipp)
- fix fix master map type check.
- add patch from rth to avoid an infinite loop
- update to release tar.
- fix return check for getpwuid_r and getgrgid_r.
- patch to give up trying to update exports list while host is mounted.
- fix to "@network" matching.
- patch to check for fstab update and retry if not updated.
- add descriptive comments to config about LDAP schema discovery.
- work around segfault at exit caused by libxml2.
- fix foreground logging (also fixes shutdown needing extra signal bug).
- allow --with-systemd to take a path arg.
- fix WITH_LIBTIRPC function name.
- fix ipv6 libtirpc getport (bz1033918).
- fix return start status on fail.
- fix double free in expire_proc().
- add a preun script to remove autofs
- cleanup defaults_read_config (Jeff Moyer).
- remove ability to use multiple indirect mount entries in master
map (bz 218616).
- Fixed i18n bug #107461
- fix segfault upon reconnect cannot find valid base dn.
- revert wait for master map to be available at start.
- remove extra read master map call.
- remove extra cache create call in master_add_map_source().
- fix error handing in do_mount_indirect().
- expire thread use pending mutex.
- explicity link against the Kerberos library.
- remove some log message duplication for verbose logging.
- fix segv during library re-open.
- fix incorrect pthreads condition handling for expire requests.
- fix master map lexer eval order.
- fix bad alloca usage.
- fix undefined authtype_requires_creds err if ldap enabled but without sasl.
- fix master map type check.
- fix task manager not getting signaled.
- bz1965862 - A recent Coverity change can cause an infinit loop on map reload
- fix lookup_prune_one_cache() refactoring change.
- bz1963129 - auto.master manpage doesn't mention -null or other built-in maps
- add missing desciption of null map option.
- Resolves: rhbz#1965862 rhbz#1963129
- Fixed regression causing any entries after a wildcard in an
indirect map to be ignored. (bz #151668).
- Fixed regression which caused local hosts to be mount instead
of --bind local directories. (bz #146887)
- use misc device ioctl interface by default, if available.
- bz1664561 - incorrect of start service command in autofs man page
- actually apply fix patch.
- fix dates and recent status messages in changelog.
-Related: rhbz#1664561 rhbz#1858742
- Fix the install permissions for auto.master and auto.misc.
- The lookup_yp module only dealt with YPERR_KEY, all other errors were
treated as success. As a result, if the ypdomain was not bound, the
subprocess that starts mounts would SIGSEGV. This is now fixed.
- Option parsing in the init script was not precise enough, sometimes matching
filesystem options to one of --ghost, --timeout, --verbose, or --debug.
The option-parsing patch addresses this issue by making the regexp's much
more precise.
- Ian has rolled a third version of the replicated mount fixes.
- fix lexer ambiguity in match when map type name is included in map name.
- add missing "multi" map support.
- add multi map nsswitch lookup.
- revert miscellaneous device node related patches.
- add missing check for zero length NIS key.
- fix incorrect match of map type name when included in map name.
- update rev 7 sasl callbacks patch.
- another try a fixing lexer matching map type in map name.
- bz2208408 - autofs fails to start with combination of +auto.master and
local direct map lookups after upgrading to 5.1.4-93.el8
- fix memory leak in sasl_do_kinit() (Coverity).
- fix fix mount tree startup reconnect.
- Resolves: rhbz#2208408
- drop "DEFAULT_" prefix from configuration names.
- add option to select replicated server at random (instead of
ping response time) (bz 227604).
- fix incorrect cast in directory cleanup routines (bz 231864).
- RHEL-61670 - sporadic autofs daemon segfaults
- fix submount shutdown race.
- RHEL-52402 - Sporadic mount failures with amd program maps on RHEL8
- fix amd external mount error handling.
- fix amd external mount mount handling.
- don't free ext mount if mounted.
- refactor amd function do_program_mount().
- refactor umount_amd_ext_mount().
- add flags argument to amd do_program_mount().
- Resolves: RHEL-61670 RHEL-52402
- always read file maps mount lookup map read fix.
- fix direct map not updating on reread.
- add external bind method.
- fix add simple bind auth.
- add option to dump configured automount maps.
- wait for master map to be available at start.
- check base of offset mount tree is not a mount before umounting
its offsets.
- fix replicated mount parse for case where last name in list
fails lookup.
- correct indirect mount expire broken by the wildcard lookup fix.
- fix up multi-mount handling when wildcard map entry present.
- rebuild
- fix incorrect pthreads condition handling for mount requests.
- bz2139504 - segfault due to lookup_mod->context address being freed
and reused while multiple threads were using it
- fix memory leak in update_hosts_mounts().
- Related: rhbz#2139504
- fix "-fstype=nfs4" handling (bz 208757).
- merge LDAP authentication update for GSSAPI (Jeff Moyer).
- update default auth config to add options documenetation (Jeff Moyer).
- workaround segfaults at exit after using GSSAPI library.
- fix not checking return in init_ldap_connection (jeff Moyer).
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- fix localhost replicated mounts not working (bz 208757).
- fix lsb service name in init script (bz692963).
- bz2023740 - autofs: send FAIL cmd/ioctl mess when encountering problems
with mount trigger
- fix kernel mount status notification.
- Resolves: rhbz#2023740
- fix fuzz in CHANGELOG hunk when applying patch26.
- fix lsb service name in init script 2 (bz712504).
- correct config names in default.c (jpro@bas.ac.uk).
- update source to latest upstream version.
- this is essentially a consolidation of the patches already in this rpm.
- add dist tag to match latest RHEL-5 package tag format.
- fix array out of bounds accesses and cleanup couple of other alloca() calls.
- Undo mistake in copy order for submount path introduced by rev 11 patch.
- add check for alternate libxml2 library for libxml2 tsd workaround.
- add check for alternate libtirpc library for libtirpc tsd workaround.
- cleanup configure defines for libtirpc.
- add WITH_LIBTIRPC to -V status report.
- add libtirpc-devel to BuildRequires.
- add nfs mount protocol default configuration option.
- Fixed documentation so users know that any local mounts override
any other weighted mount.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Fix the umount loop device function in the init script.
- Update to upstream release 5.0.2.
- Added a patch to fix the automounter failing on ldap maps
when it couldn't get the whole map. (ie. when the search
limit was lower than the number of results)
- fix nested submount expire deadlock.
- fix LDAP schema discovery.
- Bump revison for inclusion in RHEL 3.
- bz2216877 - When looking up included maps, sometimes autofs does not
consult all the included files in order
- fix incorrect matching of cached wildcard key
- Resolves: rhbz#2216877
- bz1961492 - autofs: regression in offset ordering
- fix offset entries order.
- use mapent tree root for tree_mapent_add_node().
- eliminate redundant cache lookup in tree_mapent_add_node().
- fix hosts map offset order.
- fix direct mount deadlock.
- Resolves: rhbz#1961492
- fix ipv6 link local address handling.
- fix fix ipv6 libtirpc getport.
- get_nfs_info() should query portmapper if port is not given.
- fix rpc_portmap_getport() proto not set.
- fix context init error (introduced by memory leak patch).
- Update version label to avoid package update problems.
- change random multiple server selection option name to be consistent
with upstream naming.
- bz1973025 - /net mount being not cleanly mounted and unmounted
- correct patch, fix nonstrict offset mount fail handling.
- Related: rhbz#1973025
- fix status privilege error (bz627605).
- upstream fix for filesystem is local check.
- disable exports access control check (bz 203277).
- fix patch to add command option for set a global mount options (bz 214684).
- bz1974309 - Removal of default intr mount option while using -hosts
and host.net
- remove intr hosts map mount option.
- fix previous changelog entry revision.
- Resolves: rhbz#1974309
- cthon fix expire of wildcard and program mounts broken by recent
patches.
- Bug 421371: CVE-2007-5964 autofs defaults don't restrict suid in /net [rawhide]
- use mount option "nosuid" for "-hosts" map unless "suid" is explicily specified.
- update to upstream 5.1.2 release.
- remove unused option UNDERSCORETODOT from default config files.
- Moved the freeing of ap.path to cleanup_exit, as we would otherwise
reference an already-freed variable.
- fix hosts map use after free.
- fix uri list locking (again).
- check for stale SASL credentials upon connect fail.
- add "forcestart" and "forcerestart" init script options to allow
use of 5.0.3 strartup behavior if required.
- always read entire file map into cache to speed lookups.
- make MAX_ERR_BUF and PARSE_MAX_BUF use easier to audit.
- make some easy alloca replacements.
- update to configure libtirpc if present.
- update to provide ipv6 name and address support.
- update to provide ipv6 address parsing.
- don't fail on empty master map.
- add support for the "%" hack for case insensitive attribute schemas.
- Drop ancient 2.6 kernel patches from docs
- Import 4.1.4 and merge.
- dont connect at ldap lookup module init.
- fix random selection option.
- fix disable timeout.
- fix strdup() return value check.
- catch "-xfn" map type and issue "no supported" message.
- another correction for handling of LDAP base dns with spaces.
- Clarify documentation on direct maps.
- Send automount daemons a HUP signal during reload. This tells them to
re-read maps (otherwise they use a cached version. Patch from the autofs
maintainer.
- bz1912106 - Using -hosts option does not resolve host from /etc/hosts and mount
failes
- use defines for expire type.
- remove unused function dump_master().
- fix additional typing errors.
- make bind mounts propagation slave by default.
- fix browse dir not re-created on symlink expire.
- update list.h.
- add hashtable implementation.
- change mountpoint to mp in struct ext_mount.
- make external mounts independent of amd_entry.
- make external mounts use simpler hashtable.
- add a hash index to mnt_list.
- use mnt_list for submounts.
- use mnt_list for amdmounts.
- make umount_autofs() static.
- remove force parameter from umount_all().
- fix remount expire.
- fix stale offset directories disable mount.
- use struct mnt_list to track mounted mounts.
- use struct mnt_list mounted list for expire.
- remove unused function tree_get_mnt_list().
- only add expre alarm for active mounts.
- move submount check into conditional_alarm_add().
- move lib/master.c to daemon/master.c.
- use master_list_empty() for list empty check.
- add helper to construct mount point path.
- add xdr_exports().
- remove mount.x and rpcgen dependencies.
- dont use realloc in host exports list processing.
- use sprintf() when constructing hosts mapent.
- fix mnts_remove_amdmount() uses wrong list.
- eliminate cache_lookup_offset() usage.
- fix is mounted check on non existent path.
- simplify cache_get_parent().
- set offset parent in update_offset_entry().
- remove redundant variables from mount_autofs_offset().
- remove unused parameter form do_mount_autofs_offset().
- refactor umount_multi_triggers().
- eliminate clean_stale_multi_triggers().
- simplify mount_subtree() mount check.
- fix mnts_get_expire_list() expire list construction.
- fix inconsistent locking in umount_subtree_mounts().
- fix return from umount_subtree_mounts() on offset list delete.
- pass mapent_cache to update_offset_entry().
- fix inconsistent locking in parse_mount().
- remove unused mount offset list lock functions.
- eliminate count_mounts() from expire_proc_indirect().
- eliminate some strlen calls in offset handling.
- don't add offset mounts to mounted mounts table.
- reduce umount EBUSY check delay.
- cleanup cache_delete() a little.
- rename path to m_offset in update_offset_entry().
- don't pass root to do_mount_autofs_offset().
- rename tree implementation functions.
- fix program map multi-mount lookup after mount fail.
- add some multi-mount macros.
- remove unused functions cache_dump_multi() and cache_dump_cache().
- add a len field to struct autofs_point.
- make tree implementation data independent.
- add mapent tree implementation.
- add tree_mapent_add_node().
- add tree_mapent_delete_offsets().
- add tree_mapent_traverse_subtree().
- fix mount_fullpath().
- add tree_mapent_cleanup_offsets().
- add set_offset_tree_catatonic().
- add mount and umount offsets functions.
- switch to use tree implementation for offsets.
- remove obsolete functions.
- remove redundant local var from sun_mount().
- use mount_fullpath() in one spot in parse_mount().
- pass root length to mount_fullpath().
- remove unused function master_submount_list_empty().
- move amd mounts removal into lib/mounts.c.
- check for offset with no mount location.
- remove mounts_mutex.
- Resolves: rhbz#1912106
- fix file handle leak in nsswitch parser (bz 207678).
- fix memory leak in mount and expire request processing (bz 207678).
- add additional check to prevent running of cancelled tasks.
- fix potential file handle leakage in rpc_subs.c for some failure
cases (bz 207678).
- fix file handle leak in included map lookup (bz 207678).
- add error handling for ext_mount_add().
- account for recent libnsl changes.
- use_hostname_for_mounts shouldn't prevent selection among replicas.
- fix monotonic_elapse.
- Makefiles.rules: remove 'samples' from SUBDIRS.
- When using ldap if auto.master doesn't exist we now check for auto_master.
Addresses bz #130079
- When using an auto.smb map we now remove the leading ':' from the path which
caused mount to fail in the past. Addresses bz #147492
- Autofs now checks /etc/nsswitch.conf to determine in what order files & nis
are checked when looking up autofs submount maps which don't specify a
maptype. Addresses IT #57612.
- bz2232402 - autofs attempts to mount nonexistant ".hidden" filesystems
- allow -null map in indirect maps.
- Resolves: rhbz#2232402
- fix pidof init script usage.
- bz2052122 - autofs attempts unmount on directory in use
- make umount_ent() recognise forced umount.
- remove nonstrict parameter from tree_mapent_umount_offsets().
- fix handling of incorrect return from umount_ent().
- Resolves: rhbz#2052122
- fix task cancelation at shutdown (more)
- fix concurrent mount and expire race with nested submounts.
- Fix compile error.
- fix "nosymlink" option handling and add desription to man page.
- Add patch to use LDAP_DEPRICATED compile option. (bz #173833)
- don't abuse the ap->ghost field on NFS mount.
- multi-map doesn't pickup NIS updates automatically.
- eliminate redundant DNS name lookups.
- mount thread create condition handling fix.
- allow directory create on NFS root.
- check direct mount path length.
- fix incorrect in check in get user info.
- fix a couple of memory leaks.
- bz2213267 - filesystems mount and expire immediately
- fix expire retry looping.
- Resolves: rhbz#2213267
- update patch fix initialization in rpc create_client() (bz821847).
- Fix some merging breakages that caused the package not to build.
- bz1660145 - autofs.schema doesn't work in RHEL8
- update ldap READMEs and schema definitions.
- Resolves: rhbz#1660145
- bz1802251 - Autofs will only mount share once if sss is first ini
nsswitch.conf
- fix a regression with map instance lookup.
- Resolves: rhbz#1802251
- rebuild for new ldap
- fix add null check in parse_server_string() (bz979155).
- clean up obsolete spec file directives.
- correct return status from do_mkdir (bz 223480).
- Cleaned up an restructured my added code
- Corrected ghosting problem with 2.4.19 and above
- Added autofs4 ghosting patch for 2.4.19 and above
- Implemented HUP signal to force update of ghosted maps
- bz1602447 - Please review important issues found by covscan in
"autofs-5.1.4-18.el8+7"
- covarity fixes.
-Resolves: rhbz#1602447
- tiny patch for autofs typo and possible bug.
- add units After line to include statd service.
- use systemd sd_notify() at startup.
- add "BuildRequires: systemd-devel".
- fix NFS version mask usage.
- fix incorrect date in changelog.
- update "@network" matching patch.
- Umount loopback filesystems under automount points when stopping the
automounter.
- Uncomment the map expiry patch.
- change a close to an fclose in lookup_file.c
- update source to version 5.0.0_beta3.
- add patch to remove extra debug print.
- add patch to
- fix memory alloc error in nis lookup module.
- add "_" to "." mapname translation to nis lookup module.
- add patch to add owner pid to mount list struct.
- add patch to disable NFSv4 when probing hosts (at least foe now).
- add patch to fix white space handling in replicated server selection code.
- add patch to prevent striping of debug info macro patch (Jeff Moyer).
- add patch to add sanity checks on rmdir_path and unlink (Jeff Moyer).
- add patch to fix e2fsck error code check (Jeff Moyer).
- fix parsing of numeric host names in LDAP map specs (bz 205997).
- fix interface address null check.
- fix handling of autofs specific mount options (bz 199777).
- correction to the correction for handling of LDAP base dns with spaces.
- avoid using UDP for probing NFSv4 mount requests.
- use libldap instead of libldap_r.
- fix tokenizer to distinguish between global option and dn string (bz 214684).
- fix incorrect return from spawn.
- bz1689466 - Sanitize autofs logging
- make expire remaining log level debug.
- bz1685805 - autofs doesn't expand macros in amd map selectors
- allow period following macro in selector value.
- fix macro expansion in selector values.
- Resolves: rhbz#1689466 rhbz#1685805
- correct spelling error in default config.
- fix default auth config not being installed.
- change LDAP query method as my test db was incorrect.
- change ldap defaults code to handle missing auth config.
- fix mistake in parsing old style LDAP specs.
- update LDAP so that new query method also works for old syntax.
- add upstream bug fix patches
- add command line option to override is running check.
- don't use proc fs for is running check.
- fix fail on included browse map not found.
- fix incorrect multi source messages.
- clear stale flag on map read.
- fix proximity other rpc ping timeout.
- refactor mount request vars code.
- make handle_mounts startup condition distinct.
- fix submount shutdown handling.
- try not to block on expire.
- add configuration paramter UMOUNT_WAIT.
- fix multi mount race.
- fix nfs4 colon escape handling.
- check replicated list after probe.
- add replicated server selection debug logging.
- update replicated server selection documentation.
- use /dev/urandom instead of /dev/random.
- check for mtab pointing to /proc/mounts.
- fix interface config buffer size.
- fix percent hack heap corruption.
- make double quote handing consistent (at least as much as we can).
- fix handling of trailing white space in wildcard lookup (forward port bz 199720).
- check fqdn of each interface when matching export access list (bz 213700).
- fix "-fstype=nfs4" server probing (part 2 of bz 208757).
- set close-on-exec flag on open files where possible (bz 207678).
- make dump maps check for duplicate indirect mounts (bz961312).
- document allowed map sources in auto.master(5) (bz961312).
- add enable sloppy mount option to configure.
- Finish up with the merge breakage.
- Temporary fix for the multimount detection code. It seems half-baked.
- Checked and merged most of the RedHat v3 patches
- Fixed kernel module handling wu-ftpd login problem (again)
- bz2207801 - amd map format netgoup selector function not working
- fix date for revision 104 changelog entry.
- fix use_ignore_mount_option description.
- include addtional log info for mounts.
- fix amd selector function matching.
- get rid entry thid field.
- continue expire immediately after submount check.
- add buffer length checks to autofs mount_mount().
- eliminate realpath from mount of submount.
- eliminate root param from autofs mount and umount.
- remove redundant fstat from do_mount_direct().
- get rid of strlen call in handle_packet_missing_direct().
- remove redundant stat call in lookup_ghost().
- set mapent dev and ino before adding to index.
- change to use printf functions in amd parser.
- dont call umount_subtree_mounts() on parent at umount.
- dont take parent source lock at mount shutdown.
- eliminate buffer usage from handle_mounts_cleanup().
- fix possible use after free in handle_mounts_exit().
- make submount cleanup the same as top level mounts.
- eliminate some more alloca usage.
- add soucre parameter to module functions.
- add ioctlfd open helper.
- make open files limit configurable.
- Resolves: rhbz#2207801
- Merge in the multi-over patch. This resolves an issue whereby multimounts
(such as those used for /net) could be processed in the wrong order,
resulting in directories not showing up in a multimount tree. The fix
is to process these directories in order, shortest to longer path.
- review and fix master map options update for map reload.
- bz2165143 - Autofs reports can't connect to sssd, retry for 10 seconds when
real problem is empty LDAP object
- improve handling of ENOENT in sss setautomntent().
- dont immediately call function when waiting.
- Resolves: rhbz#2165143
- fix wait time resolution in alarm and state queue handlers (bz 247711).
- add some new upstream memory leak and use after free bug fixes.
- add "condrestart" to init script (bz 228860).
- add "@network" and .domain.name export check.
- fix display map name in mount entry for "-hosts" map.
- Update to upstream 4.1.3.
- Change hard-coded paths in the spec file to the %{_xxx} variety.
- Update to upstream 4.1.2.
- Add a STRIPDASH option to /etc/sysconfig/autofs which allows for
compatibility with the Sun automounter options specification syntax in
auto.master. See /etc/sysconfig/autofs for more information. Addresses
bug 113950.
- fix another expire regression introduced in the "mitigate manual umount"
patch (bz 222872).
- Comment out map expiry (and related) patch for an FC3 build.
- Change Copyright to License in the spec file so it will build.
- bz2130034 - automount -m crashes with Segmentation fault (core dumped)
- fix invalid tsv access.
- Resolves: rhbz#2130034
- Stop automount from pinging hosts if there is only one host (#146887)
- remove unnecessary nfs-utils BuildRequires (bz1277669).
- Fixed one off bug in the submount-variable-propagation patch.
(bz #143074)
- Fixed a bug in the init script which wouldn't find the -browse
option if it was preceded by another option. (fz #113494)
- update patch to prevent failure on empty master map.
- if there's no "automount" entry in nsswitch.conf use "files" source.
- add LDAP schema discovery if no schema is configured.
- fix recursive mount deadlock.
- increase file map read buffer size.
- handle new location of systemd.
- comment out /net and /misc from the default auto.master. /net is important
since in a default shipping install, we can neatly co-exist with amd.
- Fix broken multi-mounts. test patch. (Ian Kent)
- RHEL-18035 - SIGSEGV using hierarchical map entries on reload with
autofs-5.1.4-109
- fix get parent multi-mount check in try_remount().
- fix deadlock in remount.
- Resolves: RHEL-18035
- Fix init script to print out failures where appropriate.
- Build the automount daemon as a PIE.
- bz2025963 - autofs service has not proper limits set to be able to handle many mounts
- fix set open file limit.
- improve descriptor open error reporting.
- Resolves: rhbz#2025963
- ignore "winbind" if it appears in "automount" nsswitch.conf (bz 214632).
- another easy alloca replacements fix.
- fix nobind sun escaped map entries.
- fix use cache entry after free mistake.
- fix ipv6 proximity calculation.
- fix parse buffer initialization.
- fix typo in automount(8).
- fix email in last two changelog entries.
- correct mistake in logic test in wildcard lookup.
- fix fd leak at multi-mount non-fatal mount fail.
- fix incorrect multi-mount mountpoint calcualtion.
- fix incorrect dclist free.
- srv lookup handle endianness.
- fix bug introduced by library reload changes which causes autofs to
not release mount thread resources when using submounts.
- fix notify mount message path.
- try harder to work out if we created mount point at remount.
- fix double free in do_sasl_bind().
- manual umount recovery fixes.
- fix map type info parse error.
- bz2216877 - When looking up included maps, sometimes autofs does not
consult all the included files in order
- fix the "fix incorrect matching of cached wildcard key" patch.
- Related: rhbz#2216877
- correct shutdown log message print.
- correct auth init test when no credentials required.
- bz2177998 - deadlock while reading amd maps
- fix return status of mount_autofs().
- don't close lookup at umount.
- fix deadlock in lookups.
- dont delay expire.
- make amd mapent search function name clear.
- rename statemachine() to signal_handler().
- make signal handling consistent.
- fix incorrect print format specifiers in get_pkt().
- eliminate last remaining state_pipe usage.
- add function master_find_mapent_by_devid().
- use device id to locate autofs_point when setting log priotity.
- add command pipe handling functions.
- switch to application wide command pipe.
- get rid of unused field submnt_count.
- fix mount tree startup reconnect.
- fix unterminated read in handle_cmd_pipe_fifo_message() (Coverity).
- Resolves: rhbz#2177998
- bz1654541 - autofs crash when parsing master map
- fix hesiod string check in master_parse().
- Resolves: rhbz#1654541
- add missing spec file entries for dir-type change (bz719208).
- link with full reloc options.
- Add patch to support parsing nsswitch.conf to determine map sources.
- Disable this patch, and Ian's map expiry patch for a FC build.
- bz2139504 - segfault due to lookup_mod->context address being freed
and reused while multiple threads were using it
- fix parse module instance mutex naming.
- serialise lookup module open and reinit.
- Resolves: rhbz#2139504
- Add more general patch to translate "_" to "." in map names. (bz #147765)
- More code cleanup and corrections for connectathon tests.
- update to upstream 5.1.3 release.
- fix custom autofs.conf not being installed.
- init qdn before use in get_query_dn().
- fix typo in update_hosts_mounts().
- fix hosts map update on reload.
- fix parse confusion between attribute and attribute value.
- fix submount offset delete.
- fix init script status return.
- fix use get_proximity() without libtirpc.
- don't use dirent d_type to filter out files in scandir().
- don't schedule new alarms after readmap.
- use numeric protocol ids instead of protoent structs.
- lib/defaults.c: use WITH_LDAP conditional around LDAP types.
- make yellow pages support optional.
- modules/replicated.c: use sin6_addr.s6_addr32.
- workaround missing GNU versionsort extension.
- update source to 5.0.6.
- fix ipv6 name for lookup fix.
- add dir map-type patch.
- Merged my and Ian's socket leak fixes into one, smaller patch. Only
partially addresses bz #128966.
- Fix some more echo lines for internationalization. bz #77820
- Revert the only one auto.master patch until we implement the +auto_master
syntax. Temporarily addresses bz #133055.
- fix gcc5 complaints (bz1204685).
- fix some automount(8) typos (bz664178).
- bz1660145 - autofs.schema doesn't work in RHEL8
- update spec file doc inclusions for schema definition update.
- Related: rhbz#1660145
- Upstream source version 5.0.4.
- remove redundant rpath link option (prep for move to Extras).
- bz1681956 - autofs changes blocked until gating tests are added
- correct test name in gating.yaml.
- Related: rhbz#1681956
- Add patch to implement directory ghosting and direct mounts
- Add patch to for autofs4 module to support ghosting
- Rebuilt for libtirpc soname bump
- fix file map lookup when reading included or nsswitch sources.
- a regression introduced by file map lookup optimisation in rev 9.
- cthon fix some shutdown races.
- Change icmp ping to an rpc ping. (Ian Kent)
- Fix i18n patch
o Remove the extra \" from one echo line.
o Use echo -e if we are going to do a \n in the echo string.
- Fix "Source:" URL and changelog anotations.
- Add beta map expiry code for wider testing. (Ian Kent)
- Fix check for ghosting option. I forgot to check for it in DAEMONOPTIONS.
- Remove STRIPDASH from /etc/sysconfig/autofs
- Fix a race between mounting a share and updating the cache in the parent
process. If the mount completed first, the parent would not expire the
stale entry, leaving it first on the list. This causes map updates to not
be recognized (well, worse, they are recognized after the first expire, but
not subsequent ones). Fixes a regression, bug #137026 (rhel3 bug).
- make negative cache update consistent for all lookup modules.
- ensure negative cache isn't updated on remount.
- dont add wildcard to negative cache.
- make service want network-online (bz1071591).
- bz1638487 - Drop dependency on hesiod
- actually update the spec file with the hesiod removal.
- Related: rhbz#1638487
- fixed numeric export match (bz 231188).
- add build requires for gcc.
- remove now unused patch files (bz1020242).
- RHEL-127179 - sssd autofs fails to get correct EHOSTDOWN if requested
incorrect mount after upgrade to sssd-2.9.1-4.el8_9.5.x86_64
[rhel-8.10.z]
- handle sss special case getautomntbyname() error.
- Resolves: RHEL-127179
- move autofs4 module loading back to init script (part bz # 194061).
- fix handling of quoted slash alone (bz 248943).
- Fix program maps so that they can have gt 4k characters. (Neil Horman)
Addresses bz #138994.
- Add a space after the colon here "Starting automounter:" in init script.
Fixes bz #138513.
- remove SIGCHLD handler because it is no longer needed and was
causing expire problems.
- alter expire locking of multi-mounts to lock sub-tree instead of
entire tree.
- review verbose message feedback and update.
- correction for expire of multi-mounts.
- spelling corrections to release notes (Jeff Moyer).
- add back sloppy mount option, removed for Connectathon testing.
- disable mtab locking again.
- bz1621938 - autofs can no longer get maps from IPA server
- fix use after free in parse_ldap_config().
- Resolves: rhbz#1621938
- update patches, documentation and comments only change.
- rename patch and add to CVS.
- check for protocol option.
- use ulimit max open files if greater than internal maximum.
- Fix the large program map patch.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Change BuildPrereq to BuildRequires as per the package guidelines.
- Add libxml2-devel to the BuildRequires, as it is needed for the LDAP
authentication bits.
- fix initialization in rpc create_client() (bz821847).
- bz1689467 - path_resolution on an autofs managed path resets the timer. Can
this be made configurable?
- support strictexpire mount option.
- Resolves: rhbz#1689467
- fix call restorecon when misc device file doesn't exist.
- add %config(noreplace) for auto.* config files.
- fix fix wait for master source mutex.
- fix improve mount location error reporting (bz783496).
- fix add locality as valid ldap master map attribute (bz575863).
- Pass a socket into clntudp_bufcreate so that we don't use up additional
reserved ports. This patch, along with the socket leak fix, addresses
bz #128966.
- add map-type-in-map-name fix patch to sync with upstream and RHEL.
- don't readmap on HUP for new mount.
- add NIS_PARTIAL to map entry not found check and fix use after free bug.
- mitigate manual umount of automounts where possible.
- fix multiply recursive bind mounts.
- check kernel module version and require 5.00 or above.
- fix expire regression introduced in the "mitigate manual umount" patch.
- still more on multiply recursive bind mounts.
- Bug 397591 SELinux is preventing /sbin/rpc.statd (rpcd_t) "search" to (sysctl_fs_t).
- prevent fork between fd open and setting of FD_CLOEXEC.
- fix include check full patch for file map of same name.
- add Conflicts to ensure we get fixed cyrus-sasl-lib for rev 21 change.
- Update patch for changed semantics of mkdir in recent kernels.
- fix macro table locking (bz 208091).
- fix nsswitch parser locking (bz 208091).
- allow only one master map read task at a time.
- fix misc memory leaks.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- don't use master_lex_destroy() to clear parse buffer.
- make documentation for set-log-priority clearer.
- clear rpc client on lookup fail.
- Fixed the use of +ypmapname so the maps included with +ypmapname
are used in the correct order. (In the past the '+' entries
were always processed after local entries.)
- and another try at fixing lexer matching map type in map name.
- change conflicts to requires
- fix license tag
- Fixed a bug which caused directories to never be unmounted. (bz #134403)
- fix race when setting task done (bz 227268).
- correct test for libhesiod.
- Prevent startup if a mountpoint is already mounted.
- Add in the deferred syslog patch. This fixes a hung automounter issue
related to unsafe calls to syslog in signal handler context.
- bz1612565 - Man page scan results for autofs
- fix program usage message.
- Resolves: rhbz#1612565
- fix systemd argument passing.
- fix get_nfs_info() can incorrectly fail.
- fix offset directory removal.
- Replace check-is-multi with more general multi-parse-fix.
- Add fix for premature return when waiting for lock file.
- Update copyright declaration for reentrant-syslog source.
- Add patch for configure option to disable locking during mount.
But don't disable locking by default.
- Add ability to handle automount schema used in Sun directory server.
- Quell compiler warning about getsockopt parameter.
- Quell compiler warning about yp_order parameter.
- bz2139504 - segfault due to lookup_mod->context address being freed
and reused while multiple threads were using it
- coverity fix for invalid access.
- Related: rhbz#2139504
- bz1892184 - autofs: return a connection failure until maps have been fetched
- fix lookup_nss_read_master() nsswicth check return.
- fix typo in open_sss_lib().
- fix sss_master_map_wait timing.
- add sss ECONREFUSED return handling.
- use mapname in sss context for setautomntent().
- add support for new sss autofs proto version call.
- fix retries check in setautomntent_wait().
- refactor sss setautomntent().
- improve sss setautomntent() error handling.
- refactor sss getautomntent().
- improve sss getautomntent() error handling.
- sss introduce calculate_retry_count() function.
- move readall into struct master.
- sss introduce a flag to indicate map being read.
- update sss timeout documentation.
- refactor sss getautomntbyname().
- improve sss getautomntbyname() error handling.
- use a valid timeout in lookup_prune_one_cache().
- dont prune offset map entries.
- simplify sss source stale check.
- Resolves: rhbz#1892184
- fix master map mount options matching.
- fix master map bogus keywork match.
- fix fix map entry duplicate offset detection.
- add a number of fixes based on a Covarity report.
- update source to version 5.0.3.
- include krb5.h in lookup_ldap.h (some openssl doesn't implicitly include it).
- correct initialization of local var in parse_server_string.
- Add in the map expiry patch
- Bring in other patches that have been committed to other branches. This
version should now contain all fixes we have to date
- Merge conflicts due to map expiry changes
- consolidate to rc3.
- fix typo in Fix typo in var when removing temp directory (bz 221847).
- bz1887681 - automount force unlink option (-F) does not work as expected
on autofs-5.0.7-109.el7
- fix direct mount unlink_mount_tree() path.
- fix unlink mounts umount order.
- fix incorrect logical compare in unlink_mount_tree().
- use bit flag for force unlink mounts.
- improve force unlink mounts option description.
- remove logpri fifo on autofs mount fail.
- add force unlink mounts and exit option.
- cleanup stale logpri fifo pipes on unlink and exit.
- Resolves: rhbz#1887681
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Escape macros in %changelog
- fix handling of master map entry update (bz # 193718).
- fix program map handling of invalid multi-mount offsets.
- update to upstream version 5.0.8 (bz1020242).
- include usage in usage message.
- dont wait forever to restart.
- add option description to man page.
- fix null map entry order handling.
- make description of default MOUNT_WAIT setting clear.
- configure.in: allow cross compilation.
- README: update mailing list subscription info.
- allow non root user to check status.
- bump again for double-long bug on ppc(64)
- update "replace-tempnam" patch to create temp files in sane location.
- Update to upstream 5.1.4 release.
- fix error in %post scriplet.
- use -fPIC instead of -fpic for modules and honor other RPM_OPT_FLAGS
- New map expiry patch from Ian.
- Fix a couple signal races. No known problem reports of these, but they
are holes, none-the-less.
- RHEL-72524 - autofs: deadlock between mnts_lookup_mount and mnts_remove_mount
- fix deadlock in master_notify_submount().
-Resolves: RHEL-72524
- RHEL-12369 - autofs attempts to mount nonexistant ".hidden" filesystems
- update patch "allow -null map in indirect maps".
- Resolves: RHEL-12369
- add cacheing of negative lookups to reduce unneeded map
lookups (bz 197746 part 2).
- fix typo in patch to allow dumping core.
- fix version passed to get_supported_ver_and_cost (bz 249574).
- make nfs4 default for replicated selection configuration (bz579949).
- add simple bind authentication option (bz579951).
- mark map instances stale so they aren't "cleaned" during updates.
- fix large file compile time option.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- rename two incorrectly named patches.
- add missing change entry to another patch.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- correct directory cleanup in mount modules.
- merge key and wildcard LDAP query for lookups (bz 197746).
- Fix up the one-auto-master patch. My "improvements" had side-effects.
- Fixed regression with -browse not taking effect.
- fix fix LDAP result leaks on error paths.
- report map not read when debug logging.
- duplicate parent options for included maps.
- update ->timeout() function to not return timeout.
- move timeout to map_source.
- fix kernel verion check of version components.
- dont retry ldap connect if not required.
- check if /etc/mtab is a link to /proc/self/mounts.
- fix nfs4 contacts portmap.
- make autofs wait longer for shutdown.
- fix sss map age not updated.
- fix remount deadlock.
- fix umount recovery of busy direct mount.
- fix offset mount point directory removal.
- remove move mount code and configure option.
- fix remount of multi mount.
- fix devce ioctl alloc path check.
- refactor hosts lookup module.
- remove cache update from parse_mount().
- add function to delete offset cache entry.
- allow update of multi mount offset entries.
- add hup signal handling to hosts map.
- fix use after free in do_master_list_reset().
- add missing BuildRequires.
- fix map entry duplicate offset detection.
- Allow nsswitch.conf to not contain "automount:" lines.
- fix wait for master map to be available at start.
- rename program map parsing bug fix patch.
- use CLOEXEC flag functionality for setmntent also, if present.
- Add conflicts kernel < 2.6.17.
- Fix submount operation broken by connectathon updates.
- don't close file handle for rootless direct mounti-mount at mount.
- wait submount expire thread completion when expire successful.
- add inadvertantly ommitted server list locking in LDAP module.
bluez-libs-5.63-5.el8_10.x86_64.rpm | - Update to 4.54
- Update to 4.45
- Update cable plugin for gudev changes
- Use bzipped upstream tarball.
- Bluez-alsa needs to provide/obsolete bluez-utils-alsa
- Use versioned Obsoletes:
- Update to 4.61
- Remove Wacom tablet enabler, now in the kernel
- Fix linking with new DSO rules (#564799)
- Update to 5.38
- Fix OBEX connections
- Update to 4.4
- Update source address, and remove unneeded deps (thanks Marcel)
- New upstream 5.47 bugfix release
- Initial support for Bluetooth LE mesh
- Blueooth 5 fixes and improvements
- A (slightly) different fix for parsing to XML when it contains a NULL
- Update to 4.46
- Update to 5.43
- Add crasher fixes (rhbz #1027365)
- More upstream CUPS fixes
+ bluez-5.50-3
- Bump the version
- Update to 5.34
- Update to 4.95
- Update to 4.94
- Update to 4.70
- Update cable pairing plugin to use libudev
+ bluez-5.47-2
- Lockdown Bluetooth systemd service
- Update to 5.13
- Enable sixaxis plugin by default
- Update to 4.51
- Update to 5.45
- Minor spec cleanups
- Include api docs in devel package
- Update to 4.86
- Fix typo in init script (#558993)
- Up the required udev requires so bluetoothd gets started
on boot when an adapter is present
- Don't pull in -libs for the other subpackages
- Remove a stray .la file
- Add scripts to automatically btattach serial-port / uart connected
Broadcom HCIs found on some Atom based x86 hardware
- Update to 5.16
- Update to 4.10
- Update to 4.93
- Fix sdp_copy_record(), so records are properly exported through D-Bus
- Update to 4.17
- Update to 5.29
- Remove hid2hci calls, they're in udev now
- Work-around udev bug, bluetoothd wasn't getting enabled
on coldplug
- Update to 4.40
- Update to 4.32
- Start/stop the bluetooth service via udev (#484345)
+ bluez-5.52-3
- Revering the 5.52-2 patch due some mismatch with upsream patch.
- Update to 4.21
- Port CUPS backend to BlueZ 4.x
+ bluez-5.52-1
- Fixing (#1830397)
- Update to 4.64
- Use git to manage distro patches
- Add numerous upstream and downstream patches (#892929)
- Put hid2hci into its own (optional) subpackage, so that people who
just want to use their HID proxying HCI with the keyboard and mouse
it came with, will have things working out of the box.
- Put udev rules in /lib/udev, where package installed udev rules belong
- Update udev rules (#246840)
+ bluez-5.50-4
- Fixing CVE-2020-0556
- Fix PulseAudio interaction on resume (#1534857)
- Update to 5.14
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+ bluez-5.52-5
- Fixing (#1961511)
- Update to 4.96
- Enable bluetoothd by default
- Follow-up on https://bugzilla.redhat.com/show_bug.cgi?id=694519 also fixing upgrades
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+ bluez-5.47-4
- Fix invalid paths in service file (#1499518)
- Update to 5.48
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- This update fixes Sixaxis PS3 joypad detection
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Update to 4.58
+ bluez-5.63-4
- Resolves: RHEL-35501
- Fixing CVE-2023-50230
- Resolves: RHEL-35504
- Fixing CVE-2023-50229
- Update to 5.17
- Update to 4.13
- Update to 4.85
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Update to 5.36
+ bluez-5.49-6
- Disabling Mesh Networking for crypto issue while code reviewing.
+ bluez-5.47-3
- Fix adapter name not picking up PrettyHostname
- systemd hookup and cleanups from Lennart
- Update to 4.59
+ bluez-5.63-3
- Add back the tests for OSCI.
- Add patch to allow Sixaxis pairing
- rebuild for libical 2.0.0
- Update to 4.37
- Initial build
- Enable pairing Wiimote support (#847481)
+ bluez-5.52-2
- Fixing (#1885378)
- Remove a few obsolete BRs and deps, thanks to Marcel Holtmann
- Update to 4.63
- Switch to %ldconfig_scriptlets
- Update to 4.65
+ bluez-5.52-4
- Fixing (#1885378)
- Update to 5.11
- Clean up requires and build requires
- Use CUPS macro (#772236)
- Enable audio socket so a2dp works in PulseAudio again (#874015)
- Fix hid2hci not working with recent kernels (#877998)
- Re-add Requires: dbus-bluez-pin-helper, since blueman is now in
- Update to 4.60
- Update to 4.89
- Update to 4.26
- Fix cups discovery the first time we discover a device
- Update to 5.8
- Hardened build
- Use systemd rpm macros
- Add fuzz
- Update to 4.12
+ bluez-5.63-5
- Resolves: RHEL-35371
- Fixing CVE-2023-27349
- Resolves: RHEL-35492
- Fixing CVE-2023-51589
- Rebuilt for libjson-c.so.3
- bluez builds fine on s390(x) and the packages are required to build
other packages, drop ExcludeArch
- sync release number (but not package) with F-14
- Update to 4.41
- Update to 4.72
- Update to 4.30
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Add non-upstreamable patch to make bluetooth-sendto work again
- Update to 4.16
- Update to 4.5
- Fix initscript to actually start bluetoothd by hand
- Add chkconfig information to the initscript
- Update to 4.69
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- don't buildrequire libusb1 on s390*
- Update to 5.40 bugfix relesae
- Update to 4.79
- Update to 4.78
- Add patch to activate the Socket Mobile CF kit (#498756)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+ bluez-5.49-5
- Fix accessing NULL adv_manager (#1602779)
+ bluez-5.50-1
- Update to 5.50 (#1504689)
- sdpd heap fixes
Resolves: rhbz#1490911
- Update to 4.100
- Update to 5.28
- rebuild for ICU 57.1
- Update to 4.56
- Update to 4.31
- Own /usr/lib*/bluetooth and children (#474632)
- Update to 5.10
- Remove obsoleted patches
- Add another CUPS backend patch
- Update cable pairing patch for new build system
- Update to 5.31
- Update to 4.18
- Update to 5.42
- Remove socket interface enablement for A2DP (#964031)
- Update to 4.8
- And actually apply the aforementioned patch
- Fix patch application
- Update to 4.55
- Add libcap-ng support to drop capabilities (#517660)
- Update to 5.30
- Use %license
- Update to 4.77
- hid2hci was recently removed from udev and added to bluez in 4.93,
udev in Fedora-16 no longer has hid2hci -> enable it in our bluez builds.
This fixes bluetooth not working on machines where the bluetooth hci
initially shows up as a hid device, such as with many Dell laptops.
- Update to 4.62
- Update to 4.88
- Update to 4.25
- Update to 5.12
- Sixaxis PS3 joypad support is now upstream
- Fix pairing and using mice, due to recent BtIO changes
- Avoid disconnecting audio devices straight after they're connected
- Update to 5.9
- Fix a possible crasher
- Update to 4.19
- Update to 4.76
- disable 0001-Add-icon-for-other-audio-device.patch, already upstream
- Update to 4.14
- Update to 4.98
- Update to 5.49
- Update to 4.82
- Update to 4.80
- Update to 5.35
- Update to 4.99
- Update to 4.66
+ bluez-5.63-1
- Fixing (#)
- Update to 4.42
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Update to 4.39
- Split obexd out into a sub package
- Fix the cups backend being a libtool stub
+ bluez-5.46-4
- Patches cleanup
- Add DualShock4 cable pairing support
- BIND_NOW support for RELRO
- iCade autopairing support
- Update to 4.57
+ bluez-5.56-1
- Fixing (#1965057)
- Removing bccmd, enabling hid2hci as upstream removed the support in bluez-5.56
- Fix trust setting in Sixaxis devices
- Update to 4.11
- SDP browse fixes
- Update to 5.33
- Update to 5.44
- Enable deprecated option to keep all usual tools
- Ship btattach tool
- Minor spec cleanups
- obexd fixes to prevent crashes
- add /etc/bluetooth/main.conf config file
- set 'AutoEnable=true' in /etc/bluetooth/main.conf file
- Update to 4.90
- Update to 4.73
- Don't crash when audio devices are registered and the adapter
is removed
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Fix SDP parsing to XML when it contains NULLs
- Update to 4.53
- Fix NAP connections (rh #1230461)
+ bluez-5.49-3
- Fix crash on non-LE adapters (#1567622)
- Configure systemctl settings for bluez-obexd correctly
- Resolves rhbz#1259827
- Fix PS3 BD remote input event generation
- Update to 5.25
- fix header file
- Update to 4.50
- Enable bluetoothd on all upgrades from 4.87-6 and older, in order to fix up broken F15 installations
- Rebuilt for libjson-c.so.4 (json-c v0.13.1)
- Fix a couple of warnings in the CUPS/BlueZ 4.x patch
- Update to 5.23
- Rebuilt for libjson-c.so.4 (json-c v0.13.1) on fc28
- Update to 4.81
- Add patch for udev change to fix FTBFS on rawhide
- Drop sbc patch as fixed in gcc 4.7 final
- Update to 4.74
- Update systemd patch to make it possible to disable bluez
- Update to 5.41
- Move the rfcomm.conf to the compat package, otherwise
the comments at the top of it are confusing
- Update to 4.43
- Rebuild for readline 7.x
- Change main utils package name to 'bluez'; likewise its subpackages
- Remove references to obsolete initscripts (hidd,pand,dund)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Switch Wacom Bluetooth tablet to mode 2
- Update to 5.18
- Update to 4.9
- Update to 4.6
- Make headers compilable with g++ 4.7 (bug #791292)
- Fix possible crasher on resume from suspend
- Rebuild for libical 3.x
- Update to 4.36
- Work-around broken devices that export their names in ISO-8859-1
(#450081)
- Update to 5.39 bugfix relesae
- Fix permissions on the udev rules (#479348)
- Fix D-Bus configuration for latest D-Bus (#475069)
- Update to 4.71
+ bluez-5.56-2
- Fixing (#1968392)
- Removing bccmd check from tests
- Split off dund, pand, hidd, and rfcomm helper into a compat package
(#477890, #473892)
- Update to 4.22
- Move hidd, pand and dund man pages to the -compat
sub-package (#593578)
- Update to 4.27
- Update patches to apply correctly
- First compilable version with hostnamed support
- Update to 5.5, based on earlier work from
https://bugzilla.redhat.com/show_bug.cgi?id=974145
- Add PS3 BD Remote patches (power saving)
- Update to 4.87
- Update to 4.38
- Add script to autoload uinput on startup, so the PS3 remote
works out-of-the-box
+ bluez-5.50-2
- Fixing CVE-2018-10910 (#1606373)
- Comment out Requires: dbus-bluez-pin-helper for bootstrapping. Otherwise
it drags in the old blueman, built against python-2.6
- Add rfkill plugin to restore the state of the adapters
after coming back from a blocked adapter
- Rebuilt for gcc bug 634757
- Update to 5.32
- Update to 4.35
- Update to 4.97
- Another pass at fixing A2DP support (#964031)
- Add mmx patch to fix build of sbc component
- clean up spec, drop ancient obsoletes
- Update to 4.47
- Update to 4.7
- Update to 4.28
- Fix rpmlint problems
- Fix input device handling
- Install gatttool and mpris-proxy
- Update to 4.34
- Update to 4.29
- Update to 4.52
- Fix problem unsetting discoverable
- Update to 4.15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Obsolete blueman-nautilus as well
- don't require the pin helper on s390(x) now, we can disable the whole
bluetooth stack in the future
- Update to 4.44
+ bluez-5.63-2
- Change default of ClassicBondedOnly to true to align with HID specification.
- Resolves: RHEL-18429
- Fixing CVE-2021-41229
- Update to 5.46
- Own /var/lib/bluetooth (#468717)
- Update to 4.33
- Default to the XDG cache dir for receiving files
- Obsolete blueman and obex-data-server
+ bluez-5.56-3
- Fixing (#2027434)
- Fixing CVE-2021-41229
- Update to 5.37
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Don't allow installing bluez-compat on its own
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Add -vif to autoreconf to fix build issues
- Switch to on-demand start/stop using udev
- Enable unit tests (Marek Kasik)
- Resolves: #1502677
certmonger-0.79.17-2.el8.x86_64.rpm | - when saving certificates to NSS databases, try to preserve the trust
value assigned to a previously-present certificate with the same nickname
and subject, if one is found
- when saving certificates to NSS databases, also prune certificates from
the database which have both the same nickname and subject as the one
we're adding, to avoid tripping up tools that only fetch one certificate
by nickname
- update to 0.12
- add a crucial bit of error reporting when CAs reject our requests
- count the number of configured CAs correctly
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- rework the state machine so that we save an issued certificate's associated
CA certificates, then re-read the certificate, then run the post hook and
issue notifications, in that order, instead of saving CA certificates after
running the post hook, which was always a surprising order (#1131700)
- add a generic dogtag-submit helper that doesn't include any IPA defaults,
to make it easier to know the difference between paramenters it requires
and parameters which are optional (#12)
- Reformat certificates returned by Dogtag. Dogtag was including
a spurious newline before -----END CERTIFICATE-----
- Optimize closing of file descriptors on fork (#1763745)
- Remove NOMODDB flag flag from context init, look for full tokens (#1746543)
- Retrieve full IPA CA chain (#1710632)
- fix creation and packaging of the "local" CA's data directory
- Rebuild for new annobin (#1708095)
- update to 0.10
- add some compiler warnings and then fix them
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuild for new annobin (#1708095)
- document the -R, -N, -o, and -t flags for dogtag-ipa-renew-agent-submit
- stop checking that we can generate 512 bit keys during self-tests
- pull up a patch from master to adapt self-tests to certutil's diagnostic
output having changed (#992050)
- clarify that the command passed to getcert -C is a "post"-save command
- add a "pre"-save command option to getcert, specified with the -B flag (#9)
- after we notify of an impending not-valid-after approaching, don't do it
again immediately
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- update to 0.28
- fix self-signing certificate notBefore and notAfter values on 32-bit
machines
- update to 0.16
- set a umask at startup (Dan Walsh)
- update to 0.19
- correctly initialize NSS databases that need to be using a PIN
- add certmonger.conf, for customizing notification timings and settings,
and use of digests other than the previously-hard-coded SHA256, and
drop those settings from individual requests
- up the default self-sign validity interval from 30 days to 365 days
- drop the first default notification interval from 30 days to 28 days
(these two combined to create a fun always-reissuing loop earlier)
- record the token which contains the key or certificate when we're
storing them in an NSS database, and report it
- improve handling of cases where we're supposed to use a PIN but we
either don't have one or we have the wrong one
- teach getcert to accept a PIN file's name or a PIN value when adding
a new entry
- update the IPA submission helper to use the new 'request_cert' signature
that's landing soon
- more tests
- Update gating requirements
- update to 0.11
- add XML-RPC submission for certmaster and IPA
- prune entries with duplicate names from the data store
- Switch BR from /usr/include/popt.h to popt-devel
- tweak initialization so that we set up for providing our D-Bus API before we
register our name with the bus, so that we can handle any requests that
arrive before the acknowledgement of that registration
- on systems that run systemd, add the right data file so that the service gets
started when someone tries to talk to the daemon (ticket #38)
- correctly check for error responses when sending GetCAChain requests to SCEP
servers
- certmonger creates CSRs with invalid DER syntax for X509v3 extensions
with critical=FALSE (#2012258)
- call poptGetOptArg() correctly, to fix parsing of the -R flag to scep-submit
and the -O and -o flags to dogtag-submit (#1244914)
- Mass rebuild 2014-01-24
- update to 0.30
- fix errors computing the time at the end of an interval that were
caught by self-tests
- fix a data loss bug when saving renewed certificates to NSS databases - the
private key could be removed in error since 0.77
- fixes for bugs found by static analysis
- fix self-tests when built with OpenSSL 1.0.2
- update to 0.79:
- getcert now offers an option (-X) for requesting processing by a particular
CA if the server we're contacting is running more than one
- getcert also offers options (--for-ca, --not-for-ca, --ca-path-length) for
requesting BasicConstraints values
- getcert now displays times in local time instead of UTC, which was
previously the only way they were displayed; the --utc option can often be
used to switch back to its previous behavior
- the SCEP enrollment helper now correctly issues GetCACertChain requests to
SCEP servers, instead of issuing a GetCAChain request, which isn't part of
the protocol; from report by Jason Garland
- when issuing SCEP requests, the ID of the CA included in the HTTP request
is now URL-encoded, as it should be
- renewal or notification-of-impending-expiration logic is now triggered
closer to TTL thresholds rather than waiting for a periodic check to pass a
threshold
- properly builds with OpenSSL 1.1, thanks to Lukas Slebodnik and Tomas Mraz
for a lot of the legwork
- resync .spec file with Fedora
- upstream project migrated from fedorahosted.org to pagure.io
- pass $CERTMONGER_REQ_IP_ADDRESS to enrollment helpers if the signing request
includes IP address subjectAltName values
- correctly verify signatures on SCEP server replies when the signer is neither
the top-level CA nor the RA (feedback in #1161768)
- correctly verify signatures on SCEP server replies when there is more than
one certificate in the chain between the RA and the top-level CA (feedback in
- update to 0.40
- fix validation check on EKU OIDs in getcert (#691351)
- get session bus mode sorted
- add a list of recognized EKU values to the getcert-request man page
- fix an inconsistency in how we parse cookie values returned by CA helpers,
in that single-line values would lose the end-of-line after a daemon
restart, but not before
- handle timeout values and exit status values when calling CA helpers
in non-SUBMIT, non-POLL modes (#1118468)
- rework how we save CA certificates so that we save CA certificates associated
with end-entity certificates when we save that end-entity certificate, which
requires running all of the involved pre- and post-save commands
- drop package Requires: on systemd-sysv (#1104138)
- add a --with-homedir option to configure, and use it, since subprocesses
which we run and which use NSS may attempt to write to $HOME/.pki, and
0.69's strategy of setting that to "/" was rightly hitting SELinux policy
denials (#1047798)
- initial package
- treat the ability to access keys in an NSS database without using a PIN,
when we've been told we need one, as an error (#692766, really this time)
- start populating the optional unique identifier fields in self-signed
certificates
- make the trust settings we apply to CA-supplied certificates while
saving them to NSS databases run-time configurable
- fix compiling against EL5-era OpenSSL
- when saving CA certificates we pull from an IPA server, nickname
it using the realm name with " IPA CA" appended rather than just
naming it "IPA CA"
- fix the local signer so that when it issues itself a new certificate,
it uses the same subject name
- add a -w flag to getcert's request, resubmit, and start-tracking
commands, telling it to wait until either the certificate is issued,
we get to a state where we know that we won't be able to get one, or
we are waiting for a CA
- reintroduce package Requires: on systemd-sysv on F19 and EL6 and older,
conditionalized it so that it's ignored on newer releases, and make
whether or not we call systemd-sysv-convert in triggers depend on that,
too (#1104138)
- update to 0.6
- man pages
- 'getcert stop-tracking' actually makes the server forget now
- 'getcert request -e' was redundant, dropped the -e option
- 'getcert request -i' now sets the request nickname
- 'getcert start-tracking -i' now sets the request nickname
- Rebuild for rpm bug 1131960
- Add BuildRequires on python3-devel (#1615507)
- try to SIGHUP the messagebus daemon at first install so that it'll
let us claim our service name if it isn't restarted before we are
first started (#636876)
- make the D-Bus configuration file (noreplace) (#541072)
- make the %check section and the deps we have just for it conditional on
the same macro (#541072)
- don't discard the priority value in DNS SRV records
- update to 0.18
- add support for using encrypted storage for keys, using PIN values
supplied directly or read from files whose names are supplied
- don't choke on NSS database locations that use the "sql:" or "dbm:"
prefix
- update to 0.35
- self-test fixes to rebuild properly in mock (#670322)
- update to 0.15
- notice that a directory with a trailing '/' is the same location as the
directory without it
- fix handling of the pid file when we write one (by actually giving it
contents)
- Fix test failure on some platforms
- update to 0.72
- support generating DSA parameters and keys on sufficiently-new OpenSSL
and NSS
- support generating EC keys when OpenSSL and NSS support it, using key
size to select the curve to use from among secp256r1, secp384r1,
secp521r1 (which are the ones that are usually available, though
secp521r1 isn't always, even if the other two are)
- stop trying to cache public key parameters at all and instead cache public
key info properly
- encode the friendlyName attribute in signing requests as a BMPString,
not as a PrintableString
- catch more filesystem permissions problems earlier (more of #996581)
- Fix use-after-free issue when retrieving CA chain (#1710632)
- allow for 'certmonger -P abstract:...' to work, too
- Rebuild
- treat the ability to access keys in an NSS database without using a PIN,
when we've been told we need one, as an error (#692766)
- when handling "getcert resubmit" requests, if we don't have a key yet,
make sure we go all the way back to generating one (#694184)
- getcert: try to clean up tests for NSS and PEM file locations (#699059)
- don't try to set reconnect-on-exit policy unless we managed to connect
to the bus (#712500)
- handle cases where we specify a token but the storage token isn't
known (#699552)
- getcert: recognize -i and storage options to narrow down which requests
the user wants to know about (#698772)
- output hints when the daemon has startup problems, too (#712075)
- add flags to specify whether we're bus-activated or not, so that we can
exit if we have nothing to do after handling a request received over
the bus if some specified amount of time has passed
- explicitly disallow non-root access in the D-Bus configuration (#712072)
- migrate to systemd on releases newer than Fedora 15 or RHEL 6 (#718172)
- fix a couple of incorrect calls to talloc_asprintf() (#721392)
- depend on the e2fsprogs libuuid on Fedora and RHEL releases where it's
not part of util-linux-ng
- Skip the keygen tests when executed as root.
- oops, rfc5280 says we shouldn't be populating unique identifiers, so
make it a configuration option and default the behavior to off
- when using an NSS database, skip loading the module database (#743042)
- when using an NSS database, skip loading root certs
- generate SPKAC values when generating CSRs, though we don't do anything
with SPKAC values yet
- internally maintain and use challenge passwords, if we have them
- behave better when certificates have shorter lifetimes
- add/recognize/handle notification type "none"
- getcert: error out when "list -c" finds no matching CA (#743488)
- getcert: error out when "list -i" finds no matching request (#743485)
- really fix these this time:
- getcert: error out when "list -c" finds no matching CA (#743488)
- getcert: error out when "list -i" finds no matching request (#743485)
- update to 0.8
- encode windows UPN values in requests correctly
- watch for netlink routing changes and restart stalled submission requests
- 'getcert resubmit' can force a regeneration of the CSR and submission
- updates to 0.73
- getcert no longer claims to be stuck when a CA is unreachable,
because the daemon isn't actually stuck
- init script: ensure that the subsys lock is created whenever we're called to
"start" when we're already running (even more of #596719)
- update to 0.4
- Rebuild with xmlrpc-c support enabled (#1687698)
- Update to upstream 0.79.17 (#2139523)
- Certificate format validation when adding the SCEP server's CA (#2150025)
- Certmonger SCEP renewal should not use old challenges (#2150030)
- certmonger SEGV during rekey in FIPS mode (#2150070)
- Fix local CA to work under FIPS (#1950132)
- log the state in 'getcert status' verbose mode
- avoid potential use-after-free and read overrun after a CA is added
dynamically (thanks to Jan Cholasta)
- add some self-tests
- simplify the internal submit-to-CA logic
- fixes for more problems found through static analysis
- updates to 0.73
- also pass the key type to enrollment helpers in the environment as
a the value of "CERTMONGER_KEY_TYPE"
- mostly documentation updates
- update to 0.1
- update to 0.7
- first cut at a getting-started document
- refactor some internal key handling with NSS
- check for duplicate request nicknames at add-time
- read and cache whether or not we saw a noOCSPcheck extension in certificates
- documentation updates
- update to 0.21
- getcert/*-getcert: relay the desired CA to the local service, whether
specified on the command line (in getcert) or as a built-in hard-wired
default (in *-getcert) (#584983)
- flesh out the default certmonger.conf so that people can get a feel for
the expected formatting (Jenny Galipeau)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuild for xmlrpc-c
- update to 0.25
- new translations
- in by Okta Purnama Rahadian!
- fix detection of cases where we can't access a private key in an NSS
database because we don't have the PIN
- teach '*getcert start-tracking' about the -p and -P options which the
'*getcert request' commands already understand (#621670), and also
the -U, -K, -E, and -D flags
- double-check that the nicknames of keys we get back from
PK11_ListPrivKeysInSlot() match the desired nickname before accepting
them as matches, so that our tests won't all blow up on EL5
- fix dynamic addition and removal of CAs implemented through helpers
- Replace the previous fix for dbus restarting with PartOf in the
certmonger systemd service file to link the two (#1687698)
- large changes to the D-Bus glue, exposing a lot of data which we were
providing via D-Bus getter methods as properties, and providing more
accurate introspection data
- emit a signal when the daemon saves a certificate to the destination
location, and provide an option to have the daemon spawn an arbitrary
command at that point, too (#766167)
- enable starting the service by default on RHEL (#765600)
- when getcert is passed a -a flag, to indicate that CA root certificates
should be stored in the specified database, don't ignore locations which
don't include a storage scheme (#1129537)
- when called to 'start-tracking' with the -a or -F flags, if we have
applicable certificates on-hand for a CA that we're either told to use
or which we decide is the correct one, save the certificates (#1129696)
- update to 0.9
- run external submission helpers correctly
- fix signing of signing requests generated for keys stored in files
- only care about new interface and route notifications from netlink,
and ignore notifications that don't come from pid 0
- fix logic for determining expiration status
- correct the version number in self-signed certificates
- avoid premature exit on CA data analysis failures (should fix an issue
reported by Natxo Asenjo)
- update to 0.77
- add initial, still rough, SCEP support (#1140241,#1161768)
- add an scep-submit helper to handle part of it
- getcert: add add-ca/add-scep-ca/modify-ca/remove-ca commands
- getcert: add -l, -L flags to request/resubmit/start-tracking commands
to provide a way to set a ChallengePassword in signing requests
- lay some groundwork for rekeying support
- bundled dogtag enrollment helpers now output debugging info to stderr (#)
- ipa-getcert: fix a crash when using DNS discovery to locate servers (#39)
- getcert: fix displaying of pre-request pre-/post-save commands (#1178190,
- use Zanata for translations
- getcert list: list the certificate's profile name, if it contains one
- update to 0.79.2:
- fix 'make distcheck' target
- fix the "getcert start-tracking" -L and -l options (#1249753)
- output diagnostics about the second request when scep-submit encounters an
error during a second request to the SCEP server
- don't tag the D-Bus session .service file as a configuration file (internal
tooling)
- Ensure that files read in have a trailing new-line (#1829490)
- fix setting the group ID when spawning the post-save command
- Rebase to 0.79.13 (#1891743)
- check for cases where we fail to allocate memory while reading a request
or CA entry from disk (John Haxby)
- only handle one watch at a time, which should avoid abort() during
attempts to reconnect to the message bus after losing our connection
to it (#1055521)
- notice when the OpenSSL RNG isn't seeded
- notice when saving certificates or keys fails due to filesystem-related
permission denial (#996581)
- api: lift restrictions on characters used in request and CA nicknames by
making their object names not incorporate their nicknames
- api: add find_request_by_nickname and find_ca_by_nickname
- certmonger-ipa-submit.8: list -k, -K, -t in the summary, document -K
- getcert: print "invalid option" error messages ourselves (#756291)
- ipa-submit: supply a Referer: header when submitting requests to IPA
(#750617, needed for #747710)
- updates for 0.73
- set the flag to encode EC public key parameters using named curves
instead of the default of all-the-details when using OpenSSL
- don't break when NSS supports secp521r1 but OpenSSL doesn't
- also pass the CA nickname to enrollment helpers in the environment as
a text value in "CERTMONGER_CA_NICKNAME", so they can use that value
when reading configuration settings
- also pass the SPKAC value to enrollment helpers in the environment as
a base64 value in "CERTMONGER_SPKAC"
- also pass the request's SubjectPublicKeyInfo value to enrollment helpers
in the environment as a base64 value in "CERTMONGER_SPKI" (part of #16)
- when generating signing requests using NSS, be more accommodating of
requested subject names that don't parse properly
- update to 0.33
- new translations
- id by Okta Purnama Rahadian!
- updated translations
- pl, uk
- roll up assorted fixes for defects
- update %docs list because README is now README.md
- when generating keys using OpenSSL, if key generation fails, try
again with the default key size, in case we're in FIPS mode
- documentation updates
- Mass rebuild 2013-12-27
- getcert: fix a buffer overrun preparing a request for the daemon when
there are more parameters to encode than space in the array (#696185)
- updated translations: de, es, id, pl, ru, uk
- update to 0.26
- when canceling a submission request that's being handled by a helper,
reap the child process's status after killing it (#624120)
- modify the systemd .service file to be a proper 'dbus' service (more
of #718172)
- Address more issues uncovered by static analysis (#1632449)
- Fix unit tests. NSS crypto policy disallows keys < 1024
- when attempting to contact an IPA LDAP server, if no "ldap_uri" is set in
default.conf, and no "host" is set either, try to construct the server URI
using the "server" setting (#1126985)
- add a -u flag to getcert to enable requesting a keyUsage extension value
- request subjectKeyIdentifier extensions from CAs, and include them in
self-signed certificates
- request basicConstraints from CAs, defaulting to requests for end-entity
certificates
- when requesting CA certificates, also request authorityKeyIdentifier
- add support for requesting CRL distribution point and authorityInfoAccess
extensions that specify OCSP responder locations
- don't crash when OpenSSL can't build a template certificate from a request
when we're in FIPS mode
- put NSS in FIPS mode, when the system booted that way, except when we're
trying to write certificates to a database
- fix CSR generation and self-signing in FIPS mode with NSS
- fix self-signing in FIPS mode with OpenSSL
- new languages from the translation team: mai, ml, nn, ga
- update to 0.5
- packaging fixes
- add a selfsign-getcert client
- self-signed certs now get basic constraints and their own serial numbers
- accept id-ms-kp-sc-logon as a named EKU value in a request
- expose the certificate's not-valid-before and not-valid-after dates as a
property over D-Bus (ticket #41)
- give the local signer its own configuration option to set the lifetime
of its signing certificate, falling back to the lifetime configured for
the self-signer as a default to match the previous behavior
- fix a potential read segfault parsing the output of an enrollment helper,
introduced in 0.77 (thanks to Steve Neuharth)
- read the ns-certtype extension value in certificates
- request an enrollment certtype extension to CSRs if we have a profile name
that we want to use (ticket #17, possibly part of IPA ticket #57)
- update to 0.34
- explicitly note the number of requests we're tracking in the output of
"getcert list" (#652049)
- try to offer some suggestions when we get certain specific errors back
in "getcert" (#652047)
- updated translations
- es
- Rebase to 0.79.7 (#1708095)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- add a -w (wait) flag to the getcert's request/resubmit/start-tracking
commands, and add a non-waiting status command
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- tweak how we decide whether we're on the master or a minion when we're
told to use certmaster as a CA
- clean up one of the tests so that it doesn't have to work around internal
logging producing duplicate messages
- when logging errors while setting up to contact xmlrpc servers, explicitly
note that the error is client-side
- don't abort() due to incorrect locking when an attempt to save an issued
certificate to the designated location fails (part of #1032760/#1033333,
ticket #22)
- when reading an issued certificate from an enrollment helper, ignore
noise before or after the certificate itself (more of #1032760/1033333,
ticket #22)
- run subprocesses in a cleaned-up environment (more of #1032760/1033333,
ticket #22)
- clear the ca-error that we saved when we had an error talking to the CA if we
subsequently succeed in talking to the CA
- various other static-analysis fixes
- update to 0.36
- fix some use-after-free bugs in the daemon (#689776)
- fix a copy/paste error in certmonger-ipa-submit(8)
- getcert now suppresses error details when not given its new -v option
(#683926, more of #681641/#652047)
- updated translations
- de, es, pl, ru, uk
- indonesian translation is now for "id" rather than "in"
- Rebuilt for gcc bug 634757
- backport change from git to not choke if X509_REQ_to_X509() fails when we're
self-signing using OpenSSL
- backport another change from git to represent this as a CA-rejected error
- update to 0.27
- portability and test fixes
- don't incorrectly assume that CERT_ImportCerts() returns a NULL-terminated
array (#742348)
- update to 0.79.1:
- update translations
- fix 'make archive' target
- ipa-submit: when we fail to locate/contact LDAP or XML-RPC servers,
use discovery to find them (#1136900)
- update to 0.17
- fix a hang in the daemon (Rob Crittenden)
- documentation updates
- fix parsing of submission results from IPA (Rob Crittenden)
- add a command option (-T) to getcert for specifying which enrollment
profile to tell a CA that we're using, in case it cares (#10)
- update to 0.38
- catch cases where we can't read a PIN file, but we never have to log
in to the token to access the private key (more of #688229)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- update to 0.14
- check key and certificate location at add-time to make sure they're
absolute paths to files or directories, as appropriate
- IPA: dig into the 'result' item if the named result value we're looking
for isn't in the result struct
- require a single certificate to be specified to 'getcert status' (#1148001,
- shorten the default help message which getcert prints when it's not given
a specific command (#1131704)
- add private listener (-l, -L, -P) mode to certmonger, to allow it to listen
for connections directly from clients running under the same UID
- add a command mode (-c) to certmonger, in which once it's started, it
launches a specified command, and after that command exits, the daemon exits
- when getcert is invoked with no bus running, if it's running as root, run
certmonger in private listener mode with the same invocation of getcert as
the command to start and wait for (#1134497)
- check specifically for cases where a specified token that we need to
use just isn't present for whatever reason (#697058)
- Move systemd tmpfiles from /var/run to /run (#1804928)
- Improve logging in the SCEP helper (#1807691)
- Fix sort order of certificates passed into PKCS7_verify (#1808052)
- Add -N option to SCEP helper to separate web server chain from
SCEP issuer chain (#1808613)
- Add template profile, MS v2 template and issuer to getcert list
output (#1734451)
- add backported fix to wait a reasonable amount of time after calling the
'resubmit' method for a new certificate to be issued when we're exercising
the D-Bus API during tests (Jan Cholasta, #1351052)
- fix a possible uninitialized memory read (possibly #1260871)
- log a diagnostic error when we fail to initialize libkrb5
- don't create the daemon pidfile until after we've connected to the D-Bus
(still more of #596719)
- update to 0.23
- new translations
- pl by Piotr Drąg!
- cancel daemon startup if we can't gain ownership of our well-known
service name on the DBus (#596719)
- update to 0.13
- change the default so that we default to trying to auto-refresh
certificates unless told otherwise
- preemptively enforce limitations on request nicknames so that they
make valid D-Bus object path components
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- add a -K option to ipa-submit, to use the current ccache, which makes
it easier to test
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Exit gracefully if dbus is restarted (#1687698)
- fix a regression in reading old request tracking files where the
request was in state NEED_TO_NOTIFY or NOTIFYING
- Certmonger SCEP renewal should not use old challenges (#1577570)
- Certmonger segfault after cert renewal request (#1881500)
- Include certificate NotBefore date in output of the 'getcert list' command
(#1940261)
- Certmonger certificates stuck in NEED_GUIDANCE (#2001079)
- update to 0.20
- correctly parse certificate validity periods given in years (spotted by
Stephen Gallagher)
- setup for translation
- es by Héctor Daniel Cabrera!
- ru by Yulia Poyarkova!
- uk by Yuri Chornoivan!
- fix unpreprocessed defaults in certmonger.conf's man page
- tweak the IPA-specific message that indicates a principal name also needs
to be specified if we're not using the default subject name (#579542)
- make the validity period of self-signed certificates into a configuration
setting and not a piece of the state information we track about the signer
- init script: exit with status 2 instead of 1 when invoked with an
unrecognized argument (#584517)
- Call the secport equivalent of PR_ErrorToString
- Remove a couple of unused varaibles found by coverity
- Remove BR on mktemp. It is now provided by coreutils.
- Patch to fix NSS handling of keys in sqlite databases
- Patches to fix tests now that sqlite is the NSS default.
- allow root to use our implementation of org.freedesktop.DBus.Properties
- take more care to not emit useless PropertiesChanged signals
- update to 0.37
- be more careful about checking if we can read a PIN file successfully
before we even call an API that might need us to try (#688229)
- fix strict aliasing warnings
- add a missing test case file (whoops)
- update to 0.79.4
- fix CA option name for ipa cert-request
- fix minor memory leak
- fix build warnings
- fix an incorrect date in the .spec changelog
- bump gettext version to avoid warning
- fix a self-test that broke because one-year-from-now is now a day's worth
of seconds further out than it was a few days ago
- correct encoding/decoding of variant-typed data which we receive and send
as part of the org.freedesktop.DBus.Properties interface over the bus, and
add some tests for them (based on patch from David Kupka, ticket #36)
- fix a bad %preun scriptlet
- fix self-test errors that we trigger with new OpenSSL
- fix a build error that would sometimes happen when we're told to
build PIE binaries
- quiet a compile warning
- note that SELinux usually confines us to writing only to cert_t in
doc/getting-started.txt (#765599)
- fix crashes when we add a request during our first run when we're
populating the hard-coded CA list
- properly deal with cases where a path is passed to us is "./XXX"
- in session mode, create our data directories as we go
- getcert: distinguish between {stat() succeeds but isn't a directory} and
{stat() failed} when printing an error message (#739903)
- getcert resubmit/start-tracking: when we're looking for an existing request
by ID, and we don't find one, note that specifically (#741262)
- Update to upstream 0.79.6
- Fix unit tests to work with python 3
- fix a failure in self-tests
- make pathname canonicalization slightly smarter, to handle ".." in
locations (#1131758)
- updates to self-tests (#1144082)
- Fix test failure in 039-fromfile
- Add BuildRequires on gcc
- add the "local" signer, a local toy CA that signs anything you'll
ask it to sign
- add a %trigger to remove knowledge of the "dogtag-ipa-renew-agent" CA
when we detect certmonger versions prior to 0.58 being installed, to
avoid cases where some older versions choke on CAs with nicknames that
contain characters that can't legally be part of a D-Bus name (#948993)
- Rebuild against fixed libtevent version
- don't display PINs in "getcert list" output (#42)
- clean up launching of a private instance in "getcert"
- expand on the don't-delete-private-key fix from 0.77.3 by letting NSS's
own safety checks have an effect
- backport record-keeping of key generation dates and counts of how many
times we've gotten certificates using a given key pair
- documentation updates
- switch to using popt for parsing command line arguments, continuing to
use old help text for now so that we can catch up with translations (print
old text for --help, new text (with longopts!) for -H)
- add some plumbing for eventually receiving per-certificate roots in
addition to issued certificates and chain certificates
- add a "rekey" command to getcert, for triggering enrollment using a new
key pair (#1087932)
- scep-submit: check for the Renewal capability, and default to taking
advantage of it during rekeying, unless the new -n flag is specified to it
- dogtag-submit: add flags for passing user names, UDNs, passwords, and PINs
to the helper (part of ticket #12)
- dogtag-submit: add a flag for using the agent creds to do TLS client auth
while submitting enrollment requests (more of ticket #12)
- dogtag-submit: handle cases where we submit a request and the server
returns a success code rather than just queuing the request (#12 again)
- ipa-submit: pass requested profile names to the server as an argument
named "profile_id"; if the server gives us an "unrecognized argument"
error, retry without it for compatibility's sake (part of IPA ticket #57)
- keygen: fix a possible crash if keygen fails to return a key from NSS
- correct the certmonger(8) man page's description of the -c flag, which it
used to call the -C flag
- add logic for setting ownership and permissions on certificates and keys
when saving them to disk
- add configuration options "max_key_lifetime" and "max_key_use_count" for
making automatic renewal prefer rekeying
- also save state when we exit due to SIGHUP
- don't get tripped up when enrollment helpers hand us certificates which
include CRLF line terminators (ticket #25)
- be tolerant of certificate issuer names, subject names, DNS, email, and
Kerberos principal namem subjectAltNames, and crl distribution point URLs
that contain newlines
- read and cache the certificate template extension in certificates
- enforce different minimum key sizes depending on the type of key we're
trying to generate
- store DER versions of subject, issuer and template subject, if we have
them (Jan Cholasta, ticket #26)
- when generating signing requests with subject names that don't quite parse
as subject names, encode what we're given as PrintableString rather than
as a UTF8String
- always chdir() to a known location at startup, even if we're not becoming
a daemon
- fix a couple of memory leaks (static analysis)
- add missing buildrequires: on which
- explicitly require "dbus" to try to ensure we have a running system bus
when we get started (#639126)
- adjust internals of logic for talking to dogtag to at least have a
concept of non-agent cases
- when talking to an IPA server's internal Dogtag instance, infer which
ports the CA is listening on from the "dogtag_version" setting in the
IPA configuration (Ade Lee)
- send a notification (or log a message, whatever) when we save a new
certificate (#766167)
- serialize access to NSS databases and the running of pre- and post-save
commands which might also access them (possibly fixing part of #883484)
- update to 0.22
- new translations
- de by Fabian Affolter!
- certmaster-submit: don't fall over when we can't find a certmaster.conf
or a minion.conf (i.e., certmaster isn't installed) (#588932)
- when reading extension values from certificates, prune out duplicate
principal names, email addresses, and hostnames
- update to 0.79.3:
- fix self-signing self-test cases that used DSA or EC keys
- more gracefully handle manual daemon startups and cleaning up of unexpected
crashes (still more of #596719)
- when a caller sets the is-default flag on a CA, and another CA is no longer
the default, emit the PropertiesChanged signal on the CA which is not the
default, instead on the new default a second time
- drop some dead code from the D-Bus message handlers (static analysis,
- cache public keys when we read private keys
- go back to printing an error indicating that we're missing a required
argument when we're missing a required argument, not that the option is
invalid (broken since 0.51, #796542)
- avoid potential use-after-free after a CA is removed dynamically (thanks to
Keenan Brock) (#1125342)
- add a "external-helper" property to CA objects
- build as position-independent executables with early binding (#883966)
- also don't tag the unit file as a configuration file (internal tooling)
- fixes for bugs found by static analysis
- handle IDN correctly when doing service location using SRV records
- documentation updates
- add a "dogtag-ipa-renew-agent" CA so that we can renew certificates using
an IPA server's internal Dogtag instance
- export the requested profile and old certificate to enrollment helpers
- make libxml and libcurl into hard build-time requirements
- serialize all pre/save/post sequences to make sure that stop/save/start
doesn't become stop1/save1/stop2/start1/save2/start2 when we're stopping
a service while we muck with more than one of its certificates
- Include &message=CA-IDENT with GetCACaps/GetCACert requests (#1843009)
- if xmlrpc-c's struct xmlrpc_curl_xportparms has a gss_delegate field, set
it to TRUE when we're doing Negotiate auth (#727864, #727863, #727866)
- fix a crash in the self-tests
- Add long command-line options to man pages and help output (#1782838)
- dogtag-submit: accept additional options to pass to the server when
approving requests using agent creds (#1165155, patch by Jan Cholasta)
- getcert: print help output when 'status' isn't given any args (#1163541)
- at startup, if we resume the state machine for a given certificate to a state
which expects to have the newly-added lock already acquired, acquire it
before moving on with the certificate's work (still aimed at fixing #883484)
- correctly read CA not-valid-after dates on 32-bit machines (also reported by
Natxo Asenjo), so that we don't spin on polling them (#1163023)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- add a 'refresh' option to the getcert command
- add a '-a' flag to the getcert command's 'refresh-ca' option
- update to 0.79.5:
- getcert start-tracking: use issuer option when specified
- add support for specifying the MS certificate template
- Reformat certificates returned by Dogtag to strip extra newline
- retrieve CA information from CAs, if the helpers can do so, and
add a command to explicitly refresh that data: "getcert refresh-ca"
- offer to save CA certificates to files and databases, when specified with
new -a and -F flags to getcert request/resubmit/start-tracking (#1098208,
trac #31)
- add IP address subject alternate names when getcert request/resubmit
is passed the -A option (trac #35)
- read and cache the freshestCRL extension in certificates
- properly interpret KDC-unreachable errors encountered in the IPA
submission error as a server-unreachable error that we will retry,
rather than a misconfiguration error which we won't
- don't let tests get tripped up by new formatting used in dos2unix status
messages (#1099080)
- updated translations
- be explicit that we are going to use bashisms in test scripts by calling
the shell interpreter as 'bash' rather than 'sh' (trac #27)
- instead of using killall to send a SIGHUP to the system bus daemon in %post
to get it to reload its configuration, use dbus-send to send a ReloadConfig
request over the bus (should fix #1277573)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- update to 0.39
- fix use of an uninitialized variable in the xmlrpc-based submission
helpers (#690886)
- Improve handling of NSS tokens (#1624930)
- Pull in upstream fixes discovered in coverity and clang (#1632449)
- self-tests: assume that certutil won't generate DSA keys with more than 1024
bits, and will often short us by a few
- read information about the keys we've just generated before proceeding
to generating a CSR (part of #694184, part of #695675)
- when processing a "resubmit" request from getcert, go back to key
generation if we don't have keys yet, else go back to CSR generation as
before (#694184, #695675)
- configure with --with-tmpdir=/var/run/certmonger and own /var/run/certmonger
(#687899), and add a systemd tmpfiles.d control file for creating
/var/run/certmonger on Fedora 15 and later
- let session instances exit when they get disconnected from the bus
- use a lock file to make sure there's only one session instance messing
around with the user's files at a time
- fix errors saving certificates to NSS databases when there's already a
certificate there with the same nickname (#695672)
- make key and certificate location output from 'getcert list' more properly
translatable (#7)
- update to 0.24
- keep the lock on the pid file, if we have one, when we fork, and cancel
daemon startup if we can't gain ownership of the lock (the rest of #596719)
- make the man pages note which external configuration files we consult when
submitting requests to certmaster and ipa CAs
- update to 0.29
- fix 64-bit cleanliness issue using libdbus
- actually include the full set of tests in tarballs
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
compat-openssl10-1.0.2o-4.el8_10.1.x86_64.rpm | - add back -devel subpackage as a stop-gap measure for software
that cannot be ported to new API easily
- Fix CVE-2022-0778: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
Resolves: rhbz#2077418
- minor upstream release 1.0.2n fixing security issues
- removed Buildroot and clean section
- added Conflicts with old openssl
- provide and use compat openssl10.cnf as the non-compat one is incompatible
- add missing ldconfig call to post script
- Fix CVE-2023-0286 X.400 address type confusion in X.509 GeneralName
Resolves: RHEL-9699
- minor upstream release 1.0.2o fixing security issues
- fix -devel subpackage conflict with man-pages package (#1387175)
- updated to 1.0.2j and modified Summary
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Add flags for riscv64.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- minor upstream release 1.0.2m fixing security issues
- fix locking of RNG in FIPS mode for some obscure use-cases
- correct wrong Requires in -devel subpackage
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- renamed to compat-openssl10, additional cleanups
- compat package created
- apply RPM_LD_FLAGS properly (#1548117)
flac-libs-1.3.2-11.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- update to 1.3.0pre1
- make some dependencies arch-specific
- update to 1.3.0pre3
- Update to upstream 1.1.4
- don't free memory that is still used after realloc() error (CVE-2020-22219)
- Update link-ogg patch for 1.1.4
- Rebuild for build ID
- #119551 flac-xmms -> xmms-flac to match fedora.us and freshrpms.net
- Obsoletes flac-libs to upgrade smoothly from fedora.us
- Update with work from Matthias Clasen up
to upstream 1.1.3 (#229462)
- Remove xmmx-flac Obsolete, as we don't ship the xmms plugin
- BuildRequire glib-devel for xmms plugin
- BuildRequire nasm
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Fix buildreqs (#154649 thias)
- obsolete older xmms-flac
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Also include the new pkgconfig files
- rebuild for -devel deps
- rebuilt for new gcc4.1 snapshot and glibc changes
- rebuilt
- disable nasm to avoid gaps in annobin coverage (#1630561)
- update to 1.3.0
- Removed xmms-flac subpackage
- Switch to %ldconfig_scriptlets
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- update to 1.3.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- rebuilt
- rebuilt
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- The byteSwap symbol shouldn't be global, reported by Joe Orton
(#215920)
- Rebuilt for Fedora 23 Change
https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
- add xmms-flac plugin as a conditionalized subpackage
- A few fixes from the the Fedora merge review
- Remove the static library
- fix x86_64 linkage (#117893)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- update to 20121204gita43f56
- create libs subpackage
- split documentation to base and devel subpackages
- drop defattr macros
- add GFDL to License tag
- Update for 1.20 and drop obsolete patches (#285161)
- initial build
- Rebuilt for GCC 5 C++11 ABI change
- Rebuild (flac picked up a dependancy on it's older version)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- update to 1.3.1 (CVE-2014-8962, CVE-2014-9028)
- fix memory leak in parsing of vorbis comments (CVE-2017-6888)
- add gcc to build requirements
- speed up decoding
- CFLAGS cleanup
- New patch flac-1.1.0-gnu-stack.patch from Ulrich Drepper to mark asm
as not requiring an executable stack
- Fixed warnings in shipped m4 file.
- Rebuild to fix FTBFS
- drop xmms-flac subpackage (#1578806)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Added self-obsoletes to help multilib upgrades
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- fix memory corruption in metaflac (#969259)
- disable slower assembly code
- Autorebuild for GCC 4.3
- Update GNU stack patch to cover all the NASM sources used
- fix building with gcc-4.3
- reenable some assembly optimizations
- hide private libFLAC symbols (#285961)
- update license tag
- add %check
- remove -maltivec from CFLAGS
- Update to 1.2.1
- Make a few functions hidden, to try and avoid textrels
- Disable optimisations on x86 for the same reason
(#285961)
- Update to upstream version 1.1.2
- Replace flac-1.1.0-libtool.patch with flac-1.1.2-libtool.patch
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- rebuild
- Try building w/ glib2-devel
- rebuild for gcc 4.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- rebuilt
- bump again for double-long bug on ppc(64)
glx-utils-8.4.0-5.20181118git1830dcb.el8.x86_64.rpm | - Start using proper git version strings for rawhide
- Enabling building of wayland and freetype demos
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuild for new glew soname
- New git snap
- Add EGL/GLES buildreqs and egl-utils subpackage
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuild for glew 2.0.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Rebuild for glew 1.9.0
- Initial build.
- 8.3.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- 8.2.0 upstream release
- Build with --as-needed so glxinfo doesn't needlessly drag in GLEW
- Rebuild for RHEL 8.3
- Rebuilt for Fedora 23 Change
https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
- New git snapshot
- Fix xdriinfo not working with libglvnd (rhbz#1429894)
- Copy glxinfo to glxinfo%{__isa_bits}, to allow people to check that their
compatibility drivers are working.
- update to 8.0.1 (git checkout from 20121218)
- update xdriinfo to 1.0.4
- remove non-free files (bz892925)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Today's git snapshot
- Arbitrary EVR bump to be newer than when the mesa source package dropped
the demos subpackage.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Rebuilt for glew 2.1.0
- Rebuilt for GLEW soname bump
- Install rgba images too (#640688)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- fix install of gears/info (#647947)
- New git snapshot
- rebuilt for glew 1.10
- package upstream demos release 8.1.0 (mainly for new glxinfo)
- Rebuild for glew 1.13
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
gsm-1.0.17-5.el8.x86_64.rpm | - update homepage and source URLs
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- 1.0.10-0.lvn.8: Use -fPIC on non ix86
- Rebuild for GCC 4.3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- update to 1.0.16 (#1397242)
- use license macro
- drop obsolete stuff and simplify
- Fixed build failure, defuzzified gsm-warnings patch
Resolves: rhbz#757136
- 0:1.0.10-0.fdr.6: remove second makeinstall
- Update to 1.0.13
- 1.0.10-0.fdr.7: applied patch from Ville, remove epoch since it's allowed
- 1.0.10-0.fdr.2
- Fix libgsm.so.* being files instead of symlinks
- Fix dangling symlinks for shared lib, thanks to Lucian Langa for pointing out the issue.
- Upload sources
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- fix parallel make
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- rebuilt for unwind info generation, broken in gcc-4.1.1-21
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- install symlinks instead of binaries in -devel
- Update to Release 1.0 Patchlevel 12.
- Build with -fPIC not just for non-ix86.
- Add check section to ensure proper library version.
- Remove static library.
- 1.0.10-0.lvn.10: Clean up installation
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- update to 1.0.17 (#1465878)
- ease future updates by better macro use
- drop obsolete patch hunks
- fix missing prototype for fchown warning
- 0:1.0.10-0.fdr.1: initial RPM release
- add dist
- Defines changed to globals
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- 1.0.10-0.lvn.9: mv libgsm.a only when needed
- 1.0.10-0.fdr.3
- pull in RPM_OPT_FLAGS in patch instead of using perl to wedge it in
- fix group
- -p'ize ldconfig
- 0:1.0.10-0.fdr.5
- added back epochs, I surrender
- fix RPM_OPT_FLAGS hackery
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- rebuild for BuildID
- specfile cleanups
- switch to new release field
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- 1.0.10-0.fdr.4: remove epoch mentions
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- 1.0.10-11
- rebuild for FC6
- ensure binaries are linked with Fedora LDFLAGS (#1548532)
- use ldconfig_scriptlets macro
- add proper man links for tcat and untoast
- fix some warnings
- fix 64bit testsuite issue as described at gsm homepage
- add compatibility header symlink
- split off binaries into a separate package
gstreamer1-1.16.1-2.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Update to 1.0.4
- Update to 1.9.1
- Cleanup spec file conditionals
- Update to 1.8.0
- Update to 1.2.2.
- Update to 1.7.90
- Update to 1.1.2.
- Update to 1.0.5.
- Update to 1.8.1
- Update to 1.11.91
- Update to 1.6.2
- Update to 1.0.7.
- Update to 1.4.0
- Update to 1.0.6.
- Remove BR on PyXML.
- Update to 1.11.2
- fix build on s390x
- -devel: Conflicts: gstreamer1-plugins-bad-free-devel < 1.13
- Update to 1.5.91
- Update to 1.3.90
- Update to 1.7.91
- Update to 0.11.94.
- Update to 1.5.2
- Remove (obsolete since 1.2.0) xfig build dependency.
- Update to 1.1.90.
- rebuild for https://github.com/UnitedRPMs/packages/issues/106#issuecomment-290404434
- %build: --disable-fatal-warnings --disable-silent-rules
- fix rpath harder
- use %ldconfig_scriptlets, %make_build, %make_install
- -devel: tighten deps with %{_isa}
- Update to 1.3.91
- Update to 1.2.3.
- fix build on Power64
- Update to 1.10.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Add patch to gst-inspect to generate RPM provides
- Add RPM find-provides script
- Update to 1.0.3
- Update to 1.12.1
- Add gst-stats manpage
- Update to 1.5.1
- add new bash-completion scripts
- gstconfig.h got moved
- Update to 1.7.1
- update rpm inspect patch
- add gst-stats
- add core traces
- Rebuilt for gobject-introspection 1.41.4
- Enable verbose build
- Update to 1.4.1
- Update to 1.1.4.
- Update to 1.12.2
- Update to 1.1.3.
- Update to 1.10.0
- Update to 1.9.90
- remove obsolete patches
- Tweak BRs for RHEL
- Update to 1.9.2
- gstconfig.h was moved to normal include dir
- Update to 1.2.0.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Remove lib64 rpaths from newly added binaries
- Update to 1.7.2
- Use python3 for docs generation
- Rebuilt for Fedora 23 Change
https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
- Update to 1.2.4.
- Update to 1.5.90
- Use %global instead of %define.
- Remove rpath.
- Update to 1.6.1
- Update to 1.4.5
- Update to 1.12.0
- Update to 1.14.0
- Update to 0.11.99
- Update to 1.2.1.
- Update to 1.12.3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to 1.13.1
- Update rpm patch
- Fix compiler error
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Update to 1.4.4
- Update to 1.16.1
- Enable libcap for the ptp helper permissions
- Resolves: rhbz#1756299
- Update to 1.13.90
- Update to 1.8.2
- Update to 1.12.4
- Update to 1.11.90
- Update to 1.13.91
- fix doc dependencies
- Update to 1.11.1
- update rpm patch
- Update to 1.16.2 for correctly pick up for side gating
- Resolves: rhbz#1756299
- Update to 1.0.0.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- fix build
- Update to 0.11.93.
- Bump minimum version of glib2 needed.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Update to 1.6.0
- Use license macro for COPYING
- Update to 1.0.2.
- Update to 1.4.2
- Initial Fedora spec file.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Update to 1.0.1
- Update to 1.10.2
gstreamer1-plugins-bad-free-1.16.1-5.el8_10.x86_64.rpm | - Bump (libass)
- Move libgstdecklink to its correct place in extras; needed for RHEL
- Update to 1.9.2
- Update to 1.0.4
- Update to 1.0.5
- Update to 1.0.6.
- Drop BR on PyXML.
- Update to 1.8.0
- Update to 1.2.2.
- Update to 1.11.1
- Add audiobuffersplit
- Dataurisrc was moved to core
- Add ttmlsubs plugin
- Update to 1.8.1
- Update to 1.11.91
- Update to 1.6.0
- Remove lib64 rpaths from a few more libraries
- Use license macro for COPYING and COPYING.LIB
- Fix RTP/RTCP muxing (#1199578)
- Update to 1.6.2
- Added missing buildrequire on EGL
- Cleanup spec file conditionals
- Patch CVE-2023-40474: Integer overflow
- Patch CVE-2023-40475: Integer overflow
- Patch CVE-2023-40476: Integer overflow in H.265 video parser
- Resolves: RHEL-19500, RHEL-19504, RHEL-19507
- Rebuild for new libsrtp
- 1.13.1
- use %ldconfig_scriptlets %make_build %make_install
- fix rpath in gst-p-bad-cleanup.sh
- tighten subpkg deps with %{?_isa}
- -gtk subpkg now empty. FIXME
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- rebuild (libwebp)
- Update to 1.9.90
- Patch CVE-2023-44446: MXF demuxer use-after-free
- Resolves: RHEL-16794
- Update to 1.0.7.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Enable verbose build
- Build gobject-introspection support. (#1028156)
- Register as an AppStream component.
- Rebuilt for nettle soname bump
- Update to 1.7.1
- rename fragmented -> hls
- remove liveadder
- add gstplayer
- add teletextdec and videoframe_audiolevel
- drop -gtk subpkg, moved to gst1-plugins-good
- Update to 1.5.91
- Add BR on gnutls-devel for HLS support. (#1030491)
- Update to 0.11.94.
- Update to 1.5.2
- Add optional data to AppStream metadata.
- Update to 1.14.0
- add webrtc gir and typelib
- Update to 1.1.90.
- Build the srtp plugin. (#1055669)
- Update to 1.4.0.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Update to 1.2.3.
- Update to 1.13.91
- Update to 1.10.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Update to 1.7.2
- remove rtpbad plugin, it was moved
- add new libraries and netsim plugin
- Update to 1.0.2
- Use openjpeg2 instead of openjpeg (#1553079)
- Update to 1.0.3
- Initial Fedora spec file.
- Build the wayland video output plugin
- Enable uvch264
- Update to 1.0.1
- Add frei0r plugin to file list.
- Build opus plugin.
- Merge patches from Kevin Kofler (#1267665)
- Split gtksink into a -gtk subpackage (#1295444)
- Split wildmidi plugin into a -wildmidi subpackage (#1267665)
- BR mesa-libGLES-devel to enable OpenGL ES 2 support in GstGL (#1308290)
- Update to 1.13.90
- Add audiolatency
- Schrodinger element was removed
- Rebuild for soundtouch ABI break (#1311323)
- Update to 1.4.2.
- Update to 1.1.4.
- Update to 1.12.2
- Fix permission on tarball clean-up script.
- Re-enable soundtouch-devel.
- Add COPYING.LIB to package.
- Use %global instead of %define.
- Update to 1.4.1.
- Update to 1.1.3.
- Update to 1.10.0
- Update to 1.2.0.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update to 1.12.1
- Remove celt buildreq, the plugin was removed and so is celt-devel
- Enable more plugins: gtksink, webp, bluez, bs2b, gme, ofa, openal,
opencv, openjpeg
- Rebuild (libwebp)
- Update to 1.7.90
- the opus plugin was moved to -base.
- Update to 1.5.90
- remove rpath from gtksink and mxf
- Fix description line too long
- Update to 1.11.90
- Update plugin names
- Remove old rawparse plugin
- Add new allocator lib and legacyrawparse
- Update to 1.6.1
- Update to 1.12.0
- Add BuildRequest python3-devel
- Update to 0.11.99
- Update to 1.16.1
- Remove upstreamed patches
- Remove dependency on removed package
- Add sctp and closedcaption plugins
- The vcdsrc plugin was removed
- Resolves: rhbz#1756299
- The soundtouch-devel BR should be on, even with extras disabled
- Rebuild for soundtouch 2.0.0
- Update to 1.2.1.
- Bump to avoid conflict with z stream.
- Resolves: RHEL-16794
- Update to 1.12.3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to 1.9.1
- add musepack plugin
- add kmssink plugin
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rebuild
- Update to 1.4.5
- Rebuild for opencv
- Disable opencv, the version is too new
- Update to 1.7.91
- The opus parse was not moved so we still need opus-devel and we still
ship a plugin.
- the plugin was renamed to opusparse
- Update to 1.4.4
- Update to 1.3.91.
- Remove old libraries
- Update to 1.5.1
- Drop old patch
- Build ladspa, libkate, and wildmidi plugins.
- Update to 1.8.2
- Update to 1.12.4
- Append --disable-fatal-warnings to %configure to prevent
building from aborting for negligible warnings (Fix F24FTBFS)
- Append --disable-silent-rules to %configure to make
building verbose.
- Don't remove buildroot before installing.
- Build fluidsynth plugin. (#1024906)
- Rebuild with binutils fix for ppc64le (#1475636)
- Update to 1.2.4.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- rebuild (openexr)
- Rebuilt for GCC 5 C++11 ABI change
- Update to 1.0.0.
- Rebuild for chromaprint .so change
- Fixes for problems found by covscan
- Resolves: rhbz#1602534
- add chromaprint plugin
- Put the fluidsynth plugin in its own subpackage and make it require
soundfont2-default (rhbz#1078925)
- Remove obsolete liboil BR (#1588303)
- Only build extras on Fedora
- bluez is not in extras
- vdpau is in extras
- Update to 1.11.2
- add audiomixmatrix
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- fix for CVE-2025-3887
Resolves: RHEL-93051
- Rebuild for new wildmidi
- Update to 0.11.93.
- Update to 1.1.2.
- Update to 1.10.2
gstreamer1-plugins-base-1.16.1-5.el8_10.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Update to 1.0.4
- Update to 1.2.2.
- Update to 1.8.0
- Update to 1.7.90
- Update to 1.0.5.
- Update to 1.8.1
- Update to 1.6.2
- Add upstream fix for excessive alsasink CPU usage
- Add BuildRequest python3-devel
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Update to 1.0.7.
- Fix potential deadlock on startup when playing audio files
- Improve conditional SSE and SSE2 compilation
- Register as an AppStream component.
- Update to 1.7.2
- fix for renamed header
- Update to 1.11.2
- Update to 1.5.91
- Update to 1.11.91
- Add new headers
- Add patch to fix missing mp3 codec discovery. (#680809, #896018)
- Update to 1.7.91
- Update to 0.11.94.
- Remove cdparanoia dependency
- Resolves: rhbz#1605265
- Update to 1.16.1
- Resolves: rhbz#1756299
- Remove rpath.
- Update to 1.9.2
- drop upstreamed patch
- add new files
- Update to 1.4.0.
- Fix man file names for Flatpak builds
- Resolves: rhbz#1895935
- Update to 1.11.1
- Fix build on big-endian
- Update to 1.13.1
- Add patch to fix aliasing compilation error
- Add GL buildrequires
- Update to 1.10.1
- Update to 1.9.1
- add audio-resampler.h
- Update to 1.7.1
- Add new files
- Drop gst-visualise mention from description. (#947658)
- Update to 1.1.2.
- Drop contrast/brightness video playback patch. Fixed upstream.
- Update to 1.0.3
- Add opus that was moved from -bad-free
- Update to 1.2.3.
- Drop patch to fix build on aarch64. Fixed upstream.
- Rebuilt for gobject-introspection 1.41.4
- Update to 1.4.2.
- Enable verbose build
- Update to 1.1.4.
- Update to 1.12.2
- Update to 1.4.1.
- Update to 1.1.3.
- Update to 1.10.0
- Update to 1.2.1.
- Drop patch to fix potential deadlock on startup. Fixed upstream.
- Update to 1.2.0.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update to 1.9.90
- Update to 1.12.1
- Add upstream patch to fix build on aarch64
- Add optional data to AppStream metadata.
- Update to 1.2.4.
- Update to 1.5.90
- Update to 1.5.2
- Don't produce gir and typlib for GstRiff
- Add multiview headers
- CVE-2023-37328 gstreamer1-plugins-base: heap overwrite in subtitle parsing
- Resolves: RHEL-19472
- Update to 1.6.1
- Update to 1.4.5
- Update to 1.12.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Fixes for CVE-2024-47538, CVE-2024-47607, CVE-2024-47615
Resolves: RHEL-70974, RHEL-71010, RHEL-70986
- Update to 1.14.0
- Update to 0.11.99
- Update to 1.12.3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to 1.3.91.
- rebuild for new libvisual
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Update to 1.4.4
- Update to 1.13.90
- Update to 1.8.2
- Update to 1.1.90.
- Bump minimum version of orc needed.
- Update to 1.12.4
- Upstream patch to fix contrast/brightness in video playback
- Update to 1.13.91
- Add new prelude .h files
- CVE-2024-4453 gstreamer1: EXIF Metadata Parsing Integer Overflow
- Resolves: RHEL-38509
- Enable Wayland support (previously disabled due to missing wayland-devel
as a BR - before it was probably brought in by something else).
- tigten subpkg deps
- fix rpaths
- update %files
- use %ldconfig_scriptlets %make_build %make_install
- %build: --disable-fatal-warnings --disable-silent-rules
- Conflicts: gstreamer1-plugins-bad-free < 1.13
- Update to 1.0.0.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Update to 1.5.1
- add missing headers
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Update to 1.6.0
- Use license macro for COPYING
- Update to 1.0.2.
- Update to 1.11.90
- Add new plugins
- Update to 0.11.93.
- Package gst-visualise.
- Backport new missing plugins API
- Update to 1.0.6.
- Drop BR on PyXML.
- Drop alsa delay patch. Fixed upstream.
- Initial Fedora spec file.
- Update to 1.0.1
- Update to 1.10.2
ipa-client-4.9.13-20.module+el8.10.0+2067+377bdd64.x86_64.rpm | - Resolves: #846033 [RFE] Documentation for JSONRPC IPA API
- Resolves: #989091 Ability to manage IdM/IPA directly from a standard LDAP
client
- Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
users in IdM
- Resolves: #1115294 [RFE] Add support for DNSSEC
- Resolves: #1145748 [RFE] IPA running with One Way Trust
- Resolves: #1199520 [RFE] Introduce single upgrade tool - ipa-server-upgrade
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Resolves: #1200728 [RFE] Replicate PKI Profile information
- Resolves: #1200735 [RFE] Allow issuing certificates for user accounts
- Resolves: #1204054 SSSD database is not cleared between installs and
uninstalls of ipa
- Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
Trusts
- Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
- Resolves: #1204504 [RFE] Add access control so hosts can create their own
services
- Resolves: #1206534 [RFE] Offer Kerberos over HTTP (kdcproxy) by default
- Resolves: #1206613 [RFE] Configure IPA to be a trust agent by default
- Resolves: #1209476 package ipa-client does not require package dbus-python
- Resolves: #1211589 [RFE] Add option to skip the verify_client_version
- Resolves: #1211608 [RFE] Generic support for unknown DNS RR types (RFC 3597)
- Resolves: #1215735 ipa-replica-prepare automatically adds a DNS zone
- Resolves: #1217010 OTP Manager field is not exposed in the UI
- Resolves: #1222475 krb5kdc : segfault at 0 ip 00007fa9f64d82bb sp
00007fffd68b2340 error 6 in libc-2.17.so
- Related: #1204809 Rebase ipa to 4.2
- Update to upstream 4.2.0
- Move /etc/ipa/kdcproxy to the server subpackage
- Hardening for CVE-2020-25717
- Rebuild against samba-4.14.5-11.el8
- Resolves: RHBZ#2021443
- PKI database is ugraded during replica installation (#1075118)
- Resolves: #1254689 Storing big file as a secret in vault raises traceback
- vault: Limit size of data stored in vault
- Resolves: #1255880 ipactl status should distinguish between different
pki-tomcat services
- ipactl: Do not start/stop/restart single service multiple times
- Upstream pre release FreeIPA 4.9.0rc3
Related: RHBZ#1891832
- Updated to upstream 3.0.0 GA
- Set minimum for samba to 4.0.0-153.
- Make sure server-trust-ad subpackage alternates winbind_krb5_locator.so
plugin to /dev/null since they cannot be used when trusts are configured
- Restrict krb5-server to 1.10.
- Update BR for 389-ds-base to 1.3.0
- Add directory /var/lib/ipa/pki-ca/publish for CRL published by pki-ca
- Add Requires on zip for generating FF browser extension
- Resolves: #1614301 Remove --no-sssd and --noac options
- Resolves: #1613879 Disable Domain Level 0
- New patch sets to disable domain level 0
- New adapted patch to disable DL0 specific tests (pytest_ipa vs.
pytest_plugins)
- Adapted branding patch in ipa-replica-install.1 due to DL0 removal
- Set mode of /etc/ipa/ca.crt to 0644 in CA-less installations
Resolves: RHBZ#1870202
- Resolves: #1475238 Use CommonNameToSANDefault in default profile
(new installs only)
- Restore old version of caIPAserviceCert for upgrade only
- Remove ipa-server-selinux obsoletes as upgrades from version prior to
3.3.0 are not allowed
- Wrap server-trust-ad subpackage description better
- Add (noreplace) flag for %{_sysconfdir}/tmpfiles.d/ipa.conf
- Change permissions on default_encoding_utf8.so to fix ipa-python Provides
- Use default crypto policy for TLS and enable TLS 1.3 support
Resolves: RHBZ#1777809
- Covscan fixes
Resolves: RHBZ#1777920
- Change pki_version to 10.8.0
Related: RHBZ#1748987
- Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
- Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
- Related: #1356134 'kinit -E' does not work for IPA user
- Add bash completion script and own /etc/bash_completion.d in case it
doesn't already exist
- Bump up minimum version of python-nss to pick up nss_is_initialize() API
- Updated to upstream 3.0.0 beta 1
- Resolves: #1416454 replication race condition prevents IPA to install
- wait_for_entry: use only DN as parameter
- Wait until HTTPS principal entry is replicated to replica
- Use proper logging for error messages
- Unable to remove replica by ipa-replica-manage (#1001662)
- Before uninstalling a server, warn about active replicas (#998069)
- Move initialization of Guests mapping after cifs/ principal is created
- Related: rhbz#1623895
- Upstream release FreeIPA 4.9.1
Related: RHBZ#1891832
- Fix mapping of BUILTIN\Guests to 'nobody' group during upgrade
to not use generated Samba config at this point
- Related: rhbz#1623895
- Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
- Increase default timeout for IPA services (#1033273)
- Error while running trustdomain-find (#1054376)
- group-show lists SID instead of name for external groups (#1054391)
- Fix IPA server NetBIOS name in samba configuration (#1030517)
- dnsrecord-mod produces missing API version warning (#1054869)
- Hide trust-resolve command as internal (#1052860)
- Add Trust domain Web UI (#1054870)
- ipasam cannot delete multiple child trusted domains (#1056120)
- Require 389-ds-base-legacy-tools for setup tools
- ipatests: Update ipa-adtrust-install test
Resolves: RHEL-40894
- Conditionally restart also dirsrv and httpd when upgrading
- IPA extdom plugin fails when encountering large groups (#1193759)
- CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
(#1202998)
- Added auto* BuildRequires
- Added httpd SELinux policy so CRLs can be read
- Revert DNSResolver Fix use of nameservers with ports.
Related: RHBZ#2141316
- Fix NetBIOS name generation in CLDAP plugin (#1030517)
- ipa-kdb: Fix double free in ipadb_reinit_mspac()
Resolves: RHEL-25742
- kra: set RSA-OAEP as default wrapping algo when FIPS is enabled
Resolves: RHEL-12153
- Vault: improve vault server archival/retrieval calls error handling
Resolves: RHEL-12153
- Vault: add support for RSA-OAEP wrapping algo
Resolves: RHEL-12153
- Fix postin scriplet for F-15/F-16
- Deletion of active subdomain range should not be allowed (#1075615)
- Fallback to global policy in ipa lockout plugin (#912725)
- Migration does not add users to default group (#903232)
- ipa-kdb: Make AD-SIGNEDPATH optional with krb5 DAL 8 and older
Resolves: RHEL-12198
- Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
tracked
- cert renewal: Include KRA users in Dogtag LDAP update
- cert renewal: Automatically update KRA agent PEM file
- Resolves: #1257163 renaming certificatte profile with --rename option leads
to integrity issues
- certprofile: remove 'rename' option
- Resolves: #1257968 kinit stop working after ipa-restore
- Backup: back up the hosts file
- Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
- DNSSEC: remove "DNSSEC is experimental" warnings
- Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
- Installer: do not modify /etc/hosts before user agreement
- Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
zone
- DNSSEC: backup and restore opendnssec zone list file
- DNSSEC: remove ccache and keytab of ipa-ods-exporter
- DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
- DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
- DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
key master
- DNSSEC: Fix key metadata export
- DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
- Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
- Using LDAPI to setup CA and KRA agents.
- Resolves: #1259848 server closes connection and refuses commands after
deleting user that is still logged in
- ldap: Make ldap2 connection management thread-safe again
- Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
'ra_certprofile' while ipa-ca-install
- load RA backend plugins during standalone CA install on CA-less IPA master
- Remove dependency on nss_ldap/nss-pam-ldapd
- The official client is sssd and that's what we use by default.
- Resolves: #1461177 ipa-otptoken-import - XML file is missing PBKDF2
parameters!
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
search in cn=ad, cn=trusts,dc=example,dc=com
- Resolves: #1467887 iommu platform support for ipxe
- Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic key for
host
- Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
4.5
- Resolves: #1480102 ipa-server-upgrade failes with "This entry already
exists"
- Resolves: #1482802 Unable to set ca renewal master on replica
- Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
(ipa-server-upgrade)
- Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
thus startup of Web UI fails
- Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
to self-signed CA
- Resolves: #1469246 Replica install fails to configure IPA-specific
temporary files/directories
- Resolves: #1469480 bind package is not automatically updated during
ipa-server upgrade process
- Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
installs only)
- Resolves: #1477703 IPA upgrade fails for latest ipa package
- Prevent multilib failures in *.pyo and *.pyc files
- Update dependencies for samba, 389-ds and sssd
Resolves: RHBZ#1792848
- Remove v1-style /etc/ipa/ipa.conf, replacing with /etc/ipa/default.conf
- Removed python-asset based webui
- Improve server affinity for CA-less deployments
Resolves: RHEL-22283
- host: update system: Manage Host Keytab permission
Resolves: RHEL-22286
- adtrustinstance: make sure NetBIOS name defaults are set properly
Resolves: RHEL-21938
- ipatests: Fix healthcheck report when nsslapd accesslog logbuffering is set to off
Resolves: RHEL-19672
- Resolves: #1377973 ipa-server-install fails when the provided or resolved
IP address is not found on local interfaces
- Only warn when specified server IP addresses don't match intf
- Resolves: #1438016 gssapi errors after IPA server upgrade
- Bump version of python-gssapi
- Resolves: #1457942 certauth: use canonical principal for lookups
- ipa-kdb: use canonical principal in certauth plugin
- Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
breaking older clients
- Add code to be able to set default kinit lifetime
- Revert setting sessionMaxAge for old clients
- Add missing entry for /var/cache/ipa/kpasswd (444624)
- Added patch to fix permissions problems with the Apache NSS database.
- Added patch to fix problem with DNS querying where the query could be
returned as the answer.
- Fix spec error where patch1 was in the wrong section
- Update to upstream 3.3.3 (#991064)
- Rebuild against samba4 beta7
- [WebUI] IPA Error 3007: RequirmentError" while adding members in
"User ID overrides" tab (updated)
Resolves: RHBZ#1757045
- ipa-client-install: use the authselect backup during uninstall
Resolves: RHBZ#1810179
- Replace SSLCertVerificationError with CertificateError for py36
Resolves: RHBZ#1858318
- Fix AVC denial during ipa-adtrust-install --add-agents
Resolves: RHBZ#1859213
- ipa-server-install fails if --subject parameter is other than default
realm (#983075)
- do not allow configuring bind-dyndb-ldap without persistent search (#967876)
- Lockout plugin crashed during ipa-server-install (#912725)
- Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
- ldap: limit the retro changelog to dns subtree
- Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
of "CA:FALSE" IPA CA CSR
- Include the CA basic constraint in CSRs when renewing a CA
- Resolves: #1493145 ipa-replica-install might fail because of an already
existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
- Checks if replica-s4u2proxy.ldif should be applied
- Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
- ds: ignore time skew during initial replication step
- ipa-replica-manage: implicitly ignore initial time skew in force-sync
- Resolves: #1500218 Replica installation at domain-level 0 fails against
upgraded ipa-server
- Fix ipa-replica-conncheck when called with --principal
- Resolves: #1506188 server-del doesn't remove dns-server configuration
from ldap
- Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
- Fix an integer underflow bug in libotp
- Resolves: #1262996 ipa vault internal error on replica without KRA
- install: always export KRA agent PEM file
- vault: select a server with KRA for vault operations
- Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
- do not overwrite files with local users/groups when restoring authconfig
- Renamed patch 1011 to 0138, as it was merged upstream
- Resolves: #1469246 Replica install fails to configure IPA-specific
temporary files/directories
- replica install: drop-in IPA specific config to tmpfiles.d
- Resolves: #1469480 bind package is not automatically updated during
ipa-server upgrade process
- Bumped Required version of bind-dyndb-ldap and bind package
- Set minimum version of sssd to 1.5.1
- Update to upstream freeipa-2.0.0.rc1
- Move server-only binaries from admintools subpackage to server
- Resolves: #1455946 Provide a tooling automating the configuration
of Smart Card authentication on a FreeIPA master
- smart-card advises: configure systemwide NSS DB also on master
- smart-card advises: add steps to store smart card signing CA cert
- Allow to pass in multiple CA cert paths to the smart card advises
- add a class that tracks the indentation in the generated advises
- delegate the indentation handling in advises to dedicated class
- advise: add an infrastructure for formatting Bash compound statements
- delegate formatting of compound Bash statements to dedicated classes
- Fix indentation of statements in Smart card advises
- Use the compound statement formatting API for configuring PKINIT
- smart card advises: use a wrapper around Bash `for` loops
- smart card advise: use password when changing trust flags on HTTP cert
- smart-card-advises: ensure that krb5-pkinit is installed on client
- Resolves: #1475238 Use CommonNameToSANDefault in default profile
(new installs only)
- Add CommonNameToSANDefault to default cert profile
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s
during search in cn=ad,cn=trusts,dc=example,dc=com
- NULL LDAP context in call to ldap_search_ext_s during search
- Fixed share/ipa/wsgi.py so .pyc, .pyo files are included
- No need to create /var/log/ipa_error.log since we aren't using
TurboGears any more.
- Update to upstream 2.1.0
- Upstream pre release FreeIPA 4.9.0rc2
Related: RHBZ#1891832
- Synchronize spec file with upstream and Fedora
Related: RHBZ#1891832
- Traceback while doing ipa-backup
Resolves: RHBZ#1901068
- ipa-client-install changes system wide ssh configuration
Resolves: RRBZ#1544379
- ipa-kdb: support subordinate/superior UPN suffixes
Resolves: RHBZ#1891056
- KRA Transport and Storage Certificates do not renew
Resolves: RHBZ#1872603
- Move where the restore state is marked during IPA server upgrade
Resolves: RHBZ#1569011
- Intermittent IdM Client Registration Failures
Resolves: RHBZ#1812871
- Nightly test failure in test_acme.py::TestACME::test_third_party_certs
(updates-testing)
Resolves: RHBZ#1903025
- Add IPA RA Agent to ACME group on the CA
Resolves: RHBZ#1902727
- Resolves: #1356102 Server uninstall does not stop tracking lightweight sub-CA
with certmonger
- uninstall: untrack lightweight CA certs
- Resolves: #1351807 ipa-nis-manage config.get_dn missing
- ipa-nis-manage: Use server API to retrieve plugin status
- Resolves: #1353452 ipa-compat-manage command failed,
exception: NotImplementedError: config.get_dn()
- ipa-compat-manage: use server API to retrieve plugin status
- Resolves: #1353899 ipa-advise: object of type 'type' has no len()
- ipa-advise: correct handling of plugin namespace iteration
- Resolves: #1356134 'kinit -E' does not work for IPA user
- kdb: check for local realm in enterprise principals
- Resolves: #1353072 ipa unknown command vault-add
- Enable vault-* commands on client
- vault-add: set the default vault type on the client side if none was given
- Resolves: #1353995 Default CA can be used without a CA ACL
- caacl: expand plugin documentation
- Resolves: #1356144 host-find should not print SSH keys by default, only
SSH fingerprints
- host-find: do not show SSH key by default
- Resolves: #1353506 ipa migrate-ds command fails for IPA in RHEL 7.3
- Removed unused method parameter from migrate-ds
- Expand the token auth/sync windows (#919228)
- Access is not rejected for disabled domain (#1172598)
- krb5kdc crash in ldap_pvt_search (#1170695)
- RHEL7.1 IPA server httpd avc denials after upgrade (#1164896)
- Ensure that /etc/ipa exists before moving user-modifiable html files there
- Put html files into /etc/ipa/html instead of /etc/ipa
- Replica CA installation: ignore skew during initial replication
Resolves RHEL-80995
- Update to upstream version 1.1.0
- Patch for indexing memberof attribute
- Patch for indexing uidnumber and gidnumber
- Patch to change DNA default values for replicas
- Patch to fix uninitialized variable in ipa-getkeytab
- Fix --external-ca-profile not passed to CSR
Resolves: RHBZ#1731813
- Upgrade: fix replica agreement, fix backported patch
Related: RHBZ#2216551
- Enforce uniqueness across krbprincipalname and krbcanonicalname
ipa-kdb: enforce PAC presence on TGT for TGS-REQ
ipatests: extend test for unique krbcanonicalname
Resolves: RHEL-110061
- Resolve: #1455946 Provide a tooling automating the configuration
of Smart Card authentication on a FreeIPA master
- server certinstall: update KDC master entry
- pkinit manage: introduce ipa-pkinit-manage
- server upgrade: do not enable PKINIT by default
- Extend the advice printing code by some useful abstractions
- Prepare advise plugin for smart card auth configuration
- Resolve: #1461053 allow to modify list of UPNs of a trusted forest
- trust-mod: allow modifying list of UPNs of a trusted forest
- WebUI: add support for changing trust UPN suffixes
- Rebuilt for glibc bug#747377
- Update to upstream freeipa-2.0.0.rc2
- Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
- Set minimum version of sssd to 1.5.1
- Patch to include SuiteSpotGroup when setting up 389-ds instances
- Move a lot of BuildRequires so this will build with ONLY_CLIENT enabled
- Added support for ipa_kpasswd and ipa_pwd_extop
- Rebase to upstream release 4.8.4
- Removed upstream patches 0001 to 0008 that are part of version 4.8.3-3
Resolves: RHBZ#1782658
Resolves: RHBZ#1782169
Resolves: RHBZ#1783046
Related: RHBZ#1748987
- Update to upstream GA release
- Automatically apply updates when the package is upgraded
- Remove ipa_webgui, its functions rolled into ipa_httpd
- kdb: keeep ipadb_get_connection() from succeding with null LDAP context
Resolves: RHEL-58453
- CVE-2019-14867: Denial of service in IPA server due to wrong use of ber_scanf()
Resolves: RHBZ#1767304
- CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
Resolves: RHBZ#1776939
- Removed python-cherrypy from BuildRequires and Requires
- Added Requires python-assets, python-wehjit
- Resolves: #1609883 ipaserver/plugins/cert.py: Add reason to raise of
errors.NotFound
- Resolves: #1615765 do-not-use-RC4-in-FIPS-mode
- Move fips_enabled to a common library to share across different plugins
- ipasam: do not use RC4 in FIPS mode
- Marked with wrong license. IPA is GPLv2.
- Update to upstream 3.2.0 Prerelease 1
- Use upstream reference spec file as a base for Fedora spec file
- Change Requires from fedora-ds-base to 389-ds-base
- Set minimum level of 389-ds-base to 1.2.6 for the replication
version plugin.
- Resolves: #747612 [RFE] IPA should support and manage DNS sites
- Resolves: #826790 Disabling password expiration (--maxlife=0 and --minlife=0)
in the default global_policy in IPA sets user's password expiration
(krbPasswordExpiration) to be 90 days
- Resolves: #896699 ipa-replica-manage -H does not delete DNS SRV records
- Resolves: #1084018 [RFE] Add IdM user password change support for legacy
client compat tree
- Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
aliases)
- Fix incorrect check for principal type when evaluating CA ACLs
- Resolves: #1146860 [RFE] Offer OTP generation for host enrollment in the UI
- Resolves: #1238190 ipasam unable to lookup group in directory yet manual
search works
- Resolves: #1250110 search by users which don't have read rights for all attrs
in search_attributes fails
- Resolves: #1263764 Show Certificate displays in useless format
- Resolves: #1272491 [WebUI] Certificate action dropdown does not display all
the options after adding new certificate
- Resolves: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.4.0
- Resolves: #1294503 IPA fails to issue 3rd party certs
- Resolves: #1298242 [RFE] API compatibility - compatibility of clients
- Resolves: #1298848 [RFE] Centralized topology management
- Resolves: #1298966 [RFE] Extend Smart Card support
- Resolves: #1315146 Multiple clients cannot join domain simultaneously:
/var/run/httpd/ipa/clientcaches race condition?
- Resolves: #1318903 ipa server install failing when SUBCA signs the cert
- Resolves: #1319003 ipa-winsync-migrate: Traceback should be fixed with proper
console output
- Resolves: #1324055 IPA always qualify requests for admin
- Resolves: #1328552 [RFE] Allow users to authenticate with alternative names
- Resolves: #1334582 Inconsistent UI and CLI options for removing certificate
hold
- Resolves: #1346321 Exclude o=ipaca subtree from Retro Changelog (syncrepl)
- Resolves: #1349281 Fix `Conflicts` with ipa-python
- Resolves: #1350695 execution of copy-schema script fails
- Resolves: #1351118 upgrade failed for RHEL-7.3 from RHEL-7.2.z
- Resolves: #1351153 AVC seen on Replica during ipa-server upgrade test
execution to 7.3
- Resolves: #1351276 ipa-server-install with dns cannot resolve itself to
create ipa-ca entry
- Related: #1343422 [RFE] Add GssapiImpersonate option
- Pull upstream changelog 698
- Fix ownership of /var/log/ipa_error.log during install (435119)
- Add pwpolicy command and man page
- Fix requirement for python3-kdcproxy, add no autoreqprov for ipatests sub
package
Related: RHBZ#1891832
- ipa-csreplica-manage connect fails (#1157735)
- error message which is not understandable when IDNA2003 characters are
present in --zonemgr (#1163849)
- Fix warning message should not contain CLI commands (#1114013)
- Renewing the CA signing certificate does not extend its validity period end
(#1163498)
- RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
httpd (#1159330)
- Make sure ipa-server depends on krb5-kdb-version to pick up
right MIT Kerberos KDB ABI
Related: RHBZ#1700121
- User field separator uses '$$' within ipaSELInuxUserMapOrder
Fixes: RHBZ#1729099
- Require the Python interpreter directly instead of using the package name
- Related: rhbz#1619153
- DNS install check: Fix overlapping DNS zone from the master itself
Resolves: RHBZ#1784003
- Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
Trusts
- winsync-migrate: Convert entity names to posix friendly strings
- winsync-migrate: Properly handle collisions in the names of external groups
- Resolves: #1261074 Adjust Firefox configuration to new extension signing
policy
- webui: use manual Firefox configuration for Firefox >= 40
- Resolves: #1263337 IPA Restore failed with installed KRA
- ipa-backup: Add mechanism to store empty directory structure
- Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
and private key in world readable file [rhel-7.2]
- install: fix KRA agent PEM file permissions
- Resolves: #1265086 Mark IdM API Browser as experimental
- WebUI: add API browser is experimental warning
- Resolves: #1265277 Fix kdcproxy user creation
- install: create kdcproxy user during server install
- platform: add option to create home directory when adding user
- install: fix kdcproxy user home directory
- Resolves: #1265559 GSS failure after ipa-restore
- destroy httpd ccache after stopping the service
- Resolves: #1432630 python2-jinja2 needed for python2-ipaclient
- Remove csrgen
- Resolves: #1432903 Set GssProxy options to enable caching of ldap tickets
- Add options to allow ticket caching
- Update to upstream version 1.2.0
- Set fedora-ds-base minimum version to 1.1.3 for winsync header
- Set the minimum version for SELinux policy
- Remove references to Fedora 7
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650139
- Added support for libipa-dna-plugin
- Rebuild to samba 4.17.2.
Related: RHBZ#2132051
- Update to upstream 4.7.0 GA
- ipatests: fix TestOTPToken::test_check_otpd_after_idle_timeout
Related: RHBZ#2053024
- Resolves: #1477703 IPA upgrade fails for latest ipa package
- Restore old version of caIPAserviceCert for upgrade only
- Reinstalling ipa server hangs when configuring certificate
server (#1018804)
- Allow longer dirsrv startup with systemd:
- IPAdmin class will wait until dirsrv instance is available up to 10 seconds
- Helps with restarts during upgrade for ipa-ldap-updater
- Fix pylint warnings from F16 and Rawhide
- selinux don't audit rules deny fetching trust topology
Resolves: RHBZ#1845596
- fix iPAddress cert issuance for >1 host/service
Resolves: RHBZ#1846352
- Specify cert_paths when calling PKIConnection
Resolves: RHBZ#1849155
- Update crypto policy to allow AD-SUPPORT when installing IPA
Resolves: RHBZ#1851139
- Add version to ipa-idoverride-memberof obsoletes
Related: RHBZ#1846434
- Resolves: #1365858 ipa-ca-install fails on replica when IPA Master is
installed without CA
- Set up DS TLS on replica in CA-less topology
- Resolves: #1398600 IPA replica install fails with dirsrv errors.
- Do not configure PKI ajp redirection to use "::1"
- Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
ca-del, ca-disable and ca-enable commands
- ca: correctly authorise ca-del, ca-enable and ca-disable
- Rebuild for Python 2.6
- Allow ipa-tests to work with older version (1.7.7) of python-paramiko
- Resolves: #1477367 ipa-server-upgrade timeouts on wait_for_open ports
expecting IPA services listening on IPv6 ports
- Make sure upgrade also checks for IPv6 stack
- control logging of host_port_open from caller
- log progress of wait_for_open_ports
- Resolves: #1477243 ipa help command returns traceback when no cache
is present
- Store help in Schema before writing to disk
- Disable pylint in get_help function because of type confusion.
- Require samba packages instead of obsoleted samba4 packages
- Fixed License in specfile
- Include files from /usr/lib/python*/site-packages/ipaserver
- Set the N-V-R so rc1 is an update to beta2.
- Resolves: #1452216 Replica installation grants HTTP principal
access in WebUI
- Make sure we check ccaches in all rpcserver paths
- Mass rebuild 2013-12-27
- Drop Requires of python-krbV on ipa-client
- Resolves: #828866 [RFE] enhance --subject option for ipa-server-install
- Resolves: #1160555 ipa-server-install: Cannot handle double hyphen "--" in
hostname
- Resolves: #1286288 Insufficient 'write' privilege to the 'ipaExternalMember'
attribute
- Resolves: #1321652 ipa-server-install fails when using external certificates
that encapsulate RDN components in double quotes
- Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
revocation reasons
- Resolves: #1340880 ipa-server-install: improve prompt on interactive
installation
- Resolves: #1353841 ipa-replica-install fails to install when resolv.conf
incomplete entries
- Resolves: #1356104 cert-show command does not display Subject Alternative
Names
- Resolves: #1357511 Traceback message seen when ipa is provided with invalid
configuration file name
- Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
converted from CA-less to CA-full
- Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
- Resolves: #1367572 improve error message in ipa migrate-ds: mention ipa
config-mod --enable-migration=TRUE
- Resolves: #1367868 Add options to retrieve lightweight CA certificate/chain
- Resolves: #1371927 Implement ca-enable/disable commands.
- Resolves: #1372202 Add Users into User Group editors fails to show Full names
- Resolves: #1373091 Adding an auth indicator from the CLI creates an extra
check box in the UI
- Resolves: #1375596 Ipa-server WebUI - long user/group name show wrong error
message
- Resolves: #1375905 "Normal" group type in the UI is confusing
- Resolves: #1376040 IPA client ipv6 - invalid --ip-address shows traceback
- Resolves: #1376630 IDM admin password gets written to
/root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
- Resolves: #1376729 ipa-server-install script option --no_hbac_allow should
match other options
- Resolves: #1378461 IPA Allows Password Reuse with History value defined when
admin resets the password.
- Resolves: #1379029 conncheck failing intermittently during single step
replica installs
- Resolves: #1379858 [RFE] better debugging for ipa-replica-conncheck
- Resolves: #1384310 ipa dnsrecord-add fails with Keyerror stack trace
- Resolves: #1392778 Update man page for ipa-adtrust-install by
removing --no-msdcs option
- Resolves: #1392858 Rebase to FreeIPA 4.5+
- Rebase to 4.5.0
- Resolves: #1399133 Delete option shouldn't be available for hosts applied to
view.
- Resolves: #1399190 [RFE] Certificates issued by externally signed IdM CA
should contain full trust chain
- Resolves: #1400416 RFE: Provide option to take backup of IPA server before
uninstalling IPA server
- Resolves: #1400529 cert-request is not aware of Kerberos principal aliases
- Resolves: #1401526 IPA WebUI certificates are grayed out on overview page but
not on details page
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- Resolves: #1404750 ipa-client-install fails to get CA cert via LDAP when
non-FQDN name of IPA server is first in /etc/hosts
- Resolves: #1409628 [RFE] Semi-automatic integration with external DNS using
nsupdate
- Resolves: #1413742 Backport request for bug/issue Change IP address
validation errors to warnings
- Resolves: #1415652 IPA replica install log shows password in plain text
- Resolves: #1427897 different behavior regarding system wide certs in master
and replica.
- Resolves: #1430314 The ipa-managed-entries command failed, exception:
AttributeError: ldap2
- Throw zonemgr error message before installation proceeds (#1163849)
- Winsync: Setup is broken due to incorrect import of certificate (#1169867)
- Enable last token deletion when password auth type is configured (#919228)
- ipa-otp-lasttoken loads all user's tokens on every mod/del (#1166641)
- add --hosts and --hostgroup options to allow/retrieve keytab methods
(#1007367)
- Extend host-show to add the view attribute in set of default attributes
(#1168916)
- Prefer TCP connections to UDP in krb5 clients (#919228)
- [WebUI] Not able to unprovisioning service in IPA 4.1 (#1168214)
- webui: increase notification duration (#1171089)
- RHEL7.1 ipa automatic CA cert renewal stuck in submitting state (#1166931)
- RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
(#1170003)
- Improve validation of --instance and --backend options in ipa-restore
(#951581)
- RHEL7.1 ipa replica unable to replicate to rhel6 master (#1167964)
- Disable TLS 1.2 in nss.conf until mod_nss supports it (#1156466)
- Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
error observed during ipa upgrade with latest package.
- ipa-server-install: fix uninstall
- Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
replica
- ca install: merge duplicated code for DM password
- installutils: add DM password validator
- ca, kra install: validate DM password
- Rebase to upstream release 4.8.2
- Removed upstream patches 0001 to 0010 that are part of version 4.8.2
- Updated branding patch
Resolves: RHBZ#1748987
- Update dependency for bind-dndb-ldap to 11.2-2
Related: RHBZ#1762813
- Upstream release FreeIPA 4.9.5
Related: RHBZ#1945038
- IPA to allow setting a new range type
Resolves: RHBZ#1688267
- ipa-server-install displays debug output when --debug output is not
specified.
Resolves: RHBZ#1943151
- ACME fails to generate a cert on migrated RHEL8.4 server
Resolves: RHBZ#1934991
- Switch ipa-client to use the JSON API
Resolves: RHBZ#1937856
- IDM - Allow specifying permanent logging settings for BIND
Resolves: RHBZ#1951511
- Cache LDAP data within a request
Resolves: RHBZ#1953656
- ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4
Resolves: RHBZ#1957768
- Rebuild for broken deps
- Fix 389-ds-base strict dep to be 1.3.0.5 and krb5-server 1.11.1
- Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
- Re-adding existing trust fails (#1033216)
- IPA uninstall exits with a samba error (#1033075)
- Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
- Fixed ownership of /usr/share/ipa/ui/js (#1026260)
- ipa-tests: support external names for hosts (#1032668)
- ipa-client-install fail due fail to obtain host TGT (#1029354)
- Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
by abusing password policy
- ipa-kdb: search for password policies globally
- Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream
- [ipa-python] ipalib.errors.LDAPError: failed to decode certificate:
(SEC_ERROR_INVALID_ARGS) security library: invalid arguments. (#1194312)
- Set krb5 DAL version to 7.0 (#1580711)
- Rebuild aclocal and configure during build
- hbactest does not work for external users (#848531)
- Resolves: #1443869 Command "openssl pkcs12 ..." failed during IPA upgrade
- Fix CAInstance.import_ra_cert for empty passwords
- New upstream release 4.8.0
- New subpackage: freeipa-client-samba
- Added command ipa-cert-fix with man page
- New sysconfdir sysconfig/certmonger
- Updated pki_version, certmonger_version, sssd_version and kdcproxy_version
Related: RHBZ#1684528
- Update to upstream 2.2.0 beta 1 (2.1.90.rc1)
- Set minimum n-v-r for pki-ca and pki-silent to 9.0.18.
- Add Conflicts on mod_ssl
- Update minimum n-v-r of 389-ds-base to 1.2.10.4
- Update minimum n-v-r of sssd to 1.8.0
- Update minimum n-v-r of slapi-nis to 0.38
- Update minimum n-v-r of pki-* to 9.0.18
- Update conflicts on bind-dyndb-ldap to < 1.1.0-0.9.b1
- Update conflicts on bind to < 9.9.0-1
- Drop requires on krb5-server-ldap
- Add patch to remove escaping arguments to pkisilent
- Re-add accidentally removed patches for #1170695 and #1164896
- Fix wrong path in packaging freeipa-systemd-upgrade
- Create systemd-user HBAC service and rule
Resolves: RHBZ#1664974
- ipaserver/dcerpc: fix exclusion entry with a forest trust domain info returned
Resolves: RHBZ#1664023
- trustdomain-find with pkey-only fails (#1068611)
- Invalid credential cache in trust-add (#1069182)
- ipa-replica-install prints unexpected error (#1069722)
- Too big font in input fields in details facet in Firefox (#1069720)
- trust-add for POSIX AD does not fetch trustdomains (#1070925)
- Misleading trust-add error message in some cases (#1070926)
- Access is not rejected for disabled domain (#1070924)
- Set minimum level of sssd to 1.1.1 to pull in required hbac fixes.
- Add OTP patches
- Add patch to set KRB5CCNAME for 389-ds-base
- Resolves: #1431520 ipa cert-find runs a large number of searches, so IPA
WebUI is slow to display user details page
- cert: defer cert-find result post-processing
- Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
helper when installing replica
- server-install: No double Kerberos install
- Resolves: #1437502 ipa-replica-install fails with requirement to
use --force-join that is a client install option.
- Add the force-join option to replica install
- replicainstall: better client install exception handling
- Resolves: #1437953 Server CA-less impossible option check
- server-install: remove broken no-pkinit check
- Resolves: #1441160 FreeIPA client <= 4.4 fail to parse 4.5 cookies
- Add debug log in case cookie retrieval went wrong
- Resolves: #1441548 ipa server install fails with --external-ca option
- ext. CA: correctly write the cert chain
- Resolves: #1441718 Conversion of CA-less server to CA fails on CA instance
spawn
- Fix CA-less to CA-full upgrade
- Resolves: #1442133 Do not link libkrad, liblber, libldap_r and
libsss_nss_idmap to every binary in IPA
- configure: fix AC_CHECK_LIB usage
- Resolves: #1442815 Replica install fails during migration from older IPA
master
- Fix RA cert import during DL0 replication
- Related: #1442004 Building IdM/FreeIPA internally on all architectures -
filtering unsupported packages
- Build all subpackages on all architectures
- Hardening for CVE-2020-25717
- Harden processing of trusted domains' users in S4U operations
- Resolves: RHBZ#2021443
- Updated to upstream 2.2.0 GA
- Update minimum n-v-r of certmonger to 0.53
- Update minimum n-v-r of slapi-nis to 0.40
- Add Requires in client to oddjob-mkhomedir and python-krbV
- Update minimum selinux-policy to 3.10.0-110
- 4.7.1
- Fixes: rhbz#1633105 - rebase to 4.7.1
- Fix otptoken_sync plugin
Resolves: RHBZ#1777811
- Fix automount behavior with authselect
Resolves: RHBZ#1740167
- Require mod_nss-1.0.7-2 for mod_proxy fixes
- Pull upstream changelog 678
- Add new subpackage, ipa-server-selinux
- Add Requires: authconfig to ipa-python (bz #433747)
- Package i18n files
- Fix breakage caused by python-kerberos update to 1.1
- Fix Requires for krb5-server that was missing for Fedora versions > 9
- Remove quotes around test for fedora version to package egg-info
- Load ipa_dogtag.pp in post install
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- user-undel: Fix error messages.
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Prohibit deletion of predefined profiles
- Resolves: #1232819 testing ipa-restore on fresh system install fails
- Backup/resore authentication control configuration
- Resolves: #1243331 pkispawn fails when migrating to 4.2 server from 3.0
server
- Require Dogtag PKI >= 10.2.6
- Resolves: #1245225 Asymmetric vault drops traceback when the key is not
proper
- Asymmetric vault: validate public key in client
- Resolves: #1248399 Missing DNSSEC related files in backup
- fix typo in BasePathNamespace member pointing to ods exporter config
- ipa-backup: archive DNSSEC zone file and kasp.db
- Resolves: #1248405 PassSync should be disabled after ipa-winsync-migrate is
finished
- winsync-migrate: Add warning about passsync
- winsync-migrate: Expand the man page
- Resolves: #1248524 User can't find any hosts using "ipa host-find $HOSTNAME"
- adjust search so that it works for non-admin users
- Resolves: #1250093 ipa certprofile-import accepts invalid config
- Require Dogtag PKI >= 10.2.6
- Resolves: #1250107 IPA framework should not allow modifying trust on AD trust
agents
- trusts: Detect missing Samba instance
- Resolves: #1250111 User lifecycle - preserved users can be assigned
membership
- ULC: Prevent preserved users from being assigned membership
- Resolves: #1250145 Add permission for user to bypass caacl enforcement
- Add permission for bypassing CA ACL enforcement
- Resolves: #1250190 idrange is not added for sub domain
- idranges: raise an error when local IPA ID range is being modified
- trusts: harden trust-fetch-domains oddjobd-based script
- Resolves: #1250928 Man page for ipa-server-install is out of sync
- install: Fix server and replica install options
- Resolves: #1251225 IPA default CAACL does not allow cert-request for services
after upgrade
- Fix default CA ACL added during upgrade
- Resolves: #1251561 ipa vault-add Unknown option: ipavaultpublickey
- validate mutually exclusive options in vault-add
- Resolves: #1251579 ipa vault-add --user should set container owner equal to
user on first run
- Fixed vault container ownership.
- Resolves: #1252517 cert-request rejects request with correct
krb5PrincipalName SAN
- Fix KRB5PrincipalName / UPN SAN comparison
- Resolves: #1252555 ipa vault-find doesn't work for services
- vault: Add container information to vault command results
- Add flag to list all service and user vaults
- Resolves: #1252556 Missing CLI param and ACL for vault service operations
- Added CLI param and ACL for vault service operations.
- Resolves: #1252557 certprofile: improve profile format documentation
- certprofile-import: improve profile format documentation
- certprofile: add profile format explanation
- Resolves: #1253443 ipa vault-add creates vault with invalid type
- vault: validate vault type
- Resolves: #1253480 ipa vault-add-owner does not fail when adding an existing
owner
- baseldap: Allow overriding member param label in LDAPModMember
- vault: Fix param labels in output of vault owner commands
- Resolves: #1253511 ipa vault-find does not use criteria
- vault: Fix vault-find with criteria
- Resolves: #1254038 ipa-replica-install pk12util error returns exit status 10
- install: Fix replica install with custom certificates
- Resolves: #1254262 ipa-dnskeysync-replica crash cannot contact kdc
- improve the handling of krb5-related errors in dnssec daemons
- Resolves: #1254412 when dirsrv is off ,upgrade from 7.1 to 7.2 fails with
starting CA and named-pkcs11.service
- Server Upgrade: Start DS before CA is started.
- Resolves: #1254637 Add ACI and permission for managing user userCertificate
attribute
- add permission: System: Manage User Certificates
- Resolves: #1254641 Remove CSR allowed-extensions restriction
- cert-request: remove allowed extensions check
- Resolves: #1254693 vault --service does not normalize service principal
- vault: normalize service principal in service vault operations
- Resolves: #1254785 ipa-client-install does not properly handle dual stacked
hosts
- client: Add support for multiple IP addresses during installation.
- Add dependency to SSSD 1.13.1
- client: Add description of --ip-address and --all-ip-addresses to man page
- Remove dependency on python-paramiko (#1002884)
- Broken redirection when deleting last entry of DNS resource
record (#1006360)
- "an internal error has occurred" during ipa host-del --updatedns (#1198431)
- Renamed patch 1013 to 0114, as it was merged upstream
- Fax number not displayed for user-show when kinit'ed as normal user.
(#1198430)
- Replication agreement with replica not disabled when ipa-restore done without
IPA installed (#1199060)
- Limit deadlocks between DS plugin DNA and slapi-nis (#1199128)
- Build radius separately
- Fix a few minor issues
- Broke invididual Requires and BuildRequires onto separate lines and
reordered them
- Added python-tgexpandingformwidget as a dependency
- Require at least fedora-ds-base 1.1
- Server install failure during client enrollment shouldn't
roll back (#1023086)
- nsds5ReplicaStripAttrs are not set on agreements (#1023085)
- ipa-server conflicts with mod_ssl (#1018172)
- Update to upstream 3.3.2 (#991064)
- Add delegation info to MS-PAC (#915799)
- Warn about incompatibility with AD when IPA realm and domain
differs (#1009044)
- Allow PKCS#12 files with empty password in install tools (#1002639)
- Privilege "SELinux User Map Administrators" did not list
permissions (#997085)
- SSH key upload broken when client joins an older server (#1009024)
- Set minimum pki-ca and pki-silent versions to 9.0.0
- Set krbCanonicalName admin@REALM on the admin user
Resolves: RHEL-89895
- Rebuild against samba4 beta4
- Resolves: #1361119 UPN-based search for AD users does not match an entry in
slapi-nis map cache
- support multiple uid values in schema compatibility tree
- Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
version to 1.0.7-4 so we pick up the NSS fixes.
- Add selinux-policy-base(post) to Requires (446496)
- Resolves: #1296140 Remove redhat-access-plugin-ipa support
- Obsolete and conflict redhat-access-plugin-ipa
- Resolves: #1351119 Multiple issues while uninstalling ipa-server
- server uninstall fails to remove krb principals
- Resolves: #1351758 ipa commands not showing expected error messages
- frontend: copy command arguments to output params on client
- Show full error message for selinuxusermap-add-hostgroup
- Resolves: #1352883 Traceback on adding default automember group and hostgroup
set
- allow 'value' output param in commands without primary key
- Resolves: #1353888 Fix the help for ipa otp and other topics
- schema: Fix subtopic -> topic mapping
- Resolves: #1354348 ipa trustconfig-show throws internal error.
- allow 'value' output param in commands without primary key
- Resolves: #1354381 ipa trust-add with raw option gives internal error.
- trust-add: handle `--all/--raw` options properly
- Resolves: #1354493 Replica install fails with old IPA master
- DNS install: Ensure that DNS servers container exists
- Resolves: #1354628 ipa hostgroup-add-member does not return error message
when adding itself as member
- frontend: copy command arguments to output params on client
- Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
- messages: specify message type for ResultFormattingError
- Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
secret key
- expose `--secret` option in radiusproxy-* commands
- prevent search for RADIUS proxy servers by secret
- Resolves: #1356099 Bug in the ipapwd plugin
- Heap corruption in ipapwd plugin
- Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
client changes
- Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
- Resolves: #1356964 Renaming a user removes all of his principal aliases
- Preserve user principal aliases during rename operation
- Require slapi-nis 0.47.7 delivering a core feature of 3.3.0 release
- ipa man page format the EXAMPLES section
Resolves: RHBZ#2129895
- Fix canonicalization issue in Web UI
Resolves: RHBZ#2127035
- Remove idnssoaserial argument from dns zone API.
Resolves: RHBZ#2108630
- Warn for permissions with read/write/search/compare and no attrs
Resolves: RHBZ#2098187
- Add PKINIT support to ipa-client-install
Resolves: RHBZ#2075452
- Generate CNAMEs for TXT+URI location krb records
Resolves: RHBZ#2104185
- Vault: fix interoperability issues with older RHEL systems
Resolves: RHBZ#2144737
- Fix typo on ipaupgrade.log chmod during RPM %post snipppet
Resolves: RHBZ#2140994
- Set minimum of python-pyasn1 to 0.0.9a so we have support for the ASN.1
Any type
- Remove ipa-server dependency from ipa-selinux subpackage
- Related: RHBZ#1891832
- clean up spec
- Depend on sssd >= 1.6.2 for better user experience
- webui: Do not allow empty pagination size
Resolves: RHBZ#2094672
- [WebUI] IPA Error 3007: RequirmentError" while adding members in
"User ID overrides" tab
Resolves: RHBZ#1757045
- EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in
freeipa-client-epn
Resolves: RHBZ#1847999
- FreeIPA - Utilize 256-bit AJP connector passwords
Resolves: RHBZ#1849914
- ipa: typo issue in ipanthomedirectoryrive deffinition
Resolves: RHBZ#1851411
- FreeIPA 4.8.0 tarball lacks two update files that are in git
Resolves: RHBZ#1741170
- Proxy PKI URI /ca/ee/ca/profileSubmit to enable replication with future
PKI versions (#1080865)
- kdb: apply combinatorial logic for ticket flags (CVE-2024-3183)
Resolves: RHEL-29927
- kdb: fix vulnerability in GCD rules handling (CVE-2024-2698)
Resolves: RHEL-29692
- Drop workaround for building on AArch64 (#1482244)
- Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)
- schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
build fails (#1167196)
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
- "ipa trust-add ... " cmd says : (Trust status: Established and verified)
while in the logs we see "WERR_ACCESS_DENIED" during verification step.
(#1144121)
- POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
(#1156466)
- Add support/hooks for a one-time password system like SecureID in IPA
(#919228)
- Tracebacks with latest build for --zonemgr cli option (#1167270)
- ID Views: Support migration from the sync solution to the trust solution
(#891984)
- Remove posixAccount from service_find search filter
Resolves: RHBZ#1731437
- Fix repeated uninstallation of ipa-client-samba crashes
Resolves: RHBZ#1732529
- WebUI: Add PKINIT status field to 'Configuration' page
Resolves: RHBZ#1518153
- Resolve user/group names in idoverride*-find
Resolves: RHBZ#1657745
- Configure CA replication to use TLS instead of SSL
- New command automember-find-orphans to find and remove orphan automemeber
rules has been added
Resolves: RHBZ#1638373
- Moved ipa/idm logos and background to redhat-logos-ipa-80.4:
header-logo.png, login-screen-background.jpg, login-screen-logo.png,
product-name.png
New requirement to redhat-logos-ipa >= 80.4 in ipa-server-common
Resolves: RHBZ#1626507
- Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
users in IdM
- store certificates issued for user entries as
- user-show: add --out option to save certificates to file
- Resolves: #1145748 [RFE] IPA running with One Way Trust
- Fix upgrade of sidgen and extdom plugins
- Resolves: #1195339 ipa-client-install changes the label on various files
which causes SELinux denials
- Use 'mv -Z' in specfile to restore SELinux context
- Resolves: #1198796 Text in UI should describe differing LDAP vs Krb behavior
for combinations of "User authentication types"
- webui: add LDAP vs Kerberos behavior description to user auth
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- ULC: Fix stageused-add --from-delete command
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- certprofile-import: do not require profileId in profile data
- Give more info on virtual command access denial
- Allow SAN extension for cert-request self-service
- Add profile for DNP3 / IEC 62351-8 certificates
- Work around python-nss bug on unrecognised OIDs
- Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
- Validate vault's file parameters
- Fixed missing KRA agent cert on replica.
- Resolves: #1225866 display browser config options that apply to the browser.
- webui: add Kerberos configuration instructions for Chrome
- Remove ico files from Makefile
- Resolves: #1246342 Unapply idview raises internal error
- idviews: Check for the Default Trust View only if applying the view
- Resolves: #1248102 [webui] regression - incorrect/no failed auth messages
- webui: fix regressions failed auth messages
- Resolves: #1248396 Internal error in DomainValidator.__search_in_dc
- dcerpc: Fix UnboundLocalError for ccache_name
- Resolves: #1249455 ipa trust-add failed CIFS server configuration does not
allow access to \\pipe\lsarpc
- Fix selector of protocol for LSA RPC binding string
- dcerpc: Simplify generation of LSA-RPC binding strings
- Resolves: #1250192 Error in ipa trust-fecth-domains
- Fix incorrect type comparison in trust-fetch-domains
- Resolves: #1251553 Winsync setup fails with unexpected error
- replication: Fix incorrect exception invocation
- Resolves: #1251854 ipa aci plugin is not parsing aci's correctly.
- ACI plugin: correctly parse bind rules enclosed in
- Resolves: #1252414 Trust agent install does not detect available replicas to
add to master
- adtrust-install: Correctly determine 4.2 FreeIPA servers
- Introduce upgrade script to recover existing configuration after systemd migration
as user has no means to recover FreeIPA from systemd migration
- Upgrade script:
- recovers symlinks in Dogtag instance install
- recovers systemd configuration for FreeIPA's directory server instances
- recovers freeipa.service
- migrates directory server and KDC configs to use proper keytabs for systemd services
- Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
- Remove references to admin server in ipa-server-setupssl
- Generate a client certificate for the XML-RPC server to connect to LDAP with
- Create a keytab for Apache
- Create an ldif with a test user
- Provide a certmap.conf for doing SSL client authentication
- Update to 4.7.90-pre1
Related: RHBZ#1684528
- Removed patches 0002 to 0031 as these are upsteram and part of 4.7.90-pre1
- Added new patches 0001-revert-minssf-defaults.patch and
0001-Correct-default-fontawesome-path-broken-by-da2cf1c5.patch
- Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
- Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
- Resolves: #1341249 Subsequent external CA installation fails
- install: fix external CA cert validation
- Resolves: #1353831 ipa-server-install fails in container because of
hostnamectl set-hostname
- server-install: Fix --hostname option to always override api.env values
- install: Call hostnamectl set-hostname only if --hostname option is used
- Resolves: #1356091 ipa-cacert-manage --help and man differ
- Improvements for the ipa-cacert-manage man and help
- Resolves: #1360631 ipa-backup is not keeping the
/etc/tmpfiles.d/dirsrv-.conf
- ipa-backup: backup /etc/tmpfiles.d/dirsrv-.conf
- Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
file is needed
- Update ipa-replica-install documentation
- Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
not rpm-require it
- client: RPM require initscripts to get *-domainname.service
- Resolves: #1364197 caacl: error when instantiating rules with service
principals
- caacl: fix regression in rule instantiation
- Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
- parameters: move the `confirm` kwarg to Param
- Resolves: #1364464 Topology graph: ca and domain adders shows question marks
instead of plus icon
- Fix unicode characters in ca and domain adders
- Resolves: #1365083 Incomplete output returned for command ipa vault-add
- client: add missing output params to client-side commands
- Resolves: #1365526 build fails during "make check"
- ipa-kdb: Fix unit test after packaging changes in krb5
- Rebase to security release 4.8.3 (CVE-2019-14867, CVE-2019-10195)
Resolves: RHBZ#1767304
Resolves: RHBZ#1776939
- Support KDC ticket policies for authentication indicators
Resolves: RHBZ#1777564
- Fix misleading errors during client install rollback
Resolves: RHBZ#1658283
- ipa-advise: update url of cacerdir_rehash tool
Resolves: RHBZ#1658287
- Handle NTP configuration in a replica server installation
Resolves: RHBZ#1651679
- Fix defects found by static analysis
Resolves: RHBZ#1658182
- ipa-replica-install --setup-adtrust: check for package ipa-server-trust-ad
Resolves: RHBZ#1658294
- ipaldap: invalid modlist when attribute encoding can vary
Resolves: RHBZ#1658302
- Allow ipaapi and Apache user to access SSSD IFP
Resolves: RHBZ#1639910
- Add sysadm_r to default SELinux user map order
Resolves: RHBZ#1658303
- certdb: ensure non-empty Subject Key Identifier and validate server cert sig
Resolves: RHBZ#1641988
- ipa-replica-install: password and admin-password options mutually exclusive
Resolves: RHBZ#1658309
- ipa upgrade: handle double-encoded certificates
Resolves: RHBZ#1658310
- PKINIT: fix ipa-pkinit-manage enable|disable
Resolves: RHBZ#1658313
- Enable LDAP debug output in client to display TLS errors in join
Resolves: RHBZ#1658316
- rpc: always read response
Resolves: RHBZ#1639890
- ipa vault-retrieve: fix internal error
Resolves: RHBZ#1658485
- Move ipa's systemd tmpfiles from /var/run to /run
Resolves: RHBZ#1658487
- Fix authselect invocations to work with 1.0.2
Resolves: RHBZ#1654291
- ipa-client-automount and NFS unit name changes
Resolves: RHBZ#1645501
- Fix compile issue with new 389-ds
Resolves: RHBZ#1659448
- ipatests: fix test_topology
Resolves: RHBZ#2232351
- Installer: activate nss and pam services in sssd.conf
Resolves: RHBZ#2216532
- Update to upstream 4.1.0 (#1109726)
- Re-enable otptoken_yubikey plugin
- Convert to autotools-based build
- Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
because of missing dependencies
- Rebuild with krb5-1.14.1
- Update to upstream 3.3.0 (#991064)
- Set 0.14 as minimum version for slapi-nis
- ipa-client-automount fails with incompatibility error when installed against
older IPA server (#1083108)
- Server installation fails using external signed certificates with
"IndexError: list index out of range" (#1111320)
- Add rhino to BuildRequires to fix Web UI build error
- Abstracted client class to work directly or over RPC
- Fix S4U2Self regression for cross-realm requester SID buffer
- Related: RHBZ#2021443
- Add dep for freeipa-admintools and acl
- Add Requires: python-nss to ipa-python sub-package
- Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
- python2-ipalib: add missing python dependency
- installer service: fix typo in service entry
- upgrade: add missing suffix to http instance
- Resolves: #1444791 Update man page of ipa-kra-install
- ipa-kra-install manpage: document domain-level 1
- Resolves: #1441493 ipa cert-show raises stack traces when
--certificate-out=/tmp
- cert-show: writable files does not mean dirs
- Resolves: #1441192 Add the name of URL parameter which will be check for
username during cert login
- Bump version of ipa.conf file
- Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
- Turn on NSSOCSP check in mod_nss conf
- Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
template on
- renew agent: respect CA renewal master setting
- server upgrade: always fix certmonger tracking request
- cainstance: use correct profile for lightweight CA certificates
- renew agent: allow reusing existing certs
- renew agent: always export CSR on IPA CA certificate renewal
- renew agent: get rid of virtual profiles
- ipa-cacert-manage: add --external-ca-type
- Resolves: #1441593 error adding authenticator indicators to host
- Fixing adding authenticator indicators to host
- Resolves: #1449525 Set directory ownership in spec file
- Added plugins directory to ipaclient subpackages
- ipaclient: fix missing RPM ownership
- Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
- otptoken-add-yubikey: When --digits not provided use default value
- Upstream release FreeIPA 4.9.2
Related: RHBZ#1891832
- Rebuild for broken deps in rawhide
- Fix 389-ds-base strict dep to be 1.3.0.3
- Move ipa-tests package to separate srpm (#1032668)
- Don't always override the port in import_included_profiles
Fixes: RHBZ#2022483
- Remove ipa-join errors from behind the debug option
Fixes: RHBZ#2048558
- Enable the ccache sweep timer during installation
Fixes: RHBZ#2051575
- ipa-replica-install never checks for 7389 port (#1075165)
- Non-terminated string may be passed to LDAP search (#1075091)
- ipa-sam may fail to translate group SID into GID (#1073829)
- Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
- Update to upstream version 1.0.0
- rpcserver: validate Kerberos principal name before running kinit
Resolves: RHEL-26153
- Vault: add additional fallback to RSA-OAEP wrapping algo
Resolves: RHEL-28259
- Set min version of 389-ds-base to 1.2.8
- Set min version of mod_nss 1.0.8-10
- Set min version of selinux-policy to 3.9.7-27
- Add dogtag themes to Requires
- Update to upstream freeipa-2.0.0.pre2
- Resolves: #1339483 ipa-server-install fails with ERROR pkinit_cert_files
- Fix incorrect rebase of patch 1001
- Fixed weekday in 4.8.4-2 changelog date
Related: RHBZ#1784003
- adtrust: print DNS records for external DNS case after role is enabled
Resolves: RHBZ#1665051
- AD user without override receive InternalServerError with API
Resolves: RHBZ#1782572
- ipa-client-automount fails after repeated installation/uninstallation
Resolves: RHBZ#1790886
- install/updates: move external members past schema compat update
Resolves: RHBZ#1803165
- kdb: make sure audit_as_req callback signature change is preserved
Resolves: RHBZ#1803786
- Resolves: #1449189 ipa-kra-install timeouts on replica
- kra: promote: Get ticket before calling custodia
- Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
- Fix ipa-server-install in pure IPv6 environment
- Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
reachable via the forest root
- trust: make sure ID range is created for the child domain even if it exists
- ipa-kdb: simplify trusted domain parent search
- Resolves: #1335567 Update Warning in IdM Web UI API browser
- WebUI: add API browser is tech preview warning
- Resolves: #1348560 Mulitple domain Active Directory Trust conflict
- ipaserver/dcerpc: reformat to make the code closer to pep8
- trust: automatically resolve DNS trust conflicts for triangle trusts
- Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
certificate revocation
- cert-revoke: fix permission check bypass (CVE-2016-5404)
- Resolves: #1353936 custodia.conf and server.keys file is world-readable.
- Remove Custodia server keys from LDAP
- Secure permissions of Custodia server.keys
- Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
converted from CA-less to CA-full
- custodia: include known CA certs in the PKCS#12 file for Dogtag
- custodia: force reconnect before retrieving CA certs from LDAP
- Resolves: #1362333 ipa vault container owner cannot add vault
- Fix: container owner should be able to add vault
- Resolves: #1365546 External trust with root domain is transitive
- trust: make sure external trust topology is correctly rendered
- Resolves: #1365572 IPA server broken after upgrade
- Require pki-core-10.3.3-7
- Resolves: #1367864 Server assumes latest version of command instead of
version 1 for old / 3rd party clients
- rpcserver: assume version 1 for unversioned command calls
- rpcserver: fix crash in XML-RPC system commands
- Resolves: #1367773 thin client ignores locale change
- schema cache: Fallback to 'en_us' when locale is not available
- Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
- Fail on topology disconnect/last role removal
- Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
- otptoken, permission: Convert custom type parameters on server
- Resolves: #1369414 ipa server-del fails with Python stack trace
- Handled empty hostname in server-del command
- Resolves: #1369761 ipa-server must depend on a version of httpd that support
mod_proxy with UDS
- Require httpd 2.4.6-31 with mod_proxy Unix socket support
- Resolves: #1370512 Received ACIError instead of DuplicatedError in
stageuser_tests
- Raise DuplicatedEnrty error when user exists in delete_container
- Resolves: #1371479 cert-find --all does not show information about revocation
- cert: add missing param values to cert-find output
- Renamed patch 1011 to 0100, as it was merged upstream
- Add BuildRequires for authconfig
- Add explicit dependency for libvert-libev
Resolves: RHBZ#2104929
- ipatests: Backport test fixes in python3-ipatests.
Resolves: RHBZ#2057505
- Rely on sssd-krb5 to include SSSD-generated krb5 configuration
Resolves: RHBZ#2214563
- Refactor ipatests for unique krbcanonicalname
Resolves: RHEL-110061
- Move ipalib to ipa-python subpackage
- Bump minimum version of slapi-nis to 0.15
- Remove client-epn left over files for ONLY_CLIENT
Related: RHBZ#1847999
- Resolves: #1252556 Missing CLI param and ACL for vault service operations
- vault: fix private service vault creation
- Update to upstream 2.1.4 (CVE-2011-3636)
- Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
by abusing password policy
- password policy: Add explicit default password policy for hosts and
services
- Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
certprofile-mod
- certprofile-mod: correctly authorise config update
- Update to upstream 4.1.0 Alpha 1 (#1109726)
- PKI service restart after CA renewal failed (#1040018)
- Preverse mode on ipa-keytab-util
- Version bump for relase and rpm name change
- Resolves: #1318186 Misleading error message during external-ca IPA master
install
- httpinstance: make sure NSS database is backed up
- Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
CA certificate chain in ... incomplete"
- httpinstance: make sure NSS database is backed up
- Resolves: #1393726 Enumerate all available request type options in ipa
cert-request help
- Hide request_type doc string in cert-request help
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- spec file: bump libsss_nss_idmap-devel BuildRequires
- server: make sure we test for sss_nss_getlistbycert
- Resolves: #1437378 ipa-adtrust-install produced an error and failed on
starting smb when hostname is not FQDN
- adtrust: make sure that runtime hostname result is consistent with the
configuration
- Resolves: #1437555 ipa-replica-install with DL0 fails to get annonymous
keytab
- Always check and create anonymous principal during KDC install
- Remove duplicate functionality in upgrade
- Resolves: #1437946 Upgrade to FreeIPA 4.5.0 does not configure anonymous
principal for PKINIT
- Upgrade: configure PKINIT after adding anonymous principal
- Remove unused variable from failed anonymous PKINIT handling
- Split out anonymous PKINIT test to a separate method
- Ensure KDC is propery configured after upgrade
- Resolves: #1437951 Remove pkinit-related options from server/replica-install
on DL0
- Fix the order of cert-files check
- Don't allow setting pkinit-related options on DL0
- replica-prepare man: remove pkinit option refs
- Remove redundant option check for cert files
- Resolves: #1438490 CA-less installation fails on publishing CA certificate
- Get correct CA cert nickname in CA-less
- Remove publish_ca_cert() method from NSSDatabase
- Resolves: #1438838 Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
- IPA-KDB: use relative path in ipa-certmap config snippet
- Resolves: #1439038 Allow erasing ipaDomainResolutionOrder attribute
- Allow erasing ipaDomainResolutionOrder attribute
- Upstream release FreeIPA 4.8.6
- New SELinux sub package to provide own module
- Depend on selinux-policy-devel 3.14.3-43 for build due to a makefile issue in
SELinux external policy support
Related: RHBZ#1818765
- CAless installation: set the perms on KDC cert file
Resolves: RHBZ#1863616
- EPN: handle empty attributes
Resolves: RHBZ#1866938
- IPA-EPN: enhance input validation
Resolves: RHBZ#1866291
- EPN: enhance input validation
Resolves: RHBZ#1863079
- Require new samba build 4.12.3-52
Related: RHBZ#1868558
- Require new selinux-policy build 3.14.3-52
Related: RHBZ#1869311
- Resolves: #1398670 Check IdM Topology for broken record caused by replication
conflict before upgrading it
- Check for conflict entries before raising domain level
- package the sessions dir /var/cache/ipa/sessions
- Pull upstream changelog 597
- Add call to /usr/sbin/upgradeconfig to post install
- Resolves: #1262996 ipa vault internal error on replica without KRA
- upgrade: make sure ldap2 is connected in export_kra_agent_pem
- Resolves: #1270608 IPA upgrade fails for server with CA cert signed by
external CA
- schema: do not derive ipaVaultPublicKey from ipaPublicKey
- dcerpc: invalidate forest trust intfo cache when filtering out realm domains
Resolves: RHEL-28559
- Backport latests test fixes in python3-tests
ipatests: add xfail for autoprivate group test with override
ipatests: remove xfail thanks to sssd 2.9.4
ipatests: adapt for new automembership fixup behavior
ipatests: Fixes for test_ipahealthcheck_ipansschainvalidation testcases
test_xmlrpc: adopt to automember plugin message changes in 389-ds
Resolves: RHEL-29908
- Config plugin: return EmptyModlist when no change is applied.
Resolves: RHBZ#2031825
- Custodia: use a stronger encryption algo when exporting keys.
Resolves: RHBZ#2032806
- ipa-kdb: do not remove keys for hardened auth-enabled users.
Resolves: RHBZ#2033342
- ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus
Resolves: RHBZ#2049167
- Backport latest test fxes in python3 ipatests.
Resolves: RHBZ#2048509
- Removed unused patch files that were part of 4.9.8 rebase.
- Upstream final release FreeIPA 4.9.0
Related: RHBZ#1891832
- Add end to end integration tests for external IdP
Resolves: RHBZ#2106346
- Upstream release FreeIPA 4.9.8
Related: RHBZ#2015607
- Hardening for CVE-2020-25717
- Resolves: #1419735 ipa-replica-install fails promotecustodia.create_replica
with cert errors (untrusted)
- added ssl verification using IPA trust anchor
- Resolves: #1428472 batch param compatibility is incorrect
- compat: fix `Any` params in `batch` and `dnsrecord`
- Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream
- rebuild with new openssl
- Rebase ipa to 4.9.13
Resolves: RHEL-16936
- Remove the IPA DNA plugin, use the DS one
- Drop requires on python-configobj (not used any more)
- Drop ipa-ldap-updater message, upgrades are done differently now
- Update minimum selinux-policy to 3.9.16-18
- Update minimum pki-ca and pki-selinux to 9.0.7
- Update minimum 389-ds-base to 1.2.8.0-1
- Update to upstream 2.0.1
- Remove radius subpackages
- Pull upstream changelog 641
- Require minimum version of krb5-server on F-7 and F-8
- Package some new files
- Add ipa init script
- Update to upstream 4.0.3 (#1109726)
- Update Requires on selinux-policy to 3.13.1-4
- Add missing part of backported CVE-2024-3183 fix
Resolves: RHEL-29927
- Drop BuildRequires on mozldap-devel
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
- Updated upstream pull (596) to fix bug in ipa_webgui that was causing the
UI to not start.
- Remove duplicate %files entries on share/ipa/static
- Add python default encoding shared library
- Winsync agreement cannot be created (#1023085)
- Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
aliases)
- harden the check for trust namespace overlap in new principals
- Resolves: #1351142 CLI is not using session cookies for communication with
IPA API
- Fix session cookies
- Resolves: #1353888 Fix the help for ipa otp and other topics
- help: Add dnsserver commands to help topic 'dns'
- Resolves: #1354406 host-del updatedns options complains about missing ptr
record for host
- Host-del: fix behavior of --updatedns and PTR records
- Resolves: #1355718 ipa-replica-manage man page example output differs actual
command output
- Minor fix in ipa-replica-manage MAN page
- Resolves: #1358229 Traceback message should be fixed, seen while editing
winsync migrated user information in Default trust view.
- baseldap: Fix MidairCollision instantiation during entry modification
- Resolves: #1358849 CA replica install logs to wrong log file
- unite log file name of ipa-ca-install
- Resolves: #1359130 ipa-server-install command fails to install IPA server.
- DNS Locations: fix update-system-records unpacking error
- Resolves: #1359237 AVC on dirsrv config caused by IPA installer
- Use copy when replacing files to keep SELinux context
- Resolves: #1359692 ipa-client-install join fail with traceback against
RHEL-6.8 ipa-server
- compat: fix ping call
- Resolves: #1359738 ipa-replica-install --domain= option
does not work
- replica-install: Fix --domain
- Resolves: #1360778 Vault commands are available in CLI even when the server
does not support them
- Revert "Enable vault-* commands on client"
- client: fix hiding of commands which lack server support
- Related: #1281704 Rebase to softhsm 2.1.0
- Remove the workaround for softhsm bug #1293340
- Related: #1298288 [RFE] Improve performance in large environments.
- Create indexes for krbCanonicalName attribute
- Use OpenJDK 8 to bootstrap on AArch64 until RH1482244 is resolved in
buildroot
- Resolves: #1470177 - Rebase IPA to latest 4.5.x version
- Resolves: #1398594 ipa topologysuffix-verify should only warn about
maximum number of replication agreements.
- Resolves: #1404236 Web UI: Change "Host Based" and "Role Based"
to "Host-Based" and "Role-Based"
- Resolves: #1409786 Second phase of --external-ca ipa-server-install
setup fails when dirsrv is not running
- Resolves: #1451576 ipa cert-request failed to generate certificate from csr
- Resolves: #1452086 Pagination Size under Customization in IPA WebUI
accepts negative values
- Resolves: #1458169 --force-join option is not mentioned in
ipa-replica-install man page
- Resolves: #1463186 IPA shouldn't allow objectclass if not all in lower case
- Resolves: #1478322 user-show command fails when sizelimit is configured
to number <= number of entity which is user member of
- Resolves: #1496775 Enterprise principals should be able to trigger
a refresh of the trusted domain data in the KDC
- Resolves: #1502533 Changing cert-find to go through the proxy
instead of using the port 8080
- Resolves: #1502663 pkinit-status command fails after an upgrade from
a pre-4.5 IPA
- Resolves: #1498168 Error when trying to modify a PTR record
- Resolves: #1457876 ipa-backup fails silently
- Resolves: #1493531 In case full PKINIT configuration is failing during
server/replica install the error message should be more meaningful.
- Resolves: #1449985 Suggest CA installation command in KRA installation
warning
- Display server name in ipa command's verbose mode (#1061703)
- Remove sourcehostcategory from default HBAC rule (#1061187)
- dnszone-add cannot add classless PTR zones (#1058688)
- Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)
- Add ipa-rmkeytab tool
- ipaclient-install: chmod needs octal permissions (#1609880)
- Added Require mod_wsgi, added share/ipa/wsgi.py
- Improve otptoken help messages (#919228)
- Ensure users exist when assigning tokens to them (#919228)
- Enable QR code display by default in otptoken-add (#919228)
- Show warning instead of error if CA did not start (#1158410)
- CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
- Traceback when adding zone with long name (#1164859)
- Backup & Restore mechanism (#951581)
- ignoring user attributes in migrate-ds does not work if uppercase characters
are returned by ldap (#1159816)
- Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
- Failure when installing on dual stacked system with external ca (#1128380)
- ipa-server should keep backup of CS.cfg (#1059135)
- Tracebacks with latest build for --zonemgr cli option (#1167270)
- webui: use domain name instead of domain SID in idrange adder dialog
(#891984)
- webui: normalize idview tab labels (#891984)
- Unable to add trust successfully with --trust-secret (#1075704)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Resolves: #1258965 ipa vault: set owner of vault container
- baseldap: make subtree deletion optional in LDAPDelete
- vault: add vault container commands
- vault: set owner to current user on container creation
- vault: update access control
- vault: add permissions and administrator privilege
- install: support KRA update
- Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
- config: allow user/host attributes with tagging options
- Resolves: #1262315 Unable to establish winsync replication
- winsync: Add inetUser objectclass to the passsync sysaccount
- Update SELinux policy to allow ipa_kpasswd to connect ldap and
read /dev/urandom. (#759679)
- Adopt to samba4 beta6 (libsecurity -> libsamba-security)
- Add dependency to samba4-winbind
- Resolves: #1298288 [RFE] Improve performance in large environments.
- cert: speed up cert-find
- Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
authentication
- service: add flag to allow S4U2Self
- Add 'trusted to auth as user' checkbox
- Added new authentication method
- Resolves: #1353881 ipa-replica-install suggests about
non-existent --force-ntpd option
- Don't show --force-ntpd option in replica install
- Resolves: #1354441 DNS forwarder check is too strict: unable to add
sub-domain to already-broken domain
- DNS: allow to add forward zone to already broken sub-domain
- Resolves: #1356146 performance regression in CLI help
- schema: Speed up schema cache
- frontend: Change doc, summary, topic and NO_CLI to class properties
- schema: Introduce schema cache format
- schema: Generate bits for help load them on request
- help: Do not create instances to get information about commands and topics
- schema cache: Do not reset ServerInfo dirty flag
- schema cache: Do not read fingerprint and format from cache
- Access data for help separately
- frontent: Add summary class property to CommandOverride
- schema cache: Read server info only once
- schema cache: Store API schema cache in memory
- client: Do not create instance just to check isinstance
- schema cache: Read schema instead of rewriting it when SchemaUpToDate
- Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
- server install: do not prompt for cert file PIN repeatedly
- Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
cache directory: [Errno 13] Permission denied: '/home/test_user'
- schema: Speed up schema cache
- Resolves: #1366604 `cert-find` crashes on invalid certificate data
- cert: do not crash on invalid data in cert-find
- Resolves: #1366612 Middle replica uninstallation in line topology works
without '--ignore-topology-disconnect'
- Fail on topology disconnect/last role removal
- Resolves: #1366626 caacl-add-service: incorrect error message when service
does not exists
- Fix ipa-caalc-add-service error message
- Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
does not happen to run during dnf upgrade
- DNS server upgrade: do not fail when DNS server did not respond
- Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
with CA
- Add warning about only one existing CA server
- Set servers list as default facet in topology facet group
- Resolves: #1367773 thin client ignores locale change
- schema check: Check current client language against cached one
- Resolves: #1434032 Run ipa-custodia with custom SELinux context
- Require correct custodia version
- Fix: DNS installer adds invalid zonemgr email (#1056202)
- ipaplatform: Use the dirsrv service, not target (#951581)
- Fix: DNS policy upgrade raises asertion error (#1161128)
- Fix upgrade referint plugin (#1161128)
- Upgrade: fix trusts objectclass violationi (#1161128)
- group-add doesn't accept gid parameter (#1149124)
- Remove redundat Requires versions that are already in Fedora 17
- Replace python-crypto Requires with m2crypto
- Add missing Requires(post) for client and server-trust-ad subpackages
- Restart httpd service when server-trust-ad subpackage is installed
- Bump selinux-policy Requires to pick up PKI/LDAP port labeling fixes
- Fix SELinux code
- Resolves: #1378353 Replica install fails with old IPA master sometimes during
replication process
- spec file: bump minimal required version of 389-ds-base
- Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
- Fix missing file that fails DL1 replica installation
- Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
- WebUI: services without canonical name are shown correctly
- Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
- trustdomain-del: fix the way how subdomain is searched
- kdb: PAC generator: do not fail if canonical principal is missing
Resolves: RHEL-23630
- ipa-kdb: Fix memory leak during PAC verification
Resolves: RHEL-22644
- Fix session cookie access
Resolves: RHEL-23622
- Do not ignore staged users in sidgen plugin
Resovlves: RHEL-23626
- ipa-kdb: Disable Bronze-Bit check if PAC not available
Resolves: RHEL-22313
- krb5kdc: Fix start when pkinit and otp auth type are enabled
Resolves: RHEL-4874
- hbactest was not collecting or returning messages
Resolves: RHEL-12780
- Resolves: #712109 "krbExtraData not allowed" is logged in DS error log while
setting password for default sudo binddn.
- Resolves: #747612 [RFE] IPA should support and manage DNS sites
- Resolves: #768316 [RFE] ipa-getkeytab should auto-detect the ipa server name
- Resolves: #825391 [RFE] Replica installation should provide a means for
inheriting nssldap security access settings
- Resolves: #921497 Incorrect *.py[co] files placement
- Resolves: #1029640 RHEL7 IPA to add DNA Plugin config for dnaRemote support
- Resolves: #1029905 389 DS cache sizes not replicated to IPA replicas
- Resolves: #1196958 IPA replica installation failing with high number of users
(160000).
- Resolves: #1219402 IPA suggests to uninstall a client when the user needs to
uninstall a replica
- Resolves: #1224057 [RFE] TGS authorization decisions in KDC based on
Authentication Indicator
- Resolves: #1234222 [WebUI] UI error message is not appropriate for "Kerberos
principal expiration"
- Resolves: #1234223 [WebUI] General invalid password error message appearing
for "Locked user"
- Resolves: #1254267 ipa-server-install failure applying ldap updates with
limits exceeded
- Resolves: #1258626 realmdomains-mod --add-domain command throwing error when
doamin already is in forwardzone.
- Resolves: #1259020 ipa-server-adtrust-install doesn't allow
NetBIOS-name=EXAMPLE-TEST.COM (dash character)
- Resolves: #1260993 DNSSEC signing enablement on dnszone should throw error
message when DNSSEC master not installed
- Resolves: #1262747 dnssec options missing in ipa-dns-install man page
- Resolves: #1265900 Fail installation immediately after dirsrv fails to
install using ipa-server-install
- Resolves: #1265915 idoverrideuser-find fails if any SID anchor is not
resolvable anymore
- Resolves: #1268027 ipa-dnskeysync-replica crash with backtrace -
LimitsExceeded: limits exceeded for this query
- Resolves: #1269089 Certificate of managed-by host/service fails to resubmit
- Resolves: #1269200 ipa-server crashing while trying to preserve admin user
- Resolves: #1271321 Reduce ioblocktimeout and idletimeout defaults
- Resolves: #1271579 Automember rule expressions disappear from tables on
single expression delete
- Resolves: #1275816 Incomplete ports for IPA ad-trust
- Resolves: #1276351 [RFE] Remove
/usr/share/ipa/updates/50-lockout-policy.update file from IPA releases
- Resolves: #1277109 Add tool tips for Revert, Refresh, Undo, and Undo All in
the IPA UI
- Resolves: #1278426 Better error message needed for invalid ca-signing-algo
option
- Resolves: #1279932 ipa-client-install --request-cert needs workaround in
anaconda chroot
- Resolves: #1282521 Creating a user w/o private group fails when doing so in
WebUI
- Resolves: #1283879 ipa-winsync-migrate: Traceback message should be replaced
by "IPA is not configured on this system"
- Resolves: #1285071 ipa-kra-install fails on replica looking for admin cert
file
- Resolves: #1287194 [RFE] Support of UPN for trusted domains
- Resolves: #1288967 Normalize Manager entry in ipa user-add
- Resolves: #1289487 Priority field missing in Password Policy detail tab
- Resolves: #1291140 ipa client should configure kpasswd_server directive in
krb5.conf
- Resolves: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.4.0.alpha1
- Resolves: #1298848 [RFE] Centralized topology management
- Resolves: #1300576 Browser setup page includes instructions for Internet
Explorer
- Resolves: #1301586 ipa host-del --updatedns should remove related dns
entries.
- Resolves: #1304618 Residual Files After IPA Server Uninstall
- Resolves: #1305144 ipa-python does not require its dependencies
- Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
- Resolves: #1313798 Console output post ipa-winsync-migrate command should be
corrected.
- Resolves: #1314786 [RFE] External Trust with Active Directory domain
- Resolves: #1319023 Include description for 'status' option in man page for
ipactl command.
- Resolves: #1319912 ipa-server-install does not completely change hostname and
named-pkcs11 fails
- Resolves: #1320891 IPA Error 3009: Validation error: Invalid 'ptrrecord':
Reverse zone in-addr.arpa. requires exactly 4 IP address compnents, 5 given
- Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
revocation reasons
- Resolves: #1328549 "ipa-kra-install" command reports incorrect message when
it is executed on server already installed with KRA.
- Resolves: #1329209 ipa-nis-manage enable: change service name from 'portmap'
to 'rpcbind'
- Resolves: #1329275 ipa-nis-manage command should include status option
- Resolves: #1330843 'man ipa' should be updated with latest commands
- Resolves: #1333755 ipa cert-request causes internal server error while
requesting certificate
- Resolves: #1337484 EOF is not handled for ipa-client-install command
- Resolves: #1338031 Insufficient 'write' privilege on some attributes for the
members of the role which has "User Administrators" privilege.
- Resolves: #1343142 IPA DNS should do better verification of DNS zones
- Resolves: #1347928 Frontpage exposes runtime error with no cookies enabled in
browser
- Use NSS protocol range API to set available TLS protocols (#1156466)
- Updated to upstream 3.0.0 rc 2
- Include new FF configuration extension
- Set minimum Requires of selinux-policy to 3.11.1-33
- Set minimum Requires dogtag to 10.0.0-0.43.b1
- Add new optional strict sub-package to allow users to limit other
package upgrades.
- Add ipa-idrange-fix
Resolves: RHEL-56920
- Unconditionally add MS-PAC to global config on update
Resolves: RHEL-49437
- ipatests: Update ipa-adtrust-install test
Resolves: RHEL-40894
- Require python-qrcode version 5.3 or later
Related: RHEL-15090
- ipa-kdb: Rework ipadb_reinit_mspac()
Resolves: RHEL-25742
- ipatests: wait for replica update in test_dns_locations
Resolves: RHEL-22373
- ipatests: fix tasks.wait_for_replication() method
Resolves: RHEL-25708
- Resolves: #805188 [RFE] "ipa migrate-ds" ldapsearches with scope=1
- Resolves: #1019272 With 20000+ users, adding a user to a group intermittently
throws Internal server error
- Resolves: #1035494 Unable to add Kerberos principal via kadmin.local
- Resolves: #1045153 ipa-managed-entries --list -p still requires
DM password
- Resolves: #1125950 ipa-server-install --uinstall doesn't remove port 7389
from ldap_port_t
- Resolves: #1132540 [RFE] Expose service delegation rules in UI and CLI
- Resolves: #1145584 ipaserver/install/cainstance.py creates pkiuser not
matching uidgid
- Resolves: #1176036 IDM client registration failure in a high load environment
- Resolves: #1183116 Remove Requires: subscription-manager
- Resolves: #1186054 permission-add does not prompt to enter --right option in
interactive mode
- Resolves: #1187524 Replication agreement with replica not disabled when
ipa-restore done without IPA installed
- Resolves: #1188195 Fax number not displayed for user-show when kinit'ed as
normal user.
- Resolves: #1189034 "an internal error has occurred" during ipa host-del
--updatedns
- Resolves: #1193554 ipa-client-automount: failing with error LDAP server
returned UNWILLING_TO_PERFORM. This likely means that minssf is enabled.
- Resolves: #1193759 IPA extdom plugin fails when encountering large groups
- Resolves: #1194312 [ipa-python] ipalib.errors.LDAPError: failed to decode
certificate: (SEC_ERROR_INVALID_ARGS) security library: invalid arguments.
- Resolves: #1194633 Default trust view can be deleted in lower case
- Resolves: #1196455 ipa-server-install step [8/27]: starting certificate
server instance - confusing CA staus message on TLS error
- Resolves: #1198263 Limit deadlocks between DS plugin DNA and slapi-nis
- Resolves: #1199527 [RFE] Use datepicker component for datetime fields
- Resolves: #1200867 [RFE] Make OTP validation window configurable
- Resolves: #1200883 [RFE] Switch apache to use mod_auth_gssapi
- Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using
get_user_grouplist() [rhel-7.2]
- Resolves: #1204637 slow group operations
- Resolves: #1204642 migrate-ds: slow add o users to default group
- Resolves: #1208461 IPA CA master server update stuck on checking getStatus
via https
- Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
- Resolves: #1211708 ipa-client-install gets stuck during NTP sync
- Resolves: #1215197 ipa-client-install ignores --ntp-server option during time
sync
- Resolves: #1215200 ipa-client-install configures IPA server as NTP source
even if IPA server has not ntpd configured
- Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
- Related: #1204809 Rebase ipa to 4.2
- Update to upstream 4.2.0.alpha1
- ipatests: NAMED_CRYPTO_POLICY_FILE not defined for RHEL
Resolves: RHBZ#1982956
- Add sssd and certmonger as a Requires on ipa-client
- Rebase to upstream release 4.9.10
Remove upstream patches 0002 to 0016 that are part of version 4.9.10
Remove patches 1101 that is part of version 4.9.10
Rename patch 0001 to 1002 as it will be used in future RHEL 8 releases
Add patches 0001 and 0002 to fix build on RHEL 8.7
Resolves: RHBZ#2079466
Resolves: RHBZ#2063155
Resolves: RHBZ#1958777
Resolves: RHBZ#2068088
Resolves: RHBZ#2004646
Resolves: RHBZ#782917
Resolves: RHBZ#2059396
Resolves: RHBZ#2092015
- Handle new samba exception types.
Resolves: RHEL-17623
- Deprecate --serial-autoincrement option (#1016645)
- CA installation always failed on replica (#1005446)
- Re-initializing a winsync connection exited with error (#994980)
- Update to upstream 3.2.0 Beta 1
- Add a Requires for java-atk-wrapper until we can determine which package
should be pulling it in, dogtag or tomcat.
- Add redhat-access-plugin-ipa dependency
- extdom: unify error code handling especially LDAP_NO_SUCH_OBJECT
Resolves: RHBZ#1741530
- Resolves: #800545 [RFE] Support SUDO command rename
- Reworked the renaming mechanism
- Allow renaming of the sudorule objects
- Resolves: #872671 IPA WebUI login for AD Trusted User fails
- WebUI: check principals in lowercase
- WebUI: add method for disabling item in user dropdown menu
- WebUI: Add support for login for AD users
- Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
certificates on smart cards (pkinit)
- ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
- IPA certauth plugin
- ipa-kdb: do not depend on certauth_plugin.h
- spec file: bump krb5-devel BuildRequires for certauth
- Resolves: #1264370 RFE: disable last successful authentication by default in
ipa.
- Set "KDC:Disable Last Success" by default
- Resolves: #1318186 Misleading error message during external-ca IPA master
install
- certs: do not implicitly create DS pin.txt
- httpinstance: clean up /etc/httpd/alias on uninstall
- Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
CA certificate chain in ... incomplete"
- certs: do not implicitly create DS pin.txt
- httpinstance: clean up /etc/httpd/alias on uninstall
- Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
- configure: fix --disable-server with certauth plugin
- rpcserver.login_x509: Actually return reply from __call__ method
- spec file: Bump requires to make Certificate Login in WebUI work
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- extdom: do reverse search for domain separator
- extdom: improve cert request
- Resolves: #1430363 [RFE] HBAC rule names command rename
- Reworked the renaming mechanism
- Allow renaming of the HBAC rule objects
- Resolves: #1433082 systemctl daemon-reload needs to be called after
httpd.service.d/ipa.conf is manipulated
- tasks: run `systemctl daemon-reload` after httpd.service.d updates
- Resolves: #1434032 Run ipa-custodia with custom SELinux context
- Use Custodia 0.3.1 features
- Resolves: #1434384 RPC client should use HTTP persistent connection
- Use connection keep-alive
- Add debug logging for keep-alive
- Increase Apache HTTPD's default keep alive timeout
- Resolves: #1434729 man ipa-cacert-manage install needs clarification
- man ipa-cacert-manage install needs clarification
- Resolves: #1434910 replica install against IPA v3 master fails with ACIError
- Fixing replica install: fix ldap connection in domlvl 0
- Resolves: #1435394 Ipa-kra-install fails with weird output when backspace is
used during typing Directory Manager password
- ipapython.ipautil.nolog_replace: Do not replace empty value
- Resolves: #1435397 ipa-replica-install can't install replica file produced by
ipa-replica-prepare on 4.5
- replica prepare: fix wrong IPA CA nickname in replica file
- Resolves: #1435599 WebUI: in self-service Vault menu item is shown even if
KRA is not installed
- WebUI: Fix showing vault in selfservice view
- Resolves: #1435718 As a ID user I cannot call a command with --rights option
- ldap2: use LDAP whoami operation to retrieve bind DN for current connection
- Resolves: #1436319 "Truncated search results" pop-up appears in user details
in WebUI
- WebUI: Add support for suppressing warnings
- WebUI: suppress truncation warning in select widget
- Resolves: #1436333 Uninstall fails with No such file or directory:
'/var/run/ipa/services.list'
- Create temporaty directories at the begining of uninstall
- Resolves: #1436334 WebUI: Adding certificate mapping data using certificate
fails
- WebUI: Allow to add certs to certmapping with CERT LINES around
- Resolves: #1436338 CLI doesn't work after ipa-restore
- Backup ipa-specific httpd unit-file
- Backup CA cert from kerberos folder
- Resolves: #1436342 Bump samba version, required for FIPS mode and privilege
separation
- Bump samba version for FIPS and priv. separation
- Resolves: #1436642 [ipalib/rpc.py] - "maximum recursion depth exceeded" with
ipa vault commands
- Avoid growing FILE ccaches unnecessarily
- Handle failed authentication via cookie
- Work around issues fetching session data
- Prevent churn on ccaches
- Resolves: #1436657 Add workaround for pki_pin for FIPS
- Generate PIN for PKI to help Dogtag in FIPS
- Resolves: #1436714 [vault] cache KRA transport cert
- Simplify KRA transport cert cache
- Resolves: #1436723 cert-find does not find all certificates without
sizelimit=0
- cert: do not limit internal searches in cert-find
- Resolves: #1436724 Renewal of IPA RA fails on replica
- dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
- Resolves: #1436753 Master tree fails to install
- httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not
available
- webui IdP: Remove arrow notation due to uglify-js limitation
Related: RHBZ#2141316
- Use java-1.8.0-openjdk-devel
- Update to upstream 2.2.0 alpha 1 (2.1.90.pre1)
- Support krb5 1.18
Resolves: RHBZ#1817579
- Fix ipa-replica-install crashes
- Fix ipa-server-install and ipa-dns-install logging
- Set minimum version of pki-ca to 9.0.17 to fix sslget problem
caused by FEDORA-2011-17400 update (#771357)
- Set minimum version of certmonger to 0.26 (to pck up #621670)
- Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
- Set minimum version of pki-ca to 1.3.6
- Set minimum version of sssd to 1.2.1
- diffstat was missing as a build dependency causing multilib problems
- Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
Resolves: RHBZ#1790663
- Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
certificates on smart cards (pkinit)
- spec file: bump krb5 Requires for certauth fixes
- Resolves: #1438729 Configure local PKINIT on DL0 or when '--no-pkinit' option
is used
- separate function to set ipaConfigString values on service entry
- Allow for configuration of all three PKINIT variants when deploying KDC
- API for retrieval of master's PKINIT status and publishing it in LDAP
- Use only anonymous PKINIT to fetch armor ccache
- Stop requesting anonymous keytab and purge all references of it
- Use local anchor when armoring password requests
- Upgrade: configure local/full PKINIT depending on the master status
- Do not test anonymous PKINIT after install/upgrade
- Resolves: #1442427 ipa.ipaserver.install.plugins.adtrust.
update_tdo_gidnumber: ERROR Default SMB Group not found
- upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
installed
- Resolves: #1442932 ipa restore fails to restore IPA user
- restore: restart/reload gssproxy after restore
- Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
- Fix CA/server cert validation in FIPS
- Resolves: #1444947 Deadlock between topology and schema-compat plugins
- compat-manage: behave the same for all users
- Move the compat plugin setup at the end of install
- compat: ignore cn=topology,cn=ipa,cn=etc subtree
- Resolves: #1445358 ipa vault-add raises TypeError
- vault: piped input for ipa vault-add fails
- Resolves: #1445382 ipa vault-retrieve fails to retrieve data from vault
- Vault: Explicitly default to 3DES CBC
- Resolves: #1445432 uninstall ipa client automount failed with RuntimeWarning
- automount install: fix checking of SSSD functionality on uninstall
- Resolves: #1446137 pki_client_database_password is shown in
ipaserver-install.log
- Hide PKI Client database password in log file
- Prepare spec file for release
- Using git snapshot 80e87e75bd6ab56e3e20c49ece55bd4d52f1a503
- Version bump for release
- Add missing ipa-selinux package
Resolves: RHBZ#1853263
- Remove unnecessary moving of v1 CA serial number file in post script
- Add Obsoletes for server-selinxu subpackage
- Using git snapshot 442d6ad30ce1156914e6245aa7502499e50ec0da
- PassSync does not sync passwords due to missing ACIs (#1181093)
- ipa-replica-manage list does not list synced domain (#1181010)
- Do not assume certmonger is running in httpinstance (#1181767)
- ipa-replica-manage disconnect fails without password (#1183279)
- Put LDIF files to their original location in ipa-restore (#1175277)
- DUA profile not available anonymously (#1184149)
- IPA replica missing data after master upgraded (#1176995)
- Included LICENSE and README in all packages for documentation
- Move user-modifiable content to /etc/ipa and linked back to
/usr/share/ipa/html
- Changed some references to /usr to the {_usr} macro and /etc
to {_sysconfdir}
- Added popt-devel to BuildRequires for Fedora 8 and higher and
popt for Fedora 7
- Package the egg-info for Fedora 9 and higher for ipa-python
- Updated to upstream 3.0.0 beta 2
- 2.1.3
- Force to use 389-ds 1.2.10-0.8.a7 or above
- Improve upgrade script to handle systemd 389-ds change
- Fix freeipa to work with python-ldap 2.4.6
- Fix bug #702633
- Resolves: #1256840 [webui] majority of required fields is no longer marked as
required
- fix missing information in object metadata
- Resolves: #1256842 [webui] no option to choose trust type when creating a
trust
- webui: add option to establish bidirectional trust
- Resolves: #1256853 Clear text passwords in KRA install log
- Removed clear text passwords from KRA install log.
- Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
discouraged
- vault: change default vault type to symmetric
- Resolves: #1257163 renaming certificatte profile with --rename option leads
to integrity issues
- certprofile: prevent rename (modrdn)
- Allow the admin user to be disabled
Resolves: RHEL-34756
- ipa-otptoken-import: open the key file in binary mode
Resolves: RHEL-39616
- ipa-crlgen-manage: manage the cert status task execution time
Resolves: RHEL-30280
- idrange-add: add a warning because 389ds restart is required
Resolves: RHEL-28996
- PKINIT certificate: fix renewal on hidden replica
Resolves: RHEL-4913, RHEL-45908
- Mass rebuild 2014-01-24
- Require certmonger 0.79.7-1
Related: RHBZ#1708095
- Do not check if port 8443 is available in step 2 of external CA install
(#1129481)
- Resolves: #1249226 IPA dnssec-validation not working for AD dnsforwardzone
- DNSSEC: fix forward zone forwarders checks
- Resolves: #1250190 idrange is not added for sub domain
- trusts: format Kerberos principal properly when fetching trust topology
- Resolves: #1252334 User life cycle: missing ability to provision a stage user
from a preserved user
- Add user-stage command
- Resolves: #1252863 After applying RHBA-2015-1554 errata, IPA service fails to
start.
- spec file: Add Requires(post) on selinux-policy
- Resolves: #1254304 Changing vault encryption attributes
- Change internal rsa_(public|private)_key variable names
- Added support for changing vault encryption.
- Resolves: #1256715 Executing user-del --preserve twice removes the user
pernamently
- improve the usability of `ipa user-del --preserve` command
- Pull upstream changelog 608 which renamed several files
- Fix for CVE-2008-3274
- Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
- Add fix for bug #453185
- Rebuild against openldap libraries, mozldap ones do not work properly
- TurboGears is currently broken in rawhide. Added patch to not build
the UI locales and removed them from the ipa-server files section.
- Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
- Fix regression introduced in ipa-certupdate
- Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
- Do not initialize API in ipa-client-automount uninstall
- Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
client changes
- idrange: fix unassigned global variable
- Resolves: #1360792 Migrating users doesn't update krbCanonicalName
- re-set canonical principal name on migrated users
- Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
and 'bool' objects
- Fix ipa hbactest output
- Resolves: #1362260 ipa vault-mod no longer allows defining salt
- vault: add missing salt option to vault_mod
- Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
public key
- vault: Catch correct exception in decrypt
- Resolves: #1362537 ipa-server-install fails to create symlink from
/etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
- Correct path to HTTPD's systemd service directory
- Resolves: #1363756 Increase length of passwords generated by installer
- Increase default length of auto generated passwords
- Update to upstream 3.3.0 Beta 2 (#991064)
- Update Requires on pki-ca to 10.1.2-4 (#1129558)
- build: increase java stack size for all arches
- Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
- Fix dns zonemgr validation regression (#1056202)
- Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
- Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
(#886645)
- Add bind-dyndb-ldap working dir to IPA specfile
- Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
(#886645)
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
- Deadlock in schema compat plugin (#1161131)
- ipactl stop should stop dirsrv last (#1161129)
- Upgrade 3.3.5 to 4.1 failed (#1161128)
- CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)
- Fix status trust-add command status message (#910453)
- NetBIOS was not trimmed at 15 characters (#1030517)
- Harden CA subsystem certificate renewal on CA clones (#1040018)
- remove ipa-fix-CVE-2008-3274
- Resolves: #1382812 Creation of replica for disconnected environment is
failing with CA issuance errors; Need good steps.
- gracefully handle setting replica bind dn group on old masters
- Resolves: #1397439 ipa-ca-install on promoted replica hangs on creating a
temporary CA admin
- replication: ensure bind DN group check interval is set on replica config
- add missing attribute to ipaca replica during CA topology update
- Resolves: #1401088 IPA upgrade of replica without DNS fails during restart of
named-pkcs11
- bindinstance: use data in named.conf to determine configuration status
- Resolves: #1348948 IPA server install fails with build
ipa-server-4.4.0-0.el7.1.alpha1
- Revert "Increased mod_wsgi socket-timeout"
- Resolves: #1449189 ipa-kra-install timeouts on replica
- ipa-kra-install: fix check_host_keys
- Require python-wehjit >= 0.2.0
- Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
- Resolves: #1375269 ipa trust-fetch-domains throws internal error
- Set minimum level of 389-ds-base to 1.2.7 for enhanced memberof plugin
- Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
- ipa-sam: replace encode_nt_key() with E_md4hash()
- ipa_pwd_extop: do not generate NT hashes in FIPS mode
- Resolves: #1377973 ipa-server-install fails when the provided or resolved
IP address is not found on local interfaces
- Fix local IP address validation
- ipa-dns-install: remove check for local ip address
- refactor CheckedIPAddress class
- CheckedIPAddress: remove match_local param
- Remove ip_netmask from option parser
- replica install: add missing check for non-local IP address
- Remove network and broadcast address warnings
- Resolves: #1477178 - [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic
key for host
- Always check peer has keys before connecting
- Resolves: #1482802 - Unable to set ca renewal master on replica
- Fix ipa config-mod --ca-renewal-master
- Resolves: #1486283 - TypeError in renew_ca_cert prevents from swiching
back to self-signed CA
- Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
- Resolves: #1480102 - ipa-server-upgrade failes with "This entry already exists"
- Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
- Resolves: #1484826 - FreeIPA/IdM installations which were upgraded from
versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
thus startup of Web UI fails
- Adds whoami DS plugin in case that plugin is missing
- Resolves: #1478251 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
- Fixing how sssd.conf is updated when promoting a client to replica
- Resolves: #1461177 - ipa-otptoken-import - XML file is missing PBKDF2
parameters!
- ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
- Resolves: #1484428 - Updating from RHEL 7.3 fails with Server-Cert not found
(ipa-server-upgrade)
- Backport 4-5: Fix ipa-server-upgrade with server cert tracking
- kdb: Use-krb5_pac_full_sign_compat() when available
Resolves: RHBZ#2176406
- OTP: fix-data-type-to-avoid-endianness-issue
Resolves: RHBZ#2218293
- Upgrade: fix replica agreement
Resolves: RHBZ#2216551
- Upgrade: add PKI drop-in file if missing
Resolves: RHBZ#2215336
- Use the python-cryptography parser directly in cert-find
Resolves: RHBZ#2164349
- Backport test updates
Resolves: RHBZ#221884
- Initial rpm version
- SELinux Policy: let custodia replicate keys
Resolves: RHBZ#1868432
- Update slapi-nis dependency to pull 0.54-2 (#891984)
- ipa-restore: Don't crash if AD trust is not installed (#951581)
- Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
- Trust setting not restored for CA cert with ipa-restore command (#1159011)
- ipa-server-install fails when restarting named (#1162340)
- Rebuild against samba4 beta8
- Resolves: #1170770 [AD TRUST]IPA should detect inconsistent realm domains
that conflicts with AD DC
- trusts: Check for AD root domain among our trusted domains
- Resolves: #1195339 ipa-client-install changes the label on various files
which causes SELinux denials
- sysrestore: copy files instead of moving them to avoind SELinux issues
- Resolves: #1196656 [ipa-client][rhel71] enable debugging for spawned
commands / ntpd -qgc $tmpfile hangs
- enable debugging of ntpd during client installation
- Resolves: #1205264 Migration UI Does Not Work When Anonymous Bind is Disabled
- migration: Use api.env variables.
- Resolves: #1212719 abort-clean-ruv subcommand should allow
replica-certifyall: no
- Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand
- Resolves: #1216935 ipa trust-add shows ipa: ERROR: an internal error has
occurred
- dcerpc: Expand explanation for WERR_ACCESS_DENIED
- dcerpc: Fix UnboundLocalError for ccache_name
- Resolves: #1222778 idoverride group-del can delete user and user-del can
delete group
- dcerpc: Add get_trusted_domain_object_type method
- idviews: Restrict anchor to name and name to anchor conversions
- idviews: Enforce objectclass check in idoverride*-del
- Resolves: #1234919 Be able to request certificates without certmonger service
running
- cermonger: Use private unix socket when DBus SystemBus is not available.
- ipa-client-install: Do not (re)start certmonger and DBus daemons.
- Resolves: #1240939 Please add dependency on bind-pkcs11
- Create server-dns sub-package.
- ipaplatform: Add constants submodule
- DNS: check if DNS package is installed
- Resolves: #1242914 Bump minimal selinux-policy and add booleans to allow
calling out oddjobd-activated services
- selinux: enable httpd_run_ipa to allow communicating with oddjobd services
- Resolves: #1243261 non-admin users cannot search hbac rules
- fix hbac rule search for non-admin users
- fix selinuxusermap search for non-admin users
- Resolves: #1243652 Client has missing dependency on memcache
- do not import memcache on client
- Resolves: #1243835 [webui] user change password dialog does not work
- webui: fix user reset password dialog
- Resolves: #1244802 spec: selinux denial during kdcproxy user creation
- Fix selinux denial during kdcproxy user creation
- Resolves: #1246132 trust-fetch-domains: Do not chown keytab to the sssd user
- oddjob: avoid chown keytab to sssd if sssd user does not exist
- Resolves: #1246136 Adding a privilege to a permission avoids validation
- Validate adding privilege to a permission
- Resolves: #1246141 DNS Administrators cannot search in zones
- DNS: Consolidate DNS RR types in API and schema
- Resolves: #1246143 User plugin - user-find doesn't work properly with manager
option
- fix broken search for users by their manager
- ipa-kdb: Detect and block Bronze-Bit attacks
Resolves: RHEL-9984
- Fix for CVE-2023-5455
Resolves: RHEL-12578
- Temporarily move ipa-backup and ipa-restore functionality
back to make them available in public Beta (#1003933)
- Added patch to fix problem reported by ldapmodify
- Add dependency for python-krbV
- Resolves: #1438833 [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic key for
host
- Make sure remote hosts have our keys
- Resolves: #1442815 Replica install fails during migration from older IPA
master
- Refresh Dogtag RestClient.ca_host property
- Remove the cachedproperty class
- Resolves: #1444787 Update warning message when KRA installation fails
- kra install: update installation failure message
- Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
- ipa-server-install with external CA: fix pkinit cert issuance
- Resolves: #1445397 GET in KerberosSession.finalize_kerberos_acquisition()
must use FreeIPA CA
- kerberos session: use CA cert with full cert chain for obtaining cookie
- Resolves: #1447375 ipa-client-install: extra space in pkinit_anchors
definition
- ipa-client-install: remove extra space in pkinit_anchors definition
- Resolves: #1447703 Fix SELinux contex of http.keytab during upgrade
- Use proper SELinux context with http.keytab
- Fix upgrade issue with AD trust when no trust yet established
Fixes: RHBZ#1708874
Related: RHBZ#1684528
- Resolves: #1131907 [ipa-client-install] cannot write certificate file
'/etc/ipa/ca.crt.new': must be string or buffer, not None
- Resolves: #1195775 unsaved changes dialog internally inconsistent
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- Stageusedr-activate: show username instead of DN
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Prevent to rename certprofile profile id
- Resolves: #1222047 IPA to AD Trust: IPA ERROR 4016: Remote Retrieve Error
- Resolves: #1224769 copy-schema-to-ca.py does not overwrites schema files
- copy-schema-to-ca: allow to overwrite schema files
- Resolves: #1241941 kdc component installation of IPA failed
- spec file: Update minimum required version of krb5
- Resolves: #1242036 Replica install fails to update DNS records
- Fix DNS records installation for replicas
- Resolves: #1242884 Upgrade to 4.2.0 fails when enabling kdc proxy
- Start dirsrv for kdcproxy upgrade
- ipa-kdb: fix error handling of is_master_host()
Resolves: RHBZ#2214638
- ipatests: enable firewall rule for http service on acme client
Resolves: RHBZ#2230256
- User plugin: improve error related to non existing idp
Resolves: RHBZ#2224572
- Prevent admin user from being deleted
Resolves: RHBZ#1821181
- Fix memory leak in the OTP last token plugin
Resolves: RHBZ#2227783
- Fix Fedora package changelog after merging systemd changes
- Backport latest test fixes in python3-ipatests
Resolves: RHBZ#2060841
- extdom: user getorigby{user|group}name if available
Resolves: RHBZ#2062379
- Set the mode on ipaupgrade.log during RPM post snipppet
Resolves: RHBZ#2061957
- test_krbtpolicy: skip SPAKE-related tests in FIPS mode
Resolves: RHBZ#1909630
- Fixed kdcproxy_version to 0.4-3
- Fixed krb5_version to 1.17-7
Related: RHBZ#1684528
- Handle NFS configuration file changes. nfs-utils moved the
configuration file from /etc/sysconfig/nfs to /etc/nfs.conf.
Resolves: RHBZ#1676981
- webui: Allow grace login limit
Resolves: RHBZ#2109243
- check_repl_update: in progress is a boolean
Resolves: RHBZ#2117303
- Disabling gracelimit does not prevent LDAP binds
Resolves: RHBZ#2109236
- Set passwordgracelimit to match global policy on group pw policies
Resolves: RHBZ#2115475
- Add Requires on krb5-pkinit-openssl
- Upstream release FreeIPA 4.9.6
Related: RHBZ#1945038
- Revise PKINIT upgrade code
Resolves: RHBZ#1886837
- ipa-cert-fix man page: add note about certmonger renewal
Resolves: RHBZ#1780317
- Certificate Serial Number issue
Resolves: RHBZ#1919384
- Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
- Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to
handle PKINIT certificates/anchors
- certdb: add named trust flag constants
- certdb, certs: make trust flags argument mandatory
- certdb: use custom object for trust flags
- install: trust IPA CA for PKINIT
- client install: fix client PKINIT configuration
- install: introduce generic Kerberos Augeas lens
- server install: fix KDC PKINIT configuration
- ipapython.ipautil.run: Add option to set umask before executing command
- certs: do not export keys world-readable in install_key_from_p12
- certs: do not export CA certs in install_pem_from_p12
- server install: fix KDC certificate validation in CA-less
- replica install: respect --pkinit-cert-file
- cacert manage: support PKINIT
- server certinstall: support PKINIT
- Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
option
- certs: do not export CA certs in install_pem_from_p12
- server install: fix KDC certificate validation in CA-less
- Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
decommissioned
- ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname
- Resolves: #1451712 KRA installation fails on server that was originally
installed as CA-less
- ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
- Resolves: #1441499 ipa cert-show does not raise error if no file name
specified
- ca/cert-show: check certificate_out in options
- Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
- Remove pkinit-anonymous command
- Resolves: #1449523 Provide an API command to retrieve PKINIT status
in the FreeIPA topology
- Allow for multivalued server attributes
- Refactor the role/attribute member reporting code
- Add an attribute reporting client PKINIT-capable servers
- Add the list of PKINIT servers as a virtual attribute to global config
- Add `pkinit-status` command
- test_serverroles: Get rid of MockLDAP and use ldap2 instead
- Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
- Fix rare race condition with missing ccache file
- Resolves: #1455045 Simple service uninstallers must be able to handle
missing service files gracefully
- only stop/disable simple service if it is installed
- Resolves: #1455541 after upgrade login from web ui breaks
- krb5: make sure KDC certificate is readable
- Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
command "ipa cert-request --add" after upgrade
- Change python-cryptography to python2-cryptography
- Require krb5 release 1.18.2-25 or later
Resolves: RHBZ#2234711
- Rebase ipa to 4.9.12
Resolves: RHBZ#2196425
- user or group name: explain the supported format
Resolves: RHBZ#2150217
- Allow insecure binds for migration
Resolves: RHBZ#1731963
- Trust add tries to add same value of --base-id for sub domain,
causing an error (#1033068)
- Improved error reporting for adding trust case (#1029856)
- Do not fetch a principal two times, remove potential memory leak (#1070924)
- Depend on krb5-kdb-version-devel for BuildRequires
- Update nss dependency to 3.44.0-4
- Reset per-indicator Kebreros policy
Resolves: RHBZ#1784761
- Resolves: #1339233 CA installed on replica is always marked as renewal master
- Related: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.3.1.201605241723GIT1b427d3
- Pull upstream changelog 722
- Add Conflicts mod_ssl (435360)
- Use default ssh host key algorithms
Resolves: RHBZ#1756432
- Do not run trust upgrade code if master lacks Samba bindings
Resolves: RHBZ#1757064
- Finish group membership management UI
Resolves: RHBZ#1773528
- Add ipa-host-net-manage script
- Use the OpenSSL certificate parser in cert-find
Resolves: RHBZ#2209947
- Add a- heck into ipa-cert-fix tool to avoid updating certs if CA is close to expire
Resolves: RHEL-4941
- Fix rpminspect's 'patches' warnings
Resolves: RHEL-22497
- replica install failing with avc denial for custodia component
Resolves: RHBZ#1857157
- Upstream pre release FreeIPA 4.9.0rc1
Resolves: RHBZ#1891832
- Requirements and design for libpwquality integration
Resolves: RHBZ#1340463
- When parsing options require name/value pairs
Resolves: RHBZ#1357495
- WebUI: Fix issue with opening links in new tab/window
Resolves: RHBZ#1484088
- Use a state to determine if a 389-ds upgrade is in progress
Resolves: RHBZ#1569011
- Unlock user accounts after a password reset and replicate that unlock to
all IdM servers
Resolves: RHBZ#1784657
- Set the certmonger subject with a string, not an object
Resolves: RHBZ#1810148
- Implement ACME certificate enrolment
Resolves: RHBZ#1851835
- [WebUI] Backport jQuery patches from newer versions of the library (e.g.
3.5.0)
Resolves: RHBZ#1859249
- It is not possible to edit KDC database when the FreeIPA server is running
Resolves: RHBZ#1875001
- Fix nsslapd-db-lock tuning of BDB backend
Resolves: RHBZ#1882340
- ipa-kdb: support subordinate/superior UPN suffixes
Resolves: RHBZ#1891056
- wgi/plugins.py: ignore empty plugin directories
Resolves: RHBZ#1894800
- Default to systemd for Fedora 16 and onwards
- Update to upstream 3.2.0 GA
- ipa-client-install fails if /etc/ipa does not exist (#961483)
- Certificate status is not visible in Service and Host page (#956718)
- ipa-client-install removes needed options from ldap.conf (#953991)
- Handle socket.gethostbyaddr() exceptions when verifying hostnames (#953957)
- Add triggerin scriptlet to support OpenSSH 6.2 (#953617)
- Require nss 3.14.3-12.0 to address certutil certificate import
errors (#953485)
- Require pki-ca 10.0.2-3 to pull in fix for sslget and mixed IPv4/6
environments. (#953464)
- ipa-client-install removes 'sss' from /etc/nsswitch.conf (#953453)
- ipa-server-install --uninstall doesn't stop dirsrv instances (#953432)
- Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for
socket based connections (#960222)
- Require libsss_nss_idmap-python
- Add Conflicts on nss-pam-ldapd < 0.8.4. The mapping from uniqueMember to
member is now done automatically and having it in the config file raises
an error.
- Add backup and restore tools, directory.
- require at least systemd 38 which provides the journal (we no longer
need to require syslog.target)
- Update Requires on policycoreutils to 2.1.14-37
- Update Requires on selinux-policy to 3.12.1-42
- Update Requires on 389-ds-base to 1.3.1.0
- Remove a Requires for java-atk-wrapper
- Preserve user: fix the confusing summary
Resolves: RHBZ#2022028
- Only calculate LDAP password grace when the password is expired
Related: RHBZ#782917
- Resolves: #1260663 crash of ipa-dnskeysync-replica component during
ipa-restore
- IPA Restore: allows to specify files that should be removed
- Resolves: #1261806 Installing ipa-server package breaks httpd
- Handle timeout error in ipa-httpd-kdcproxy
- Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
- Server Upgrade: backup CS.cfg when dogtag is turned off
- ipa-server-install crashes when AD subpackage is not installed (#1026434)
- Resolves: #1228671 pkispawn fails in ipa-ca-install and ipa-kra-install
- Related: #1204809 Rebase ipa to 4.2
- Fix minimum version of slapi-nis
- Require python-sss and python-sss-murmur (provided by sssd-1.13.0)
- Drop conflicts on mod_nss
- Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
- Drop a slew of conditionals on older Fedora releases (< 12)
- Add a few conditionals against RHEL 6
- Add Requires of nss-tools on ipa-client
- Upstream release FreeIPA 4.9.3
Resolves: RHBZ#1945038
- Fix systemd-user HBAC rule
Resolves: RHBZ#1664974
- sudo rule for "admins" members should be created by default (#1609873)
- New upstream release 1.2.1
- Updated to current upstream state of 3.0.0 beta 2 development
- Wrong directories created on full restore (#1186398)
- ipa-restore crashes if replica is unreachable (#1186396)
- idoverrideuser-add option --sshpubkey does not work (#1185410)
- Missing objectclasses when empty password passed to host-add (#1052979)
- sudoOrder missing in sudoers (#1052983)
- Missing examples in sudorule help (#1049464)
- Client automount does not uninstall when fstore is empty (#910899)
- Error not clear for invalid realm given to trust-fetch-domains (#1052981)
- trust-fetch-domains does not add idrange for subdomains found (#1049926)
- Add option to show if an AD subdomain is enabled/disabled (#1052973)
- ipa-adtrust-install still failed with long NetBIOS names (#1030517)
- Error not clear for invalid relam given to trustdomain-find (#1049455)
- renewed client cert not recognized during IPA CA renewal (#1033273)
- Revert bind-pkcs11-utils configuration in freeipa.spec.
Resolves: RHBZ#2026732
- Replace TurboGears requirement with python-cherrypy
- Update to upstream 3.2.1
- Drop dogtag-pki-server-theme requires, it won't be build for RHEL-7.0
- Remove ipa-idoverride-memberof as superceded by ipa-server 4.8.7
Resolves: RHBZ#1846434
- Respin after the tarball has been re-released upstream
New hash is 506c9c92dcaf9f227cba5030e999f177
- Allow Web-based migration to work with tightened SE Linux policy (#769440)
- Rebuild slapi plugins against re-enterant version of libldap
- Remove strict dependencies to krb5-server version in order to allow
update of krb5 to 1.17 and change dependency to KDB DAL version.
Resolves: RHBZ#1700121
- Fixed: rhbz#1643445 - External CA step 2 fails with pki_client_database_dir is missing
- Fixed: rhbz#1642834 - Smart card advise script uses hard-coded Python interpreter
- Resolves: #1277696 IPA certificate auto renewal fail with "Invalid
Credential"
- cert renewal: make renewal of ipaCert atomic
- Resolves: #1278330 installer options are not validated at the beginning of
installation
- install: fix command line option validation
- Resolves: #1282845 sshd_config change on ipa-client-install can prevent sshd
from starting up
- client install: do not corrupt OpenSSH config with Match sections
- Resolves: #1282935 ipa upgrade causes vault internal error
- install: export KRA agent PEM file in ipa-kra-install
- Resolves: #1283429 Default CA ACL rule is not created during
ipa-replica-install
- TLS and Dogtag HTTPS request logging improvements
- Avoid race condition caused by profile delete and recreate
- Do not erroneously reinit NSS in Dogtag interface
- Add profiles and default CA ACL on migration
- disconnect ldap2 backend after adding default CA ACL profiles
- do not disconnect when using existing connection to check default CA ACLs
- Resolves: #1283430 ipa-kra-install: fails to apply updates
- suppress errors arising from adding existing LDAP entries during KRA
install
- Resolves: #1283748 Caching of ipaconfig does not work in framework
- fix caching in get_ipa_config
- Resolves: #1283943 IPA DNS Zone/DNS Forward Zone details missing after
upgrade from RHEL 7.0 to RHEL 7.2
- upgrade: fix migration of old dns forward zones
- Fix upgrade of forwardzones when zone is in realmdomains
- Resolves: #1284413 ipa-cacert-manage renew fails on nonexistent ldap
connection
- ipa-cacert-renew: Fix connection to ldap.
- Resolves: #1284414 ipa-otptoken-import fails on nonexistent ldap connection
- ipa-otptoken-import: Fix connection to ldap.
- Resolves: #1286635 IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using
"yum update ipa* sssd"
- Set minimal required version for openssl
- Resolves: #1286781 ipa-nis-manage does not update ldap with all NIS maps
- Upgrade: Fix upgrade of NIS Server configuration
- Resolves: #1289311 umask setting causes named-pkcs11 issue with directory
permissions on /var/lib/ipa/dnssec
- DNS: fix file permissions
- Explicitly call chmod on newly created directories
- Fix: replace mkdir with chmod
- Resolves: #1290142 Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
- Fix version comparison
- use FFI call to rpmvercmp function for version comparison
- Resolves: #1292595 In IPA-AD trust environment some secondary IPA based Posix
groups are missing
- ipa-kdb: map_groups() consider all results
- Resolves: #1293870 User should be notified for wrong password in password
reset page
- Fixed login error message box in LoginScreen page
- Resolves: #1296196 Sysrestore did not restore state if a key is specified in
mixed case
- Allow to used mixed case for sysrestore
- Resolves: #1296214 DNSSEC key purging is not handled properly
- DNSSEC: Improve error reporting from ipa-ods-exporter
- DNSSEC: Make sure that current state in OpenDNSSEC matches key state in
LDAP
- DNSSEC: Make sure that current key state in LDAP matches key state in BIND
- DNSSEC: remove obsolete TODO note
- DNSSEC: add debug mode to ldapkeydb.py
- DNSSEC: logging improvements in ipa-ods-exporter
- DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP
- DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
- DNSSEC: ipa-ods-exporter: add ldap-cleanup command
- DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removal
- DNSSEC: Log debug messages at log level DEBUG
- Resolves: #1296216 ipa-server-upgrade fails if certmonger is not running
- prevent crash of CA-less server upgrade due to absent certmonger
- always start certmonger during IPA server configuration upgrade
- Resolves: #1297811 The ipa -e skip_version_check=1 still issues
incompatibility error when called against RHEL 6 server
- ipalib: assume version 2.0 when skip_version_check is enabled
- Resolves: #1298289 install fails when locale is "fr_FR.UTF-8"
- Do not decode HTTP reason phrase from Dogtag
- Resolves: #1300252 shared certificateProfiles container is missing on a
freshly installed RHEL7.2 system
- upgrade: unconditional import of certificate profiles into LDAP
- Resolves: #1301674 --setup-dns and other options is forgotten for using an
external PKI
- installer: Propagate option values from components instead of copying them.
- installer: Fix logic of reading option values from cache.
- Resolves: #1301687 issues with migration from RHEL 6 self-signed to RHEL 7 CA
IPA setup
- ipa-ca-install: print more specific errors when CA is already installed
- cert renewal: import all external CA certs on IPA CA cert renewal
- CA install: explicitly set dogtag_version to 10
- fix standalone installation of externally signed CA on IPA master
- replica install: validate DS and HTTP server certificates
- replica install: improvements in the handling of CA-related IPA config
entries
- Resolves: #1301901 [RFE] compat tree: show AD members of IPA groups
- slapi-nis: update configuration to allow external members of IPA groups
- Resolves: #1305533 ipa trust-add succeded but after that ipa trust-find
returns "0 trusts matched"
- upgrade: fix config of sidgen and extdom plugins
- trusts: use ipaNTTrustPartner attribute to detect trust entries
- Warn user if trust is broken
- fix upgrade: wait for proper DS socket after DS restart
- Insure the admin_conn is disconnected on stop
- Fix connections to DS during installation
- Fix broken trust warnings
- Resolves: #1321092 Installers fail when there are multiple versions of the
same certificate
- certdb: never use the -r option of certutil
- Related: #1317381 Crash during IPA upgrade due to slapd
- spec file: update minimum required version of slapi-nis
- Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112
CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws
[rhel-7.3]
- Rebuild against newer Samba version
- RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
(#1169591)
- CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
(#1172578)
- Re-arrange doc and defattr to clean up rpmlint warnings
- Remove conditionals on older releases
- Move some man pages into admintools subpackage
- Remove some explicit Requires in client that aren't needed
- Consistent use of buildroot vs RPM_BUILD_ROOT
- Update to upstream 3.3.1 (#991064)
- Update minimum version of bind-dyndb-ldap to 3.5
- Remove release from krb5-server in strict sub-package to allow for rebuilds.
- Fix krb5-kdb-server -> krb5-kdb-version
Related: RHBZ#1700121
- Unified spec file
- Update to upstream 3.1.2
- CVE-2012-4546: Incorrect CRLs publishing
- CVE-2012-5484: MITM Attack during Join process
- CVE-2013-0199: Cross-Realm Trust key leak
- Updated strict dependencies to 389-ds-base = 1.3.0.2 and
pki-ca = 10.0.1
- IPA Replicate creation fails with error "Update failed! Status: [10 Total
update abortedLDAP error: Referral]" (#1166265)
- running ipa-server-install --setup-dns results in a crash (#1072502)
- DNS zones are not migrated into forward zones if 4.0+ replica is added
(#1175384)
- gid is overridden by uid in default trust view (#1168904)
- When migrating warn user if compat is enabled (#1177133)
- Clean up debug log for trust-add (#1168376)
- No error message thrown on restore(full kind) on replica from full backup
taken on master (#1175287)
- ipa-restore proceed even IPA not configured (#1175326)
- Data replication not working as expected after data restore from full backup
(#1175277)
- IPA externally signed CA cert expiration warning missing from log (#1178128)
- ipa-upgradeconfig fails in CA-less installs (#1181767)
- IPA certs fail to autorenew simultaneouly (#1173207)
- More validation required on ipa-restore's options (#1176034)
- Installer did not detect different server and IPA domain (#1026845)
- Allow kernel keyring CCACHE when supported (#1026861)
- Resolves: #1442233 IPA client commands fail when pointing to replica
- httpinstance: wait until the service entry is replicated
- Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
not indexed
- Fix index definition for ipaAnchorUUID
- Resolves: #1438016 gssapi errors after IPA server upgrade
- Avoid possible endless recursion in RPC call
- rpc: preparations for recursion fix
- rpc: avoid possible recursion in create_connection
- Resolves: #1446087 services entries missing krbCanonicalName attribute.
- Changing cert-find to do not use only primary key to search in LDAP.
- Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
- ipa-kdb: reload certificate mapping rules periodically
- Resolves: #1455541 after upgrade login from web ui breaks
- kdc.key should not be visible to all
- Resolves: #1435606 Add pkinit_indicator option to KDC configuration
- ipa-kdb: add pkinit authentication indicator in case of a successful
certauth
- Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
issuance when ipa-ca records are not resolvable
- Turn off OCSP check
- Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
server_del - TypeError: 'NoneType' object is not iterable
- fix incorrect suffix handling in topology checks
- Hardening for CVE-2020-25717
- Related: RHBZ#2019668
- Require python-wehjit >= 0.2.2
- Resolves: #837369 [RFE] Switch to client promotion to replica model
- Resolves: #1199516 [RFE] Move replication topology to the shared tree
- Resolves: #1206588 [RFE] Visualize FreeIPA server replication topology
- Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
- Resolves: #1212713 ipa-csreplica-manage: it could be nice to have also
list-ruv / clean-ruv / abort-clean-ruv for o=ipaca backend
- Resolves: #1267206 ipa-server-install uninstall should warn if no
installation found
- Resolves: #1295865 The Domain option is not correctly set in idmapd.conf when
ipa-client-automount is executed.
- Resolves: #1327092 URI details missing and OCSP-URI details are incorrectly
displayed when certificate generated using IPA on RHEL 7.2up2.
- Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
because of missing dependencies
- Related: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.3.1.201605191449GITf8edf37
- Update to upstream 4.6.90.pre1
- Resolves: #1355753 adding two way non transitive(external) trust displays
internal error on the console
- Always fetch forest info from root DCs when establishing two-way trust
- factor out `populate_remote_domain` method into module-level function
- Always fetch forest info from root DCs when establishing one-way trust
- Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
after `ipa-replica-install`
- Track lightweight CAs on replica installation
- Resolves: #1357488 ipa command stuck forever on higher versioned client with
lower versioned server
- compat: Save server's API version in for pre-schema servers
- compat: Fix ping command call
- schema cache: Store and check info for pre-schema servers
- Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
- Fix man page ipa-replica-manage: remove duplicate -c option
from --no-lookup
- Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
when revoking certificate
- cert: include CA name in cert command output
- WebUI add support for sub-CAs while revoking certificates
- Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
- Add support for additional options taken from table facet
- WebUI: Fix showing certificates issued by sub-CA
- Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
internactively
- dns: normalize record type read interactively in dnsrecord_add
- dns: prompt for missing record parts in CLI
- dns: fix crash in interactive mode against old servers
- Resolves: #1370519 Certificate revocation in service-del and host-del isn't
aware of Sub CAs
- cert: fix cert-find --certificate when the cert is not in LDAP
- Make host/service cert revocation aware of lightweight CAs
- Resolves: #1371901 Use OAEP padding with custodia
- Use RSA-OAEP instead of RSA PKCS#1 v1.5
- Resolves: #1371915 When establishing external two-way trust, forest root
Administrator account is used to fetch domain info
- do not use trusted forest name to construct domain admin principal
- Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
certificate request
- Fix CA ACL Check on SubjectAltNames
- Resolves: #1373272 CLI always sends default command version
- cli: use full name when executing a command
- Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
- Fix ipa-certupdate for CA-less installation
- Resolves: #1373540 client-install with IPv6 address fails on link-local
address (always)
- Fix parse errors with link-local addresses
- man page: update ipa-server-upgrade.1
Resolves: RHBZ#1973273
- Fall back to krbprincipalname when validating host auth indicators
Resolves: RHBZ#1979625
- Add dependency for sssd-winbind-idmap to server-trust-ad
Resolves: RHBZ#1982211
- Fix replica installation failing on certificate subject (#983075)
- Rebase ipa to 4.9.11
Resolves: RHBZ#2141316
- updates: fix memberManager ACI to allow managers from a specified group
Resolves: RHBZ#2056009
- Defer creating the final krb5.conf on clients
Resolves: RHBZ#2148259
- Exclude installed policy module file from RPM verification
Resolves: RHBZ#2149567
- Spec file: ipa-client depends on krb5-pkinit-openssl
Resolves: RHBZ#2149889
- When IdM server trusts multiple AD forests, IPA client returns invalid group
membership info (#1079498)
- IPA server in debug mode fails to run because time.perf_counter_ns is
Python 3.7+
Resolves: RHBZ#1974822
- Add checks to prevent assigning authentication indicators to internal IPA
services
Resolves: RHBZ#1979625
- Unable to set ipaUserAuthType with stageuser-add
Resolves: RHBZ#1979605
- Replica installation fails for RHEL 6.4 master (#1004680)
- Server uninstallation crashes if DS is not available (#998069)
- Updated to upstream 3.1.0 GA
- Set minimum for sssd to 1.9.2
- Set minimum for pki-ca to 10.0.0-1
- Set minimum for 389-ds-base to 1.3.0
- Set minimum for selinux-policy to 3.11.1-60
- Remove unneeded dogtag package requires
- Updated to upstream 3.0.0 rc 1
- Update BR for 389-ds-base to 1.2.11.14
- Update BR for krb5 to 1.10
- Update BR for samba4-devel to 4.0.0-139 (rc1)
- Add BR for python-polib
- Update BR and Requires on sssd to 1.9.0
- Update Requires on policycoreutils to 2.1.12-5
- Update Requires on 389-ds-base to 1.2.11.14
- Update Requires on selinux-policy to 3.11.1-21
- Update Requires on dogtag to 10.0.0-0.33.a1
- Update Requires on certmonger to 0.60
- Update Requires on tomcat to 7.0.29
- Update minimum version of bind to 9.9.1-10.P3
- Update minimum version of bind-dyndb-ldap to 1.1.0-0.16.rc1
- Remove Requires on authconfig from python sub-package
- Update Requires on krb5-server to 1.11
- Moved directory install/static to install/ui
- Fix ipa-pwd-extop global configuration caching (#1187342)
- group-detach does not add correct objectclasses (#1187540)
- Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
- Keep NSS trust flags of existing certificates
- Resolves: #1360813 ipa-server-certinstall does not update all certificate
stores and doesn't set proper trust permissions
- Add cert checks in ipa-server-certinstall
- Resolves: #1371479 cert-find --all does not show information about revocation
- cert: add revocation reason back to cert-find output
- Resolves: #1375133 WinSync users who have First.Last casing creates users who
can have their password set
- ipa passwd: use correct normalizer for user principals
- Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
- Properly handle LDAP socket closures in ipa-otpd
- Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
- Make httpd publish its CA certificate on DL1
- ipatests: remove additional check for failed units.
Resolves: RHBZ#2053024
- ipa-cldap: fix memory leak.
Resolves: RHBZ#2032738
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Resolves: #1382053 Need to have validation for idrange names
- idrange-add: properly handle empty --dom-name option
- Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
helper when installing replica
- dsinstance: reconnect ldap2 after DS is restarted by certmonger
- httpinstance: avoid httpd restart during certificate request
- dsinstance, httpinstance: consolidate certificate request code
- install: request service certs after host keytab is set up
- renew agent: revert to host keytab authentication
- renew agent, restart scripts: connect to LDAP after kinit
- Resolves: #1436987 ipasam: gidNumber attribute is not created in the trusted
domain entry
- ipa-sam: create the gidNumber attribute in the trusted domain entry
- Upgrade: add gidnumber to trusted domain entry
- Resolves: #1438679 [ipa-replica-install] - IncorrectPasswordException:
Incorrect client security database password
- Add pki_pin only when needed
- Resolves: #1438348 Console output message while adding trust should be
mapped with texts changed in Samba.
- ipaserver/dcerpc: unify error processing
- Resolves: #1438366 ipa trust-fetch-domains: ValidationError: invalid
'Credentials': Missing credentials for cross-forest communication
- trust: always use oddjobd helper for fetching trust information
- Resolves: #1441192 Add the name of URL parameter which will be check for
username during cert login
- WebUI: cert login: Configure name of parameter used to pass username
- Resolves: #1437879 [copr] Replica install failing
- Create system users for FreeIPA services during package installation
- Resolves: #1441316 WebUI cert auth fails after ipa-adtrust-install
- Fix s4u2self with adtrust
- Require samba 4.14.5-13 with IPA DC server role fixes
- Related: RHBZ#2021443
- Update to upstream 3.2.2
- Drop ipa-server-selinux subpackage
- Drop redundant directory /var/cache/ipa/sessions
- Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
- Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
issues when there are still old parts of software (like entitlements plugin)
- Version bump for release
- Add versioned dependency of samba-client-libs to ipa-server
- Related: RHBZ#2021443
- Upstream release FreeIPA 4.8.7
- Require new samba build 4.12.3-0
Related: RHBZ#1818765
- New client-epn sub package
Resolves: RHBZ#913799
ipa-client-common-4.9.13-20.module+el8.10.0+2067+377bdd64.noarch.rpm | - Resolves: #846033 [RFE] Documentation for JSONRPC IPA API
- Resolves: #989091 Ability to manage IdM/IPA directly from a standard LDAP
client
- Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
users in IdM
- Resolves: #1115294 [RFE] Add support for DNSSEC
- Resolves: #1145748 [RFE] IPA running with One Way Trust
- Resolves: #1199520 [RFE] Introduce single upgrade tool - ipa-server-upgrade
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Resolves: #1200728 [RFE] Replicate PKI Profile information
- Resolves: #1200735 [RFE] Allow issuing certificates for user accounts
- Resolves: #1204054 SSSD database is not cleared between installs and
uninstalls of ipa
- Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
Trusts
- Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
- Resolves: #1204504 [RFE] Add access control so hosts can create their own
services
- Resolves: #1206534 [RFE] Offer Kerberos over HTTP (kdcproxy) by default
- Resolves: #1206613 [RFE] Configure IPA to be a trust agent by default
- Resolves: #1209476 package ipa-client does not require package dbus-python
- Resolves: #1211589 [RFE] Add option to skip the verify_client_version
- Resolves: #1211608 [RFE] Generic support for unknown DNS RR types (RFC 3597)
- Resolves: #1215735 ipa-replica-prepare automatically adds a DNS zone
- Resolves: #1217010 OTP Manager field is not exposed in the UI
- Resolves: #1222475 krb5kdc : segfault at 0 ip 00007fa9f64d82bb sp
00007fffd68b2340 error 6 in libc-2.17.so
- Related: #1204809 Rebase ipa to 4.2
- Update to upstream 4.2.0
- Move /etc/ipa/kdcproxy to the server subpackage
- Hardening for CVE-2020-25717
- Rebuild against samba-4.14.5-11.el8
- Resolves: RHBZ#2021443
- PKI database is ugraded during replica installation (#1075118)
- Resolves: #1254689 Storing big file as a secret in vault raises traceback
- vault: Limit size of data stored in vault
- Resolves: #1255880 ipactl status should distinguish between different
pki-tomcat services
- ipactl: Do not start/stop/restart single service multiple times
- Upstream pre release FreeIPA 4.9.0rc3
Related: RHBZ#1891832
- Updated to upstream 3.0.0 GA
- Set minimum for samba to 4.0.0-153.
- Make sure server-trust-ad subpackage alternates winbind_krb5_locator.so
plugin to /dev/null since they cannot be used when trusts are configured
- Restrict krb5-server to 1.10.
- Update BR for 389-ds-base to 1.3.0
- Add directory /var/lib/ipa/pki-ca/publish for CRL published by pki-ca
- Add Requires on zip for generating FF browser extension
- Resolves: #1614301 Remove --no-sssd and --noac options
- Resolves: #1613879 Disable Domain Level 0
- New patch sets to disable domain level 0
- New adapted patch to disable DL0 specific tests (pytest_ipa vs.
pytest_plugins)
- Adapted branding patch in ipa-replica-install.1 due to DL0 removal
- Set mode of /etc/ipa/ca.crt to 0644 in CA-less installations
Resolves: RHBZ#1870202
- Resolves: #1475238 Use CommonNameToSANDefault in default profile
(new installs only)
- Restore old version of caIPAserviceCert for upgrade only
- Remove ipa-server-selinux obsoletes as upgrades from version prior to
3.3.0 are not allowed
- Wrap server-trust-ad subpackage description better
- Add (noreplace) flag for %{_sysconfdir}/tmpfiles.d/ipa.conf
- Change permissions on default_encoding_utf8.so to fix ipa-python Provides
- Use default crypto policy for TLS and enable TLS 1.3 support
Resolves: RHBZ#1777809
- Covscan fixes
Resolves: RHBZ#1777920
- Change pki_version to 10.8.0
Related: RHBZ#1748987
- Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
- Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
- Related: #1356134 'kinit -E' does not work for IPA user
- Add bash completion script and own /etc/bash_completion.d in case it
doesn't already exist
- Bump up minimum version of python-nss to pick up nss_is_initialize() API
- Updated to upstream 3.0.0 beta 1
- Resolves: #1416454 replication race condition prevents IPA to install
- wait_for_entry: use only DN as parameter
- Wait until HTTPS principal entry is replicated to replica
- Use proper logging for error messages
- Unable to remove replica by ipa-replica-manage (#1001662)
- Before uninstalling a server, warn about active replicas (#998069)
- Move initialization of Guests mapping after cifs/ principal is created
- Related: rhbz#1623895
- Upstream release FreeIPA 4.9.1
Related: RHBZ#1891832
- Fix mapping of BUILTIN\Guests to 'nobody' group during upgrade
to not use generated Samba config at this point
- Related: rhbz#1623895
- Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
- Increase default timeout for IPA services (#1033273)
- Error while running trustdomain-find (#1054376)
- group-show lists SID instead of name for external groups (#1054391)
- Fix IPA server NetBIOS name in samba configuration (#1030517)
- dnsrecord-mod produces missing API version warning (#1054869)
- Hide trust-resolve command as internal (#1052860)
- Add Trust domain Web UI (#1054870)
- ipasam cannot delete multiple child trusted domains (#1056120)
- Require 389-ds-base-legacy-tools for setup tools
- ipatests: Update ipa-adtrust-install test
Resolves: RHEL-40894
- Conditionally restart also dirsrv and httpd when upgrading
- IPA extdom plugin fails when encountering large groups (#1193759)
- CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
(#1202998)
- Added auto* BuildRequires
- Added httpd SELinux policy so CRLs can be read
- Revert DNSResolver Fix use of nameservers with ports.
Related: RHBZ#2141316
- Fix NetBIOS name generation in CLDAP plugin (#1030517)
- ipa-kdb: Fix double free in ipadb_reinit_mspac()
Resolves: RHEL-25742
- kra: set RSA-OAEP as default wrapping algo when FIPS is enabled
Resolves: RHEL-12153
- Vault: improve vault server archival/retrieval calls error handling
Resolves: RHEL-12153
- Vault: add support for RSA-OAEP wrapping algo
Resolves: RHEL-12153
- Fix postin scriplet for F-15/F-16
- Deletion of active subdomain range should not be allowed (#1075615)
- Fallback to global policy in ipa lockout plugin (#912725)
- Migration does not add users to default group (#903232)
- ipa-kdb: Make AD-SIGNEDPATH optional with krb5 DAL 8 and older
Resolves: RHEL-12198
- Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
tracked
- cert renewal: Include KRA users in Dogtag LDAP update
- cert renewal: Automatically update KRA agent PEM file
- Resolves: #1257163 renaming certificatte profile with --rename option leads
to integrity issues
- certprofile: remove 'rename' option
- Resolves: #1257968 kinit stop working after ipa-restore
- Backup: back up the hosts file
- Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
- DNSSEC: remove "DNSSEC is experimental" warnings
- Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
- Installer: do not modify /etc/hosts before user agreement
- Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
zone
- DNSSEC: backup and restore opendnssec zone list file
- DNSSEC: remove ccache and keytab of ipa-ods-exporter
- DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
- DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
- DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
key master
- DNSSEC: Fix key metadata export
- DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
- Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
- Using LDAPI to setup CA and KRA agents.
- Resolves: #1259848 server closes connection and refuses commands after
deleting user that is still logged in
- ldap: Make ldap2 connection management thread-safe again
- Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
'ra_certprofile' while ipa-ca-install
- load RA backend plugins during standalone CA install on CA-less IPA master
- Remove dependency on nss_ldap/nss-pam-ldapd
- The official client is sssd and that's what we use by default.
- Resolves: #1461177 ipa-otptoken-import - XML file is missing PBKDF2
parameters!
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
search in cn=ad, cn=trusts,dc=example,dc=com
- Resolves: #1467887 iommu platform support for ipxe
- Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic key for
host
- Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
4.5
- Resolves: #1480102 ipa-server-upgrade failes with "This entry already
exists"
- Resolves: #1482802 Unable to set ca renewal master on replica
- Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
(ipa-server-upgrade)
- Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
thus startup of Web UI fails
- Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
to self-signed CA
- Resolves: #1469246 Replica install fails to configure IPA-specific
temporary files/directories
- Resolves: #1469480 bind package is not automatically updated during
ipa-server upgrade process
- Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
installs only)
- Resolves: #1477703 IPA upgrade fails for latest ipa package
- Prevent multilib failures in *.pyo and *.pyc files
- Update dependencies for samba, 389-ds and sssd
Resolves: RHBZ#1792848
- Remove v1-style /etc/ipa/ipa.conf, replacing with /etc/ipa/default.conf
- Removed python-asset based webui
- Improve server affinity for CA-less deployments
Resolves: RHEL-22283
- host: update system: Manage Host Keytab permission
Resolves: RHEL-22286
- adtrustinstance: make sure NetBIOS name defaults are set properly
Resolves: RHEL-21938
- ipatests: Fix healthcheck report when nsslapd accesslog logbuffering is set to off
Resolves: RHEL-19672
- Resolves: #1377973 ipa-server-install fails when the provided or resolved
IP address is not found on local interfaces
- Only warn when specified server IP addresses don't match intf
- Resolves: #1438016 gssapi errors after IPA server upgrade
- Bump version of python-gssapi
- Resolves: #1457942 certauth: use canonical principal for lookups
- ipa-kdb: use canonical principal in certauth plugin
- Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
breaking older clients
- Add code to be able to set default kinit lifetime
- Revert setting sessionMaxAge for old clients
- Add missing entry for /var/cache/ipa/kpasswd (444624)
- Added patch to fix permissions problems with the Apache NSS database.
- Added patch to fix problem with DNS querying where the query could be
returned as the answer.
- Fix spec error where patch1 was in the wrong section
- Update to upstream 3.3.3 (#991064)
- Rebuild against samba4 beta7
- [WebUI] IPA Error 3007: RequirmentError" while adding members in
"User ID overrides" tab (updated)
Resolves: RHBZ#1757045
- ipa-client-install: use the authselect backup during uninstall
Resolves: RHBZ#1810179
- Replace SSLCertVerificationError with CertificateError for py36
Resolves: RHBZ#1858318
- Fix AVC denial during ipa-adtrust-install --add-agents
Resolves: RHBZ#1859213
- ipa-server-install fails if --subject parameter is other than default
realm (#983075)
- do not allow configuring bind-dyndb-ldap without persistent search (#967876)
- Lockout plugin crashed during ipa-server-install (#912725)
- Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
- ldap: limit the retro changelog to dns subtree
- Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
of "CA:FALSE" IPA CA CSR
- Include the CA basic constraint in CSRs when renewing a CA
- Resolves: #1493145 ipa-replica-install might fail because of an already
existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
- Checks if replica-s4u2proxy.ldif should be applied
- Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
- ds: ignore time skew during initial replication step
- ipa-replica-manage: implicitly ignore initial time skew in force-sync
- Resolves: #1500218 Replica installation at domain-level 0 fails against
upgraded ipa-server
- Fix ipa-replica-conncheck when called with --principal
- Resolves: #1506188 server-del doesn't remove dns-server configuration
from ldap
- Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
- Fix an integer underflow bug in libotp
- Resolves: #1262996 ipa vault internal error on replica without KRA
- install: always export KRA agent PEM file
- vault: select a server with KRA for vault operations
- Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
- do not overwrite files with local users/groups when restoring authconfig
- Renamed patch 1011 to 0138, as it was merged upstream
- Resolves: #1469246 Replica install fails to configure IPA-specific
temporary files/directories
- replica install: drop-in IPA specific config to tmpfiles.d
- Resolves: #1469480 bind package is not automatically updated during
ipa-server upgrade process
- Bumped Required version of bind-dyndb-ldap and bind package
- Set minimum version of sssd to 1.5.1
- Update to upstream freeipa-2.0.0.rc1
- Move server-only binaries from admintools subpackage to server
- Resolves: #1455946 Provide a tooling automating the configuration
of Smart Card authentication on a FreeIPA master
- smart-card advises: configure systemwide NSS DB also on master
- smart-card advises: add steps to store smart card signing CA cert
- Allow to pass in multiple CA cert paths to the smart card advises
- add a class that tracks the indentation in the generated advises
- delegate the indentation handling in advises to dedicated class
- advise: add an infrastructure for formatting Bash compound statements
- delegate formatting of compound Bash statements to dedicated classes
- Fix indentation of statements in Smart card advises
- Use the compound statement formatting API for configuring PKINIT
- smart card advises: use a wrapper around Bash `for` loops
- smart card advise: use password when changing trust flags on HTTP cert
- smart-card-advises: ensure that krb5-pkinit is installed on client
- Resolves: #1475238 Use CommonNameToSANDefault in default profile
(new installs only)
- Add CommonNameToSANDefault to default cert profile
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s
during search in cn=ad,cn=trusts,dc=example,dc=com
- NULL LDAP context in call to ldap_search_ext_s during search
- Fixed share/ipa/wsgi.py so .pyc, .pyo files are included
- No need to create /var/log/ipa_error.log since we aren't using
TurboGears any more.
- Update to upstream 2.1.0
- Upstream pre release FreeIPA 4.9.0rc2
Related: RHBZ#1891832
- Synchronize spec file with upstream and Fedora
Related: RHBZ#1891832
- Traceback while doing ipa-backup
Resolves: RHBZ#1901068
- ipa-client-install changes system wide ssh configuration
Resolves: RRBZ#1544379
- ipa-kdb: support subordinate/superior UPN suffixes
Resolves: RHBZ#1891056
- KRA Transport and Storage Certificates do not renew
Resolves: RHBZ#1872603
- Move where the restore state is marked during IPA server upgrade
Resolves: RHBZ#1569011
- Intermittent IdM Client Registration Failures
Resolves: RHBZ#1812871
- Nightly test failure in test_acme.py::TestACME::test_third_party_certs
(updates-testing)
Resolves: RHBZ#1903025
- Add IPA RA Agent to ACME group on the CA
Resolves: RHBZ#1902727
- Resolves: #1356102 Server uninstall does not stop tracking lightweight sub-CA
with certmonger
- uninstall: untrack lightweight CA certs
- Resolves: #1351807 ipa-nis-manage config.get_dn missing
- ipa-nis-manage: Use server API to retrieve plugin status
- Resolves: #1353452 ipa-compat-manage command failed,
exception: NotImplementedError: config.get_dn()
- ipa-compat-manage: use server API to retrieve plugin status
- Resolves: #1353899 ipa-advise: object of type 'type' has no len()
- ipa-advise: correct handling of plugin namespace iteration
- Resolves: #1356134 'kinit -E' does not work for IPA user
- kdb: check for local realm in enterprise principals
- Resolves: #1353072 ipa unknown command vault-add
- Enable vault-* commands on client
- vault-add: set the default vault type on the client side if none was given
- Resolves: #1353995 Default CA can be used without a CA ACL
- caacl: expand plugin documentation
- Resolves: #1356144 host-find should not print SSH keys by default, only
SSH fingerprints
- host-find: do not show SSH key by default
- Resolves: #1353506 ipa migrate-ds command fails for IPA in RHEL 7.3
- Removed unused method parameter from migrate-ds
- Expand the token auth/sync windows (#919228)
- Access is not rejected for disabled domain (#1172598)
- krb5kdc crash in ldap_pvt_search (#1170695)
- RHEL7.1 IPA server httpd avc denials after upgrade (#1164896)
- Ensure that /etc/ipa exists before moving user-modifiable html files there
- Put html files into /etc/ipa/html instead of /etc/ipa
- Replica CA installation: ignore skew during initial replication
Resolves RHEL-80995
- Update to upstream version 1.1.0
- Patch for indexing memberof attribute
- Patch for indexing uidnumber and gidnumber
- Patch to change DNA default values for replicas
- Patch to fix uninitialized variable in ipa-getkeytab
- Fix --external-ca-profile not passed to CSR
Resolves: RHBZ#1731813
- Upgrade: fix replica agreement, fix backported patch
Related: RHBZ#2216551
- Enforce uniqueness across krbprincipalname and krbcanonicalname
ipa-kdb: enforce PAC presence on TGT for TGS-REQ
ipatests: extend test for unique krbcanonicalname
Resolves: RHEL-110061
- Resolve: #1455946 Provide a tooling automating the configuration
of Smart Card authentication on a FreeIPA master
- server certinstall: update KDC master entry
- pkinit manage: introduce ipa-pkinit-manage
- server upgrade: do not enable PKINIT by default
- Extend the advice printing code by some useful abstractions
- Prepare advise plugin for smart card auth configuration
- Resolve: #1461053 allow to modify list of UPNs of a trusted forest
- trust-mod: allow modifying list of UPNs of a trusted forest
- WebUI: add support for changing trust UPN suffixes
- Rebuilt for glibc bug#747377
- Update to upstream freeipa-2.0.0.rc2
- Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
- Set minimum version of sssd to 1.5.1
- Patch to include SuiteSpotGroup when setting up 389-ds instances
- Move a lot of BuildRequires so this will build with ONLY_CLIENT enabled
- Added support for ipa_kpasswd and ipa_pwd_extop
- Rebase to upstream release 4.8.4
- Removed upstream patches 0001 to 0008 that are part of version 4.8.3-3
Resolves: RHBZ#1782658
Resolves: RHBZ#1782169
Resolves: RHBZ#1783046
Related: RHBZ#1748987
- Update to upstream GA release
- Automatically apply updates when the package is upgraded
- Remove ipa_webgui, its functions rolled into ipa_httpd
- kdb: keeep ipadb_get_connection() from succeding with null LDAP context
Resolves: RHEL-58453
- CVE-2019-14867: Denial of service in IPA server due to wrong use of ber_scanf()
Resolves: RHBZ#1767304
- CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
Resolves: RHBZ#1776939
- Removed python-cherrypy from BuildRequires and Requires
- Added Requires python-assets, python-wehjit
- Resolves: #1609883 ipaserver/plugins/cert.py: Add reason to raise of
errors.NotFound
- Resolves: #1615765 do-not-use-RC4-in-FIPS-mode
- Move fips_enabled to a common library to share across different plugins
- ipasam: do not use RC4 in FIPS mode
- Marked with wrong license. IPA is GPLv2.
- Update to upstream 3.2.0 Prerelease 1
- Use upstream reference spec file as a base for Fedora spec file
- Change Requires from fedora-ds-base to 389-ds-base
- Set minimum level of 389-ds-base to 1.2.6 for the replication
version plugin.
- Resolves: #747612 [RFE] IPA should support and manage DNS sites
- Resolves: #826790 Disabling password expiration (--maxlife=0 and --minlife=0)
in the default global_policy in IPA sets user's password expiration
(krbPasswordExpiration) to be 90 days
- Resolves: #896699 ipa-replica-manage -H does not delete DNS SRV records
- Resolves: #1084018 [RFE] Add IdM user password change support for legacy
client compat tree
- Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
aliases)
- Fix incorrect check for principal type when evaluating CA ACLs
- Resolves: #1146860 [RFE] Offer OTP generation for host enrollment in the UI
- Resolves: #1238190 ipasam unable to lookup group in directory yet manual
search works
- Resolves: #1250110 search by users which don't have read rights for all attrs
in search_attributes fails
- Resolves: #1263764 Show Certificate displays in useless format
- Resolves: #1272491 [WebUI] Certificate action dropdown does not display all
the options after adding new certificate
- Resolves: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.4.0
- Resolves: #1294503 IPA fails to issue 3rd party certs
- Resolves: #1298242 [RFE] API compatibility - compatibility of clients
- Resolves: #1298848 [RFE] Centralized topology management
- Resolves: #1298966 [RFE] Extend Smart Card support
- Resolves: #1315146 Multiple clients cannot join domain simultaneously:
/var/run/httpd/ipa/clientcaches race condition?
- Resolves: #1318903 ipa server install failing when SUBCA signs the cert
- Resolves: #1319003 ipa-winsync-migrate: Traceback should be fixed with proper
console output
- Resolves: #1324055 IPA always qualify requests for admin
- Resolves: #1328552 [RFE] Allow users to authenticate with alternative names
- Resolves: #1334582 Inconsistent UI and CLI options for removing certificate
hold
- Resolves: #1346321 Exclude o=ipaca subtree from Retro Changelog (syncrepl)
- Resolves: #1349281 Fix `Conflicts` with ipa-python
- Resolves: #1350695 execution of copy-schema script fails
- Resolves: #1351118 upgrade failed for RHEL-7.3 from RHEL-7.2.z
- Resolves: #1351153 AVC seen on Replica during ipa-server upgrade test
execution to 7.3
- Resolves: #1351276 ipa-server-install with dns cannot resolve itself to
create ipa-ca entry
- Related: #1343422 [RFE] Add GssapiImpersonate option
- Pull upstream changelog 698
- Fix ownership of /var/log/ipa_error.log during install (435119)
- Add pwpolicy command and man page
- Fix requirement for python3-kdcproxy, add no autoreqprov for ipatests sub
package
Related: RHBZ#1891832
- ipa-csreplica-manage connect fails (#1157735)
- error message which is not understandable when IDNA2003 characters are
present in --zonemgr (#1163849)
- Fix warning message should not contain CLI commands (#1114013)
- Renewing the CA signing certificate does not extend its validity period end
(#1163498)
- RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
httpd (#1159330)
- Make sure ipa-server depends on krb5-kdb-version to pick up
right MIT Kerberos KDB ABI
Related: RHBZ#1700121
- User field separator uses '$$' within ipaSELInuxUserMapOrder
Fixes: RHBZ#1729099
- Require the Python interpreter directly instead of using the package name
- Related: rhbz#1619153
- DNS install check: Fix overlapping DNS zone from the master itself
Resolves: RHBZ#1784003
- Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
Trusts
- winsync-migrate: Convert entity names to posix friendly strings
- winsync-migrate: Properly handle collisions in the names of external groups
- Resolves: #1261074 Adjust Firefox configuration to new extension signing
policy
- webui: use manual Firefox configuration for Firefox >= 40
- Resolves: #1263337 IPA Restore failed with installed KRA
- ipa-backup: Add mechanism to store empty directory structure
- Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
and private key in world readable file [rhel-7.2]
- install: fix KRA agent PEM file permissions
- Resolves: #1265086 Mark IdM API Browser as experimental
- WebUI: add API browser is experimental warning
- Resolves: #1265277 Fix kdcproxy user creation
- install: create kdcproxy user during server install
- platform: add option to create home directory when adding user
- install: fix kdcproxy user home directory
- Resolves: #1265559 GSS failure after ipa-restore
- destroy httpd ccache after stopping the service
- Resolves: #1432630 python2-jinja2 needed for python2-ipaclient
- Remove csrgen
- Resolves: #1432903 Set GssProxy options to enable caching of ldap tickets
- Add options to allow ticket caching
- Update to upstream version 1.2.0
- Set fedora-ds-base minimum version to 1.1.3 for winsync header
- Set the minimum version for SELinux policy
- Remove references to Fedora 7
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650139
- Added support for libipa-dna-plugin
- Rebuild to samba 4.17.2.
Related: RHBZ#2132051
- Update to upstream 4.7.0 GA
- ipatests: fix TestOTPToken::test_check_otpd_after_idle_timeout
Related: RHBZ#2053024
- Resolves: #1477703 IPA upgrade fails for latest ipa package
- Restore old version of caIPAserviceCert for upgrade only
- Reinstalling ipa server hangs when configuring certificate
server (#1018804)
- Allow longer dirsrv startup with systemd:
- IPAdmin class will wait until dirsrv instance is available up to 10 seconds
- Helps with restarts during upgrade for ipa-ldap-updater
- Fix pylint warnings from F16 and Rawhide
- selinux don't audit rules deny fetching trust topology
Resolves: RHBZ#1845596
- fix iPAddress cert issuance for >1 host/service
Resolves: RHBZ#1846352
- Specify cert_paths when calling PKIConnection
Resolves: RHBZ#1849155
- Update crypto policy to allow AD-SUPPORT when installing IPA
Resolves: RHBZ#1851139
- Add version to ipa-idoverride-memberof obsoletes
Related: RHBZ#1846434
- Resolves: #1365858 ipa-ca-install fails on replica when IPA Master is
installed without CA
- Set up DS TLS on replica in CA-less topology
- Resolves: #1398600 IPA replica install fails with dirsrv errors.
- Do not configure PKI ajp redirection to use "::1"
- Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
ca-del, ca-disable and ca-enable commands
- ca: correctly authorise ca-del, ca-enable and ca-disable
- Rebuild for Python 2.6
- Allow ipa-tests to work with older version (1.7.7) of python-paramiko
- Resolves: #1477367 ipa-server-upgrade timeouts on wait_for_open ports
expecting IPA services listening on IPv6 ports
- Make sure upgrade also checks for IPv6 stack
- control logging of host_port_open from caller
- log progress of wait_for_open_ports
- Resolves: #1477243 ipa help command returns traceback when no cache
is present
- Store help in Schema before writing to disk
- Disable pylint in get_help function because of type confusion.
- Require samba packages instead of obsoleted samba4 packages
- Fixed License in specfile
- Include files from /usr/lib/python*/site-packages/ipaserver
- Set the N-V-R so rc1 is an update to beta2.
- Resolves: #1452216 Replica installation grants HTTP principal
access in WebUI
- Make sure we check ccaches in all rpcserver paths
- Mass rebuild 2013-12-27
- Drop Requires of python-krbV on ipa-client
- Resolves: #828866 [RFE] enhance --subject option for ipa-server-install
- Resolves: #1160555 ipa-server-install: Cannot handle double hyphen "--" in
hostname
- Resolves: #1286288 Insufficient 'write' privilege to the 'ipaExternalMember'
attribute
- Resolves: #1321652 ipa-server-install fails when using external certificates
that encapsulate RDN components in double quotes
- Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
revocation reasons
- Resolves: #1340880 ipa-server-install: improve prompt on interactive
installation
- Resolves: #1353841 ipa-replica-install fails to install when resolv.conf
incomplete entries
- Resolves: #1356104 cert-show command does not display Subject Alternative
Names
- Resolves: #1357511 Traceback message seen when ipa is provided with invalid
configuration file name
- Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
converted from CA-less to CA-full
- Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
- Resolves: #1367572 improve error message in ipa migrate-ds: mention ipa
config-mod --enable-migration=TRUE
- Resolves: #1367868 Add options to retrieve lightweight CA certificate/chain
- Resolves: #1371927 Implement ca-enable/disable commands.
- Resolves: #1372202 Add Users into User Group editors fails to show Full names
- Resolves: #1373091 Adding an auth indicator from the CLI creates an extra
check box in the UI
- Resolves: #1375596 Ipa-server WebUI - long user/group name show wrong error
message
- Resolves: #1375905 "Normal" group type in the UI is confusing
- Resolves: #1376040 IPA client ipv6 - invalid --ip-address shows traceback
- Resolves: #1376630 IDM admin password gets written to
/root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
- Resolves: #1376729 ipa-server-install script option --no_hbac_allow should
match other options
- Resolves: #1378461 IPA Allows Password Reuse with History value defined when
admin resets the password.
- Resolves: #1379029 conncheck failing intermittently during single step
replica installs
- Resolves: #1379858 [RFE] better debugging for ipa-replica-conncheck
- Resolves: #1384310 ipa dnsrecord-add fails with Keyerror stack trace
- Resolves: #1392778 Update man page for ipa-adtrust-install by
removing --no-msdcs option
- Resolves: #1392858 Rebase to FreeIPA 4.5+
- Rebase to 4.5.0
- Resolves: #1399133 Delete option shouldn't be available for hosts applied to
view.
- Resolves: #1399190 [RFE] Certificates issued by externally signed IdM CA
should contain full trust chain
- Resolves: #1400416 RFE: Provide option to take backup of IPA server before
uninstalling IPA server
- Resolves: #1400529 cert-request is not aware of Kerberos principal aliases
- Resolves: #1401526 IPA WebUI certificates are grayed out on overview page but
not on details page
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- Resolves: #1404750 ipa-client-install fails to get CA cert via LDAP when
non-FQDN name of IPA server is first in /etc/hosts
- Resolves: #1409628 [RFE] Semi-automatic integration with external DNS using
nsupdate
- Resolves: #1413742 Backport request for bug/issue Change IP address
validation errors to warnings
- Resolves: #1415652 IPA replica install log shows password in plain text
- Resolves: #1427897 different behavior regarding system wide certs in master
and replica.
- Resolves: #1430314 The ipa-managed-entries command failed, exception:
AttributeError: ldap2
- Throw zonemgr error message before installation proceeds (#1163849)
- Winsync: Setup is broken due to incorrect import of certificate (#1169867)
- Enable last token deletion when password auth type is configured (#919228)
- ipa-otp-lasttoken loads all user's tokens on every mod/del (#1166641)
- add --hosts and --hostgroup options to allow/retrieve keytab methods
(#1007367)
- Extend host-show to add the view attribute in set of default attributes
(#1168916)
- Prefer TCP connections to UDP in krb5 clients (#919228)
- [WebUI] Not able to unprovisioning service in IPA 4.1 (#1168214)
- webui: increase notification duration (#1171089)
- RHEL7.1 ipa automatic CA cert renewal stuck in submitting state (#1166931)
- RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
(#1170003)
- Improve validation of --instance and --backend options in ipa-restore
(#951581)
- RHEL7.1 ipa replica unable to replicate to rhel6 master (#1167964)
- Disable TLS 1.2 in nss.conf until mod_nss supports it (#1156466)
- Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
error observed during ipa upgrade with latest package.
- ipa-server-install: fix uninstall
- Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
replica
- ca install: merge duplicated code for DM password
- installutils: add DM password validator
- ca, kra install: validate DM password
- Rebase to upstream release 4.8.2
- Removed upstream patches 0001 to 0010 that are part of version 4.8.2
- Updated branding patch
Resolves: RHBZ#1748987
- Update dependency for bind-dndb-ldap to 11.2-2
Related: RHBZ#1762813
- Upstream release FreeIPA 4.9.5
Related: RHBZ#1945038
- IPA to allow setting a new range type
Resolves: RHBZ#1688267
- ipa-server-install displays debug output when --debug output is not
specified.
Resolves: RHBZ#1943151
- ACME fails to generate a cert on migrated RHEL8.4 server
Resolves: RHBZ#1934991
- Switch ipa-client to use the JSON API
Resolves: RHBZ#1937856
- IDM - Allow specifying permanent logging settings for BIND
Resolves: RHBZ#1951511
- Cache LDAP data within a request
Resolves: RHBZ#1953656
- ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4
Resolves: RHBZ#1957768
- Rebuild for broken deps
- Fix 389-ds-base strict dep to be 1.3.0.5 and krb5-server 1.11.1
- Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
- Re-adding existing trust fails (#1033216)
- IPA uninstall exits with a samba error (#1033075)
- Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
- Fixed ownership of /usr/share/ipa/ui/js (#1026260)
- ipa-tests: support external names for hosts (#1032668)
- ipa-client-install fail due fail to obtain host TGT (#1029354)
- Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
by abusing password policy
- ipa-kdb: search for password policies globally
- Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream
- [ipa-python] ipalib.errors.LDAPError: failed to decode certificate:
(SEC_ERROR_INVALID_ARGS) security library: invalid arguments. (#1194312)
- Set krb5 DAL version to 7.0 (#1580711)
- Rebuild aclocal and configure during build
- hbactest does not work for external users (#848531)
- Resolves: #1443869 Command "openssl pkcs12 ..." failed during IPA upgrade
- Fix CAInstance.import_ra_cert for empty passwords
- New upstream release 4.8.0
- New subpackage: freeipa-client-samba
- Added command ipa-cert-fix with man page
- New sysconfdir sysconfig/certmonger
- Updated pki_version, certmonger_version, sssd_version and kdcproxy_version
Related: RHBZ#1684528
- Update to upstream 2.2.0 beta 1 (2.1.90.rc1)
- Set minimum n-v-r for pki-ca and pki-silent to 9.0.18.
- Add Conflicts on mod_ssl
- Update minimum n-v-r of 389-ds-base to 1.2.10.4
- Update minimum n-v-r of sssd to 1.8.0
- Update minimum n-v-r of slapi-nis to 0.38
- Update minimum n-v-r of pki-* to 9.0.18
- Update conflicts on bind-dyndb-ldap to < 1.1.0-0.9.b1
- Update conflicts on bind to < 9.9.0-1
- Drop requires on krb5-server-ldap
- Add patch to remove escaping arguments to pkisilent
- Re-add accidentally removed patches for #1170695 and #1164896
- Fix wrong path in packaging freeipa-systemd-upgrade
- Create systemd-user HBAC service and rule
Resolves: RHBZ#1664974
- ipaserver/dcerpc: fix exclusion entry with a forest trust domain info returned
Resolves: RHBZ#1664023
- trustdomain-find with pkey-only fails (#1068611)
- Invalid credential cache in trust-add (#1069182)
- ipa-replica-install prints unexpected error (#1069722)
- Too big font in input fields in details facet in Firefox (#1069720)
- trust-add for POSIX AD does not fetch trustdomains (#1070925)
- Misleading trust-add error message in some cases (#1070926)
- Access is not rejected for disabled domain (#1070924)
- Set minimum level of sssd to 1.1.1 to pull in required hbac fixes.
- Add OTP patches
- Add patch to set KRB5CCNAME for 389-ds-base
- Resolves: #1431520 ipa cert-find runs a large number of searches, so IPA
WebUI is slow to display user details page
- cert: defer cert-find result post-processing
- Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
helper when installing replica
- server-install: No double Kerberos install
- Resolves: #1437502 ipa-replica-install fails with requirement to
use --force-join that is a client install option.
- Add the force-join option to replica install
- replicainstall: better client install exception handling
- Resolves: #1437953 Server CA-less impossible option check
- server-install: remove broken no-pkinit check
- Resolves: #1441160 FreeIPA client <= 4.4 fail to parse 4.5 cookies
- Add debug log in case cookie retrieval went wrong
- Resolves: #1441548 ipa server install fails with --external-ca option
- ext. CA: correctly write the cert chain
- Resolves: #1441718 Conversion of CA-less server to CA fails on CA instance
spawn
- Fix CA-less to CA-full upgrade
- Resolves: #1442133 Do not link libkrad, liblber, libldap_r and
libsss_nss_idmap to every binary in IPA
- configure: fix AC_CHECK_LIB usage
- Resolves: #1442815 Replica install fails during migration from older IPA
master
- Fix RA cert import during DL0 replication
- Related: #1442004 Building IdM/FreeIPA internally on all architectures -
filtering unsupported packages
- Build all subpackages on all architectures
- Hardening for CVE-2020-25717
- Harden processing of trusted domains' users in S4U operations
- Resolves: RHBZ#2021443
- Updated to upstream 2.2.0 GA
- Update minimum n-v-r of certmonger to 0.53
- Update minimum n-v-r of slapi-nis to 0.40
- Add Requires in client to oddjob-mkhomedir and python-krbV
- Update minimum selinux-policy to 3.10.0-110
- 4.7.1
- Fixes: rhbz#1633105 - rebase to 4.7.1
- Fix otptoken_sync plugin
Resolves: RHBZ#1777811
- Fix automount behavior with authselect
Resolves: RHBZ#1740167
- Require mod_nss-1.0.7-2 for mod_proxy fixes
- Pull upstream changelog 678
- Add new subpackage, ipa-server-selinux
- Add Requires: authconfig to ipa-python (bz #433747)
- Package i18n files
- Fix breakage caused by python-kerberos update to 1.1
- Fix Requires for krb5-server that was missing for Fedora versions > 9
- Remove quotes around test for fedora version to package egg-info
- Load ipa_dogtag.pp in post install
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- user-undel: Fix error messages.
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Prohibit deletion of predefined profiles
- Resolves: #1232819 testing ipa-restore on fresh system install fails
- Backup/resore authentication control configuration
- Resolves: #1243331 pkispawn fails when migrating to 4.2 server from 3.0
server
- Require Dogtag PKI >= 10.2.6
- Resolves: #1245225 Asymmetric vault drops traceback when the key is not
proper
- Asymmetric vault: validate public key in client
- Resolves: #1248399 Missing DNSSEC related files in backup
- fix typo in BasePathNamespace member pointing to ods exporter config
- ipa-backup: archive DNSSEC zone file and kasp.db
- Resolves: #1248405 PassSync should be disabled after ipa-winsync-migrate is
finished
- winsync-migrate: Add warning about passsync
- winsync-migrate: Expand the man page
- Resolves: #1248524 User can't find any hosts using "ipa host-find $HOSTNAME"
- adjust search so that it works for non-admin users
- Resolves: #1250093 ipa certprofile-import accepts invalid config
- Require Dogtag PKI >= 10.2.6
- Resolves: #1250107 IPA framework should not allow modifying trust on AD trust
agents
- trusts: Detect missing Samba instance
- Resolves: #1250111 User lifecycle - preserved users can be assigned
membership
- ULC: Prevent preserved users from being assigned membership
- Resolves: #1250145 Add permission for user to bypass caacl enforcement
- Add permission for bypassing CA ACL enforcement
- Resolves: #1250190 idrange is not added for sub domain
- idranges: raise an error when local IPA ID range is being modified
- trusts: harden trust-fetch-domains oddjobd-based script
- Resolves: #1250928 Man page for ipa-server-install is out of sync
- install: Fix server and replica install options
- Resolves: #1251225 IPA default CAACL does not allow cert-request for services
after upgrade
- Fix default CA ACL added during upgrade
- Resolves: #1251561 ipa vault-add Unknown option: ipavaultpublickey
- validate mutually exclusive options in vault-add
- Resolves: #1251579 ipa vault-add --user should set container owner equal to
user on first run
- Fixed vault container ownership.
- Resolves: #1252517 cert-request rejects request with correct
krb5PrincipalName SAN
- Fix KRB5PrincipalName / UPN SAN comparison
- Resolves: #1252555 ipa vault-find doesn't work for services
- vault: Add container information to vault command results
- Add flag to list all service and user vaults
- Resolves: #1252556 Missing CLI param and ACL for vault service operations
- Added CLI param and ACL for vault service operations.
- Resolves: #1252557 certprofile: improve profile format documentation
- certprofile-import: improve profile format documentation
- certprofile: add profile format explanation
- Resolves: #1253443 ipa vault-add creates vault with invalid type
- vault: validate vault type
- Resolves: #1253480 ipa vault-add-owner does not fail when adding an existing
owner
- baseldap: Allow overriding member param label in LDAPModMember
- vault: Fix param labels in output of vault owner commands
- Resolves: #1253511 ipa vault-find does not use criteria
- vault: Fix vault-find with criteria
- Resolves: #1254038 ipa-replica-install pk12util error returns exit status 10
- install: Fix replica install with custom certificates
- Resolves: #1254262 ipa-dnskeysync-replica crash cannot contact kdc
- improve the handling of krb5-related errors in dnssec daemons
- Resolves: #1254412 when dirsrv is off ,upgrade from 7.1 to 7.2 fails with
starting CA and named-pkcs11.service
- Server Upgrade: Start DS before CA is started.
- Resolves: #1254637 Add ACI and permission for managing user userCertificate
attribute
- add permission: System: Manage User Certificates
- Resolves: #1254641 Remove CSR allowed-extensions restriction
- cert-request: remove allowed extensions check
- Resolves: #1254693 vault --service does not normalize service principal
- vault: normalize service principal in service vault operations
- Resolves: #1254785 ipa-client-install does not properly handle dual stacked
hosts
- client: Add support for multiple IP addresses during installation.
- Add dependency to SSSD 1.13.1
- client: Add description of --ip-address and --all-ip-addresses to man page
- Remove dependency on python-paramiko (#1002884)
- Broken redirection when deleting last entry of DNS resource
record (#1006360)
- "an internal error has occurred" during ipa host-del --updatedns (#1198431)
- Renamed patch 1013 to 0114, as it was merged upstream
- Fax number not displayed for user-show when kinit'ed as normal user.
(#1198430)
- Replication agreement with replica not disabled when ipa-restore done without
IPA installed (#1199060)
- Limit deadlocks between DS plugin DNA and slapi-nis (#1199128)
- Build radius separately
- Fix a few minor issues
- Broke invididual Requires and BuildRequires onto separate lines and
reordered them
- Added python-tgexpandingformwidget as a dependency
- Require at least fedora-ds-base 1.1
- Server install failure during client enrollment shouldn't
roll back (#1023086)
- nsds5ReplicaStripAttrs are not set on agreements (#1023085)
- ipa-server conflicts with mod_ssl (#1018172)
- Update to upstream 3.3.2 (#991064)
- Add delegation info to MS-PAC (#915799)
- Warn about incompatibility with AD when IPA realm and domain
differs (#1009044)
- Allow PKCS#12 files with empty password in install tools (#1002639)
- Privilege "SELinux User Map Administrators" did not list
permissions (#997085)
- SSH key upload broken when client joins an older server (#1009024)
- Set minimum pki-ca and pki-silent versions to 9.0.0
- Set krbCanonicalName admin@REALM on the admin user
Resolves: RHEL-89895
- Rebuild against samba4 beta4
- Resolves: #1361119 UPN-based search for AD users does not match an entry in
slapi-nis map cache
- support multiple uid values in schema compatibility tree
- Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
version to 1.0.7-4 so we pick up the NSS fixes.
- Add selinux-policy-base(post) to Requires (446496)
- Resolves: #1296140 Remove redhat-access-plugin-ipa support
- Obsolete and conflict redhat-access-plugin-ipa
- Resolves: #1351119 Multiple issues while uninstalling ipa-server
- server uninstall fails to remove krb principals
- Resolves: #1351758 ipa commands not showing expected error messages
- frontend: copy command arguments to output params on client
- Show full error message for selinuxusermap-add-hostgroup
- Resolves: #1352883 Traceback on adding default automember group and hostgroup
set
- allow 'value' output param in commands without primary key
- Resolves: #1353888 Fix the help for ipa otp and other topics
- schema: Fix subtopic -> topic mapping
- Resolves: #1354348 ipa trustconfig-show throws internal error.
- allow 'value' output param in commands without primary key
- Resolves: #1354381 ipa trust-add with raw option gives internal error.
- trust-add: handle `--all/--raw` options properly
- Resolves: #1354493 Replica install fails with old IPA master
- DNS install: Ensure that DNS servers container exists
- Resolves: #1354628 ipa hostgroup-add-member does not return error message
when adding itself as member
- frontend: copy command arguments to output params on client
- Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
- messages: specify message type for ResultFormattingError
- Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
secret key
- expose `--secret` option in radiusproxy-* commands
- prevent search for RADIUS proxy servers by secret
- Resolves: #1356099 Bug in the ipapwd plugin
- Heap corruption in ipapwd plugin
- Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
client changes
- Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
- Resolves: #1356964 Renaming a user removes all of his principal aliases
- Preserve user principal aliases during rename operation
- Require slapi-nis 0.47.7 delivering a core feature of 3.3.0 release
- ipa man page format the EXAMPLES section
Resolves: RHBZ#2129895
- Fix canonicalization issue in Web UI
Resolves: RHBZ#2127035
- Remove idnssoaserial argument from dns zone API.
Resolves: RHBZ#2108630
- Warn for permissions with read/write/search/compare and no attrs
Resolves: RHBZ#2098187
- Add PKINIT support to ipa-client-install
Resolves: RHBZ#2075452
- Generate CNAMEs for TXT+URI location krb records
Resolves: RHBZ#2104185
- Vault: fix interoperability issues with older RHEL systems
Resolves: RHBZ#2144737
- Fix typo on ipaupgrade.log chmod during RPM %post snipppet
Resolves: RHBZ#2140994
- Set minimum of python-pyasn1 to 0.0.9a so we have support for the ASN.1
Any type
- Remove ipa-server dependency from ipa-selinux subpackage
- Related: RHBZ#1891832
- clean up spec
- Depend on sssd >= 1.6.2 for better user experience
- webui: Do not allow empty pagination size
Resolves: RHBZ#2094672
- [WebUI] IPA Error 3007: RequirmentError" while adding members in
"User ID overrides" tab
Resolves: RHBZ#1757045
- EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in
freeipa-client-epn
Resolves: RHBZ#1847999
- FreeIPA - Utilize 256-bit AJP connector passwords
Resolves: RHBZ#1849914
- ipa: typo issue in ipanthomedirectoryrive deffinition
Resolves: RHBZ#1851411
- FreeIPA 4.8.0 tarball lacks two update files that are in git
Resolves: RHBZ#1741170
- Proxy PKI URI /ca/ee/ca/profileSubmit to enable replication with future
PKI versions (#1080865)
- kdb: apply combinatorial logic for ticket flags (CVE-2024-3183)
Resolves: RHEL-29927
- kdb: fix vulnerability in GCD rules handling (CVE-2024-2698)
Resolves: RHEL-29692
- Drop workaround for building on AArch64 (#1482244)
- Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)
- schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
build fails (#1167196)
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
- "ipa trust-add ... " cmd says : (Trust status: Established and verified)
while in the logs we see "WERR_ACCESS_DENIED" during verification step.
(#1144121)
- POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
(#1156466)
- Add support/hooks for a one-time password system like SecureID in IPA
(#919228)
- Tracebacks with latest build for --zonemgr cli option (#1167270)
- ID Views: Support migration from the sync solution to the trust solution
(#891984)
- Remove posixAccount from service_find search filter
Resolves: RHBZ#1731437
- Fix repeated uninstallation of ipa-client-samba crashes
Resolves: RHBZ#1732529
- WebUI: Add PKINIT status field to 'Configuration' page
Resolves: RHBZ#1518153
- Resolve user/group names in idoverride*-find
Resolves: RHBZ#1657745
- Configure CA replication to use TLS instead of SSL
- New command automember-find-orphans to find and remove orphan automemeber
rules has been added
Resolves: RHBZ#1638373
- Moved ipa/idm logos and background to redhat-logos-ipa-80.4:
header-logo.png, login-screen-background.jpg, login-screen-logo.png,
product-name.png
New requirement to redhat-logos-ipa >= 80.4 in ipa-server-common
Resolves: RHBZ#1626507
- Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
users in IdM
- store certificates issued for user entries as
- user-show: add --out option to save certificates to file
- Resolves: #1145748 [RFE] IPA running with One Way Trust
- Fix upgrade of sidgen and extdom plugins
- Resolves: #1195339 ipa-client-install changes the label on various files
which causes SELinux denials
- Use 'mv -Z' in specfile to restore SELinux context
- Resolves: #1198796 Text in UI should describe differing LDAP vs Krb behavior
for combinations of "User authentication types"
- webui: add LDAP vs Kerberos behavior description to user auth
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- ULC: Fix stageused-add --from-delete command
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- certprofile-import: do not require profileId in profile data
- Give more info on virtual command access denial
- Allow SAN extension for cert-request self-service
- Add profile for DNP3 / IEC 62351-8 certificates
- Work around python-nss bug on unrecognised OIDs
- Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
- Validate vault's file parameters
- Fixed missing KRA agent cert on replica.
- Resolves: #1225866 display browser config options that apply to the browser.
- webui: add Kerberos configuration instructions for Chrome
- Remove ico files from Makefile
- Resolves: #1246342 Unapply idview raises internal error
- idviews: Check for the Default Trust View only if applying the view
- Resolves: #1248102 [webui] regression - incorrect/no failed auth messages
- webui: fix regressions failed auth messages
- Resolves: #1248396 Internal error in DomainValidator.__search_in_dc
- dcerpc: Fix UnboundLocalError for ccache_name
- Resolves: #1249455 ipa trust-add failed CIFS server configuration does not
allow access to \\pipe\lsarpc
- Fix selector of protocol for LSA RPC binding string
- dcerpc: Simplify generation of LSA-RPC binding strings
- Resolves: #1250192 Error in ipa trust-fecth-domains
- Fix incorrect type comparison in trust-fetch-domains
- Resolves: #1251553 Winsync setup fails with unexpected error
- replication: Fix incorrect exception invocation
- Resolves: #1251854 ipa aci plugin is not parsing aci's correctly.
- ACI plugin: correctly parse bind rules enclosed in
- Resolves: #1252414 Trust agent install does not detect available replicas to
add to master
- adtrust-install: Correctly determine 4.2 FreeIPA servers
- Introduce upgrade script to recover existing configuration after systemd migration
as user has no means to recover FreeIPA from systemd migration
- Upgrade script:
- recovers symlinks in Dogtag instance install
- recovers systemd configuration for FreeIPA's directory server instances
- recovers freeipa.service
- migrates directory server and KDC configs to use proper keytabs for systemd services
- Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
- Remove references to admin server in ipa-server-setupssl
- Generate a client certificate for the XML-RPC server to connect to LDAP with
- Create a keytab for Apache
- Create an ldif with a test user
- Provide a certmap.conf for doing SSL client authentication
- Update to 4.7.90-pre1
Related: RHBZ#1684528
- Removed patches 0002 to 0031 as these are upsteram and part of 4.7.90-pre1
- Added new patches 0001-revert-minssf-defaults.patch and
0001-Correct-default-fontawesome-path-broken-by-da2cf1c5.patch
- Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
- Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
- Resolves: #1341249 Subsequent external CA installation fails
- install: fix external CA cert validation
- Resolves: #1353831 ipa-server-install fails in container because of
hostnamectl set-hostname
- server-install: Fix --hostname option to always override api.env values
- install: Call hostnamectl set-hostname only if --hostname option is used
- Resolves: #1356091 ipa-cacert-manage --help and man differ
- Improvements for the ipa-cacert-manage man and help
- Resolves: #1360631 ipa-backup is not keeping the
/etc/tmpfiles.d/dirsrv-.conf
- ipa-backup: backup /etc/tmpfiles.d/dirsrv-.conf
- Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
file is needed
- Update ipa-replica-install documentation
- Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
not rpm-require it
- client: RPM require initscripts to get *-domainname.service
- Resolves: #1364197 caacl: error when instantiating rules with service
principals
- caacl: fix regression in rule instantiation
- Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
- parameters: move the `confirm` kwarg to Param
- Resolves: #1364464 Topology graph: ca and domain adders shows question marks
instead of plus icon
- Fix unicode characters in ca and domain adders
- Resolves: #1365083 Incomplete output returned for command ipa vault-add
- client: add missing output params to client-side commands
- Resolves: #1365526 build fails during "make check"
- ipa-kdb: Fix unit test after packaging changes in krb5
- Rebase to security release 4.8.3 (CVE-2019-14867, CVE-2019-10195)
Resolves: RHBZ#1767304
Resolves: RHBZ#1776939
- Support KDC ticket policies for authentication indicators
Resolves: RHBZ#1777564
- Fix misleading errors during client install rollback
Resolves: RHBZ#1658283
- ipa-advise: update url of cacerdir_rehash tool
Resolves: RHBZ#1658287
- Handle NTP configuration in a replica server installation
Resolves: RHBZ#1651679
- Fix defects found by static analysis
Resolves: RHBZ#1658182
- ipa-replica-install --setup-adtrust: check for package ipa-server-trust-ad
Resolves: RHBZ#1658294
- ipaldap: invalid modlist when attribute encoding can vary
Resolves: RHBZ#1658302
- Allow ipaapi and Apache user to access SSSD IFP
Resolves: RHBZ#1639910
- Add sysadm_r to default SELinux user map order
Resolves: RHBZ#1658303
- certdb: ensure non-empty Subject Key Identifier and validate server cert sig
Resolves: RHBZ#1641988
- ipa-replica-install: password and admin-password options mutually exclusive
Resolves: RHBZ#1658309
- ipa upgrade: handle double-encoded certificates
Resolves: RHBZ#1658310
- PKINIT: fix ipa-pkinit-manage enable|disable
Resolves: RHBZ#1658313
- Enable LDAP debug output in client to display TLS errors in join
Resolves: RHBZ#1658316
- rpc: always read response
Resolves: RHBZ#1639890
- ipa vault-retrieve: fix internal error
Resolves: RHBZ#1658485
- Move ipa's systemd tmpfiles from /var/run to /run
Resolves: RHBZ#1658487
- Fix authselect invocations to work with 1.0.2
Resolves: RHBZ#1654291
- ipa-client-automount and NFS unit name changes
Resolves: RHBZ#1645501
- Fix compile issue with new 389-ds
Resolves: RHBZ#1659448
- ipatests: fix test_topology
Resolves: RHBZ#2232351
- Installer: activate nss and pam services in sssd.conf
Resolves: RHBZ#2216532
- Update to upstream 4.1.0 (#1109726)
- Re-enable otptoken_yubikey plugin
- Convert to autotools-based build
- Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
because of missing dependencies
- Rebuild with krb5-1.14.1
- Update to upstream 3.3.0 (#991064)
- Set 0.14 as minimum version for slapi-nis
- ipa-client-automount fails with incompatibility error when installed against
older IPA server (#1083108)
- Server installation fails using external signed certificates with
"IndexError: list index out of range" (#1111320)
- Add rhino to BuildRequires to fix Web UI build error
- Abstracted client class to work directly or over RPC
- Fix S4U2Self regression for cross-realm requester SID buffer
- Related: RHBZ#2021443
- Add dep for freeipa-admintools and acl
- Add Requires: python-nss to ipa-python sub-package
- Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
- python2-ipalib: add missing python dependency
- installer service: fix typo in service entry
- upgrade: add missing suffix to http instance
- Resolves: #1444791 Update man page of ipa-kra-install
- ipa-kra-install manpage: document domain-level 1
- Resolves: #1441493 ipa cert-show raises stack traces when
--certificate-out=/tmp
- cert-show: writable files does not mean dirs
- Resolves: #1441192 Add the name of URL parameter which will be check for
username during cert login
- Bump version of ipa.conf file
- Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
- Turn on NSSOCSP check in mod_nss conf
- Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
template on
- renew agent: respect CA renewal master setting
- server upgrade: always fix certmonger tracking request
- cainstance: use correct profile for lightweight CA certificates
- renew agent: allow reusing existing certs
- renew agent: always export CSR on IPA CA certificate renewal
- renew agent: get rid of virtual profiles
- ipa-cacert-manage: add --external-ca-type
- Resolves: #1441593 error adding authenticator indicators to host
- Fixing adding authenticator indicators to host
- Resolves: #1449525 Set directory ownership in spec file
- Added plugins directory to ipaclient subpackages
- ipaclient: fix missing RPM ownership
- Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
- otptoken-add-yubikey: When --digits not provided use default value
- Upstream release FreeIPA 4.9.2
Related: RHBZ#1891832
- Rebuild for broken deps in rawhide
- Fix 389-ds-base strict dep to be 1.3.0.3
- Move ipa-tests package to separate srpm (#1032668)
- Don't always override the port in import_included_profiles
Fixes: RHBZ#2022483
- Remove ipa-join errors from behind the debug option
Fixes: RHBZ#2048558
- Enable the ccache sweep timer during installation
Fixes: RHBZ#2051575
- ipa-replica-install never checks for 7389 port (#1075165)
- Non-terminated string may be passed to LDAP search (#1075091)
- ipa-sam may fail to translate group SID into GID (#1073829)
- Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
- Update to upstream version 1.0.0
- rpcserver: validate Kerberos principal name before running kinit
Resolves: RHEL-26153
- Vault: add additional fallback to RSA-OAEP wrapping algo
Resolves: RHEL-28259
- Set min version of 389-ds-base to 1.2.8
- Set min version of mod_nss 1.0.8-10
- Set min version of selinux-policy to 3.9.7-27
- Add dogtag themes to Requires
- Update to upstream freeipa-2.0.0.pre2
- Resolves: #1339483 ipa-server-install fails with ERROR pkinit_cert_files
- Fix incorrect rebase of patch 1001
- Fixed weekday in 4.8.4-2 changelog date
Related: RHBZ#1784003
- adtrust: print DNS records for external DNS case after role is enabled
Resolves: RHBZ#1665051
- AD user without override receive InternalServerError with API
Resolves: RHBZ#1782572
- ipa-client-automount fails after repeated installation/uninstallation
Resolves: RHBZ#1790886
- install/updates: move external members past schema compat update
Resolves: RHBZ#1803165
- kdb: make sure audit_as_req callback signature change is preserved
Resolves: RHBZ#1803786
- Resolves: #1449189 ipa-kra-install timeouts on replica
- kra: promote: Get ticket before calling custodia
- Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
- Fix ipa-server-install in pure IPv6 environment
- Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
reachable via the forest root
- trust: make sure ID range is created for the child domain even if it exists
- ipa-kdb: simplify trusted domain parent search
- Resolves: #1335567 Update Warning in IdM Web UI API browser
- WebUI: add API browser is tech preview warning
- Resolves: #1348560 Mulitple domain Active Directory Trust conflict
- ipaserver/dcerpc: reformat to make the code closer to pep8
- trust: automatically resolve DNS trust conflicts for triangle trusts
- Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
certificate revocation
- cert-revoke: fix permission check bypass (CVE-2016-5404)
- Resolves: #1353936 custodia.conf and server.keys file is world-readable.
- Remove Custodia server keys from LDAP
- Secure permissions of Custodia server.keys
- Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
converted from CA-less to CA-full
- custodia: include known CA certs in the PKCS#12 file for Dogtag
- custodia: force reconnect before retrieving CA certs from LDAP
- Resolves: #1362333 ipa vault container owner cannot add vault
- Fix: container owner should be able to add vault
- Resolves: #1365546 External trust with root domain is transitive
- trust: make sure external trust topology is correctly rendered
- Resolves: #1365572 IPA server broken after upgrade
- Require pki-core-10.3.3-7
- Resolves: #1367864 Server assumes latest version of command instead of
version 1 for old / 3rd party clients
- rpcserver: assume version 1 for unversioned command calls
- rpcserver: fix crash in XML-RPC system commands
- Resolves: #1367773 thin client ignores locale change
- schema cache: Fallback to 'en_us' when locale is not available
- Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
- Fail on topology disconnect/last role removal
- Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
- otptoken, permission: Convert custom type parameters on server
- Resolves: #1369414 ipa server-del fails with Python stack trace
- Handled empty hostname in server-del command
- Resolves: #1369761 ipa-server must depend on a version of httpd that support
mod_proxy with UDS
- Require httpd 2.4.6-31 with mod_proxy Unix socket support
- Resolves: #1370512 Received ACIError instead of DuplicatedError in
stageuser_tests
- Raise DuplicatedEnrty error when user exists in delete_container
- Resolves: #1371479 cert-find --all does not show information about revocation
- cert: add missing param values to cert-find output
- Renamed patch 1011 to 0100, as it was merged upstream
- Add BuildRequires for authconfig
- Add explicit dependency for libvert-libev
Resolves: RHBZ#2104929
- ipatests: Backport test fixes in python3-ipatests.
Resolves: RHBZ#2057505
- Rely on sssd-krb5 to include SSSD-generated krb5 configuration
Resolves: RHBZ#2214563
- Refactor ipatests for unique krbcanonicalname
Resolves: RHEL-110061
- Move ipalib to ipa-python subpackage
- Bump minimum version of slapi-nis to 0.15
- Remove client-epn left over files for ONLY_CLIENT
Related: RHBZ#1847999
- Resolves: #1252556 Missing CLI param and ACL for vault service operations
- vault: fix private service vault creation
- Update to upstream 2.1.4 (CVE-2011-3636)
- Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
by abusing password policy
- password policy: Add explicit default password policy for hosts and
services
- Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
certprofile-mod
- certprofile-mod: correctly authorise config update
- Update to upstream 4.1.0 Alpha 1 (#1109726)
- PKI service restart after CA renewal failed (#1040018)
- Preverse mode on ipa-keytab-util
- Version bump for relase and rpm name change
- Resolves: #1318186 Misleading error message during external-ca IPA master
install
- httpinstance: make sure NSS database is backed up
- Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
CA certificate chain in ... incomplete"
- httpinstance: make sure NSS database is backed up
- Resolves: #1393726 Enumerate all available request type options in ipa
cert-request help
- Hide request_type doc string in cert-request help
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- spec file: bump libsss_nss_idmap-devel BuildRequires
- server: make sure we test for sss_nss_getlistbycert
- Resolves: #1437378 ipa-adtrust-install produced an error and failed on
starting smb when hostname is not FQDN
- adtrust: make sure that runtime hostname result is consistent with the
configuration
- Resolves: #1437555 ipa-replica-install with DL0 fails to get annonymous
keytab
- Always check and create anonymous principal during KDC install
- Remove duplicate functionality in upgrade
- Resolves: #1437946 Upgrade to FreeIPA 4.5.0 does not configure anonymous
principal for PKINIT
- Upgrade: configure PKINIT after adding anonymous principal
- Remove unused variable from failed anonymous PKINIT handling
- Split out anonymous PKINIT test to a separate method
- Ensure KDC is propery configured after upgrade
- Resolves: #1437951 Remove pkinit-related options from server/replica-install
on DL0
- Fix the order of cert-files check
- Don't allow setting pkinit-related options on DL0
- replica-prepare man: remove pkinit option refs
- Remove redundant option check for cert files
- Resolves: #1438490 CA-less installation fails on publishing CA certificate
- Get correct CA cert nickname in CA-less
- Remove publish_ca_cert() method from NSSDatabase
- Resolves: #1438838 Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
- IPA-KDB: use relative path in ipa-certmap config snippet
- Resolves: #1439038 Allow erasing ipaDomainResolutionOrder attribute
- Allow erasing ipaDomainResolutionOrder attribute
- Upstream release FreeIPA 4.8.6
- New SELinux sub package to provide own module
- Depend on selinux-policy-devel 3.14.3-43 for build due to a makefile issue in
SELinux external policy support
Related: RHBZ#1818765
- CAless installation: set the perms on KDC cert file
Resolves: RHBZ#1863616
- EPN: handle empty attributes
Resolves: RHBZ#1866938
- IPA-EPN: enhance input validation
Resolves: RHBZ#1866291
- EPN: enhance input validation
Resolves: RHBZ#1863079
- Require new samba build 4.12.3-52
Related: RHBZ#1868558
- Require new selinux-policy build 3.14.3-52
Related: RHBZ#1869311
- Resolves: #1398670 Check IdM Topology for broken record caused by replication
conflict before upgrading it
- Check for conflict entries before raising domain level
- package the sessions dir /var/cache/ipa/sessions
- Pull upstream changelog 597
- Add call to /usr/sbin/upgradeconfig to post install
- Resolves: #1262996 ipa vault internal error on replica without KRA
- upgrade: make sure ldap2 is connected in export_kra_agent_pem
- Resolves: #1270608 IPA upgrade fails for server with CA cert signed by
external CA
- schema: do not derive ipaVaultPublicKey from ipaPublicKey
- dcerpc: invalidate forest trust intfo cache when filtering out realm domains
Resolves: RHEL-28559
- Backport latests test fixes in python3-tests
ipatests: add xfail for autoprivate group test with override
ipatests: remove xfail thanks to sssd 2.9.4
ipatests: adapt for new automembership fixup behavior
ipatests: Fixes for test_ipahealthcheck_ipansschainvalidation testcases
test_xmlrpc: adopt to automember plugin message changes in 389-ds
Resolves: RHEL-29908
- Config plugin: return EmptyModlist when no change is applied.
Resolves: RHBZ#2031825
- Custodia: use a stronger encryption algo when exporting keys.
Resolves: RHBZ#2032806
- ipa-kdb: do not remove keys for hardened auth-enabled users.
Resolves: RHBZ#2033342
- ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus
Resolves: RHBZ#2049167
- Backport latest test fxes in python3 ipatests.
Resolves: RHBZ#2048509
- Removed unused patch files that were part of 4.9.8 rebase.
- Upstream final release FreeIPA 4.9.0
Related: RHBZ#1891832
- Add end to end integration tests for external IdP
Resolves: RHBZ#2106346
- Upstream release FreeIPA 4.9.8
Related: RHBZ#2015607
- Hardening for CVE-2020-25717
- Resolves: #1419735 ipa-replica-install fails promotecustodia.create_replica
with cert errors (untrusted)
- added ssl verification using IPA trust anchor
- Resolves: #1428472 batch param compatibility is incorrect
- compat: fix `Any` params in `batch` and `dnsrecord`
- Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream
- rebuild with new openssl
- Rebase ipa to 4.9.13
Resolves: RHEL-16936
- Remove the IPA DNA plugin, use the DS one
- Drop requires on python-configobj (not used any more)
- Drop ipa-ldap-updater message, upgrades are done differently now
- Update minimum selinux-policy to 3.9.16-18
- Update minimum pki-ca and pki-selinux to 9.0.7
- Update minimum 389-ds-base to 1.2.8.0-1
- Update to upstream 2.0.1
- Remove radius subpackages
- Pull upstream changelog 641
- Require minimum version of krb5-server on F-7 and F-8
- Package some new files
- Add ipa init script
- Update to upstream 4.0.3 (#1109726)
- Update Requires on selinux-policy to 3.13.1-4
- Add missing part of backported CVE-2024-3183 fix
Resolves: RHEL-29927
- Drop BuildRequires on mozldap-devel
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
- Updated upstream pull (596) to fix bug in ipa_webgui that was causing the
UI to not start.
- Remove duplicate %files entries on share/ipa/static
- Add python default encoding shared library
- Winsync agreement cannot be created (#1023085)
- Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
aliases)
- harden the check for trust namespace overlap in new principals
- Resolves: #1351142 CLI is not using session cookies for communication with
IPA API
- Fix session cookies
- Resolves: #1353888 Fix the help for ipa otp and other topics
- help: Add dnsserver commands to help topic 'dns'
- Resolves: #1354406 host-del updatedns options complains about missing ptr
record for host
- Host-del: fix behavior of --updatedns and PTR records
- Resolves: #1355718 ipa-replica-manage man page example output differs actual
command output
- Minor fix in ipa-replica-manage MAN page
- Resolves: #1358229 Traceback message should be fixed, seen while editing
winsync migrated user information in Default trust view.
- baseldap: Fix MidairCollision instantiation during entry modification
- Resolves: #1358849 CA replica install logs to wrong log file
- unite log file name of ipa-ca-install
- Resolves: #1359130 ipa-server-install command fails to install IPA server.
- DNS Locations: fix update-system-records unpacking error
- Resolves: #1359237 AVC on dirsrv config caused by IPA installer
- Use copy when replacing files to keep SELinux context
- Resolves: #1359692 ipa-client-install join fail with traceback against
RHEL-6.8 ipa-server
- compat: fix ping call
- Resolves: #1359738 ipa-replica-install --domain= option
does not work
- replica-install: Fix --domain
- Resolves: #1360778 Vault commands are available in CLI even when the server
does not support them
- Revert "Enable vault-* commands on client"
- client: fix hiding of commands which lack server support
- Related: #1281704 Rebase to softhsm 2.1.0
- Remove the workaround for softhsm bug #1293340
- Related: #1298288 [RFE] Improve performance in large environments.
- Create indexes for krbCanonicalName attribute
- Use OpenJDK 8 to bootstrap on AArch64 until RH1482244 is resolved in
buildroot
- Resolves: #1470177 - Rebase IPA to latest 4.5.x version
- Resolves: #1398594 ipa topologysuffix-verify should only warn about
maximum number of replication agreements.
- Resolves: #1404236 Web UI: Change "Host Based" and "Role Based"
to "Host-Based" and "Role-Based"
- Resolves: #1409786 Second phase of --external-ca ipa-server-install
setup fails when dirsrv is not running
- Resolves: #1451576 ipa cert-request failed to generate certificate from csr
- Resolves: #1452086 Pagination Size under Customization in IPA WebUI
accepts negative values
- Resolves: #1458169 --force-join option is not mentioned in
ipa-replica-install man page
- Resolves: #1463186 IPA shouldn't allow objectclass if not all in lower case
- Resolves: #1478322 user-show command fails when sizelimit is configured
to number <= number of entity which is user member of
- Resolves: #1496775 Enterprise principals should be able to trigger
a refresh of the trusted domain data in the KDC
- Resolves: #1502533 Changing cert-find to go through the proxy
instead of using the port 8080
- Resolves: #1502663 pkinit-status command fails after an upgrade from
a pre-4.5 IPA
- Resolves: #1498168 Error when trying to modify a PTR record
- Resolves: #1457876 ipa-backup fails silently
- Resolves: #1493531 In case full PKINIT configuration is failing during
server/replica install the error message should be more meaningful.
- Resolves: #1449985 Suggest CA installation command in KRA installation
warning
- Display server name in ipa command's verbose mode (#1061703)
- Remove sourcehostcategory from default HBAC rule (#1061187)
- dnszone-add cannot add classless PTR zones (#1058688)
- Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)
- Add ipa-rmkeytab tool
- ipaclient-install: chmod needs octal permissions (#1609880)
- Added Require mod_wsgi, added share/ipa/wsgi.py
- Improve otptoken help messages (#919228)
- Ensure users exist when assigning tokens to them (#919228)
- Enable QR code display by default in otptoken-add (#919228)
- Show warning instead of error if CA did not start (#1158410)
- CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
- Traceback when adding zone with long name (#1164859)
- Backup & Restore mechanism (#951581)
- ignoring user attributes in migrate-ds does not work if uppercase characters
are returned by ldap (#1159816)
- Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
- Failure when installing on dual stacked system with external ca (#1128380)
- ipa-server should keep backup of CS.cfg (#1059135)
- Tracebacks with latest build for --zonemgr cli option (#1167270)
- webui: use domain name instead of domain SID in idrange adder dialog
(#891984)
- webui: normalize idview tab labels (#891984)
- Unable to add trust successfully with --trust-secret (#1075704)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Resolves: #1258965 ipa vault: set owner of vault container
- baseldap: make subtree deletion optional in LDAPDelete
- vault: add vault container commands
- vault: set owner to current user on container creation
- vault: update access control
- vault: add permissions and administrator privilege
- install: support KRA update
- Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
- config: allow user/host attributes with tagging options
- Resolves: #1262315 Unable to establish winsync replication
- winsync: Add inetUser objectclass to the passsync sysaccount
- Update SELinux policy to allow ipa_kpasswd to connect ldap and
read /dev/urandom. (#759679)
- Adopt to samba4 beta6 (libsecurity -> libsamba-security)
- Add dependency to samba4-winbind
- Resolves: #1298288 [RFE] Improve performance in large environments.
- cert: speed up cert-find
- Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
authentication
- service: add flag to allow S4U2Self
- Add 'trusted to auth as user' checkbox
- Added new authentication method
- Resolves: #1353881 ipa-replica-install suggests about
non-existent --force-ntpd option
- Don't show --force-ntpd option in replica install
- Resolves: #1354441 DNS forwarder check is too strict: unable to add
sub-domain to already-broken domain
- DNS: allow to add forward zone to already broken sub-domain
- Resolves: #1356146 performance regression in CLI help
- schema: Speed up schema cache
- frontend: Change doc, summary, topic and NO_CLI to class properties
- schema: Introduce schema cache format
- schema: Generate bits for help load them on request
- help: Do not create instances to get information about commands and topics
- schema cache: Do not reset ServerInfo dirty flag
- schema cache: Do not read fingerprint and format from cache
- Access data for help separately
- frontent: Add summary class property to CommandOverride
- schema cache: Read server info only once
- schema cache: Store API schema cache in memory
- client: Do not create instance just to check isinstance
- schema cache: Read schema instead of rewriting it when SchemaUpToDate
- Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
- server install: do not prompt for cert file PIN repeatedly
- Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
cache directory: [Errno 13] Permission denied: '/home/test_user'
- schema: Speed up schema cache
- Resolves: #1366604 `cert-find` crashes on invalid certificate data
- cert: do not crash on invalid data in cert-find
- Resolves: #1366612 Middle replica uninstallation in line topology works
without '--ignore-topology-disconnect'
- Fail on topology disconnect/last role removal
- Resolves: #1366626 caacl-add-service: incorrect error message when service
does not exists
- Fix ipa-caalc-add-service error message
- Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
does not happen to run during dnf upgrade
- DNS server upgrade: do not fail when DNS server did not respond
- Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
with CA
- Add warning about only one existing CA server
- Set servers list as default facet in topology facet group
- Resolves: #1367773 thin client ignores locale change
- schema check: Check current client language against cached one
- Resolves: #1434032 Run ipa-custodia with custom SELinux context
- Require correct custodia version
- Fix: DNS installer adds invalid zonemgr email (#1056202)
- ipaplatform: Use the dirsrv service, not target (#951581)
- Fix: DNS policy upgrade raises asertion error (#1161128)
- Fix upgrade referint plugin (#1161128)
- Upgrade: fix trusts objectclass violationi (#1161128)
- group-add doesn't accept gid parameter (#1149124)
- Remove redundat Requires versions that are already in Fedora 17
- Replace python-crypto Requires with m2crypto
- Add missing Requires(post) for client and server-trust-ad subpackages
- Restart httpd service when server-trust-ad subpackage is installed
- Bump selinux-policy Requires to pick up PKI/LDAP port labeling fixes
- Fix SELinux code
- Resolves: #1378353 Replica install fails with old IPA master sometimes during
replication process
- spec file: bump minimal required version of 389-ds-base
- Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
- Fix missing file that fails DL1 replica installation
- Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
- WebUI: services without canonical name are shown correctly
- Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
- trustdomain-del: fix the way how subdomain is searched
- kdb: PAC generator: do not fail if canonical principal is missing
Resolves: RHEL-23630
- ipa-kdb: Fix memory leak during PAC verification
Resolves: RHEL-22644
- Fix session cookie access
Resolves: RHEL-23622
- Do not ignore staged users in sidgen plugin
Resovlves: RHEL-23626
- ipa-kdb: Disable Bronze-Bit check if PAC not available
Resolves: RHEL-22313
- krb5kdc: Fix start when pkinit and otp auth type are enabled
Resolves: RHEL-4874
- hbactest was not collecting or returning messages
Resolves: RHEL-12780
- Resolves: #712109 "krbExtraData not allowed" is logged in DS error log while
setting password for default sudo binddn.
- Resolves: #747612 [RFE] IPA should support and manage DNS sites
- Resolves: #768316 [RFE] ipa-getkeytab should auto-detect the ipa server name
- Resolves: #825391 [RFE] Replica installation should provide a means for
inheriting nssldap security access settings
- Resolves: #921497 Incorrect *.py[co] files placement
- Resolves: #1029640 RHEL7 IPA to add DNA Plugin config for dnaRemote support
- Resolves: #1029905 389 DS cache sizes not replicated to IPA replicas
- Resolves: #1196958 IPA replica installation failing with high number of users
(160000).
- Resolves: #1219402 IPA suggests to uninstall a client when the user needs to
uninstall a replica
- Resolves: #1224057 [RFE] TGS authorization decisions in KDC based on
Authentication Indicator
- Resolves: #1234222 [WebUI] UI error message is not appropriate for "Kerberos
principal expiration"
- Resolves: #1234223 [WebUI] General invalid password error message appearing
for "Locked user"
- Resolves: #1254267 ipa-server-install failure applying ldap updates with
limits exceeded
- Resolves: #1258626 realmdomains-mod --add-domain command throwing error when
doamin already is in forwardzone.
- Resolves: #1259020 ipa-server-adtrust-install doesn't allow
NetBIOS-name=EXAMPLE-TEST.COM (dash character)
- Resolves: #1260993 DNSSEC signing enablement on dnszone should throw error
message when DNSSEC master not installed
- Resolves: #1262747 dnssec options missing in ipa-dns-install man page
- Resolves: #1265900 Fail installation immediately after dirsrv fails to
install using ipa-server-install
- Resolves: #1265915 idoverrideuser-find fails if any SID anchor is not
resolvable anymore
- Resolves: #1268027 ipa-dnskeysync-replica crash with backtrace -
LimitsExceeded: limits exceeded for this query
- Resolves: #1269089 Certificate of managed-by host/service fails to resubmit
- Resolves: #1269200 ipa-server crashing while trying to preserve admin user
- Resolves: #1271321 Reduce ioblocktimeout and idletimeout defaults
- Resolves: #1271579 Automember rule expressions disappear from tables on
single expression delete
- Resolves: #1275816 Incomplete ports for IPA ad-trust
- Resolves: #1276351 [RFE] Remove
/usr/share/ipa/updates/50-lockout-policy.update file from IPA releases
- Resolves: #1277109 Add tool tips for Revert, Refresh, Undo, and Undo All in
the IPA UI
- Resolves: #1278426 Better error message needed for invalid ca-signing-algo
option
- Resolves: #1279932 ipa-client-install --request-cert needs workaround in
anaconda chroot
- Resolves: #1282521 Creating a user w/o private group fails when doing so in
WebUI
- Resolves: #1283879 ipa-winsync-migrate: Traceback message should be replaced
by "IPA is not configured on this system"
- Resolves: #1285071 ipa-kra-install fails on replica looking for admin cert
file
- Resolves: #1287194 [RFE] Support of UPN for trusted domains
- Resolves: #1288967 Normalize Manager entry in ipa user-add
- Resolves: #1289487 Priority field missing in Password Policy detail tab
- Resolves: #1291140 ipa client should configure kpasswd_server directive in
krb5.conf
- Resolves: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.4.0.alpha1
- Resolves: #1298848 [RFE] Centralized topology management
- Resolves: #1300576 Browser setup page includes instructions for Internet
Explorer
- Resolves: #1301586 ipa host-del --updatedns should remove related dns
entries.
- Resolves: #1304618 Residual Files After IPA Server Uninstall
- Resolves: #1305144 ipa-python does not require its dependencies
- Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
- Resolves: #1313798 Console output post ipa-winsync-migrate command should be
corrected.
- Resolves: #1314786 [RFE] External Trust with Active Directory domain
- Resolves: #1319023 Include description for 'status' option in man page for
ipactl command.
- Resolves: #1319912 ipa-server-install does not completely change hostname and
named-pkcs11 fails
- Resolves: #1320891 IPA Error 3009: Validation error: Invalid 'ptrrecord':
Reverse zone in-addr.arpa. requires exactly 4 IP address compnents, 5 given
- Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
revocation reasons
- Resolves: #1328549 "ipa-kra-install" command reports incorrect message when
it is executed on server already installed with KRA.
- Resolves: #1329209 ipa-nis-manage enable: change service name from 'portmap'
to 'rpcbind'
- Resolves: #1329275 ipa-nis-manage command should include status option
- Resolves: #1330843 'man ipa' should be updated with latest commands
- Resolves: #1333755 ipa cert-request causes internal server error while
requesting certificate
- Resolves: #1337484 EOF is not handled for ipa-client-install command
- Resolves: #1338031 Insufficient 'write' privilege on some attributes for the
members of the role which has "User Administrators" privilege.
- Resolves: #1343142 IPA DNS should do better verification of DNS zones
- Resolves: #1347928 Frontpage exposes runtime error with no cookies enabled in
browser
- Use NSS protocol range API to set available TLS protocols (#1156466)
- Updated to upstream 3.0.0 rc 2
- Include new FF configuration extension
- Set minimum Requires of selinux-policy to 3.11.1-33
- Set minimum Requires dogtag to 10.0.0-0.43.b1
- Add new optional strict sub-package to allow users to limit other
package upgrades.
- Add ipa-idrange-fix
Resolves: RHEL-56920
- Unconditionally add MS-PAC to global config on update
Resolves: RHEL-49437
- ipatests: Update ipa-adtrust-install test
Resolves: RHEL-40894
- Require python-qrcode version 5.3 or later
Related: RHEL-15090
- ipa-kdb: Rework ipadb_reinit_mspac()
Resolves: RHEL-25742
- ipatests: wait for replica update in test_dns_locations
Resolves: RHEL-22373
- ipatests: fix tasks.wait_for_replication() method
Resolves: RHEL-25708
- Resolves: #805188 [RFE] "ipa migrate-ds" ldapsearches with scope=1
- Resolves: #1019272 With 20000+ users, adding a user to a group intermittently
throws Internal server error
- Resolves: #1035494 Unable to add Kerberos principal via kadmin.local
- Resolves: #1045153 ipa-managed-entries --list -p still requires
DM password
- Resolves: #1125950 ipa-server-install --uinstall doesn't remove port 7389
from ldap_port_t
- Resolves: #1132540 [RFE] Expose service delegation rules in UI and CLI
- Resolves: #1145584 ipaserver/install/cainstance.py creates pkiuser not
matching uidgid
- Resolves: #1176036 IDM client registration failure in a high load environment
- Resolves: #1183116 Remove Requires: subscription-manager
- Resolves: #1186054 permission-add does not prompt to enter --right option in
interactive mode
- Resolves: #1187524 Replication agreement with replica not disabled when
ipa-restore done without IPA installed
- Resolves: #1188195 Fax number not displayed for user-show when kinit'ed as
normal user.
- Resolves: #1189034 "an internal error has occurred" during ipa host-del
--updatedns
- Resolves: #1193554 ipa-client-automount: failing with error LDAP server
returned UNWILLING_TO_PERFORM. This likely means that minssf is enabled.
- Resolves: #1193759 IPA extdom plugin fails when encountering large groups
- Resolves: #1194312 [ipa-python] ipalib.errors.LDAPError: failed to decode
certificate: (SEC_ERROR_INVALID_ARGS) security library: invalid arguments.
- Resolves: #1194633 Default trust view can be deleted in lower case
- Resolves: #1196455 ipa-server-install step [8/27]: starting certificate
server instance - confusing CA staus message on TLS error
- Resolves: #1198263 Limit deadlocks between DS plugin DNA and slapi-nis
- Resolves: #1199527 [RFE] Use datepicker component for datetime fields
- Resolves: #1200867 [RFE] Make OTP validation window configurable
- Resolves: #1200883 [RFE] Switch apache to use mod_auth_gssapi
- Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using
get_user_grouplist() [rhel-7.2]
- Resolves: #1204637 slow group operations
- Resolves: #1204642 migrate-ds: slow add o users to default group
- Resolves: #1208461 IPA CA master server update stuck on checking getStatus
via https
- Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
- Resolves: #1211708 ipa-client-install gets stuck during NTP sync
- Resolves: #1215197 ipa-client-install ignores --ntp-server option during time
sync
- Resolves: #1215200 ipa-client-install configures IPA server as NTP source
even if IPA server has not ntpd configured
- Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
- Related: #1204809 Rebase ipa to 4.2
- Update to upstream 4.2.0.alpha1
- ipatests: NAMED_CRYPTO_POLICY_FILE not defined for RHEL
Resolves: RHBZ#1982956
- Add sssd and certmonger as a Requires on ipa-client
- Rebase to upstream release 4.9.10
Remove upstream patches 0002 to 0016 that are part of version 4.9.10
Remove patches 1101 that is part of version 4.9.10
Rename patch 0001 to 1002 as it will be used in future RHEL 8 releases
Add patches 0001 and 0002 to fix build on RHEL 8.7
Resolves: RHBZ#2079466
Resolves: RHBZ#2063155
Resolves: RHBZ#1958777
Resolves: RHBZ#2068088
Resolves: RHBZ#2004646
Resolves: RHBZ#782917
Resolves: RHBZ#2059396
Resolves: RHBZ#2092015
- Handle new samba exception types.
Resolves: RHEL-17623
- Deprecate --serial-autoincrement option (#1016645)
- CA installation always failed on replica (#1005446)
- Re-initializing a winsync connection exited with error (#994980)
- Update to upstream 3.2.0 Beta 1
- Add a Requires for java-atk-wrapper until we can determine which package
should be pulling it in, dogtag or tomcat.
- Add redhat-access-plugin-ipa dependency
- extdom: unify error code handling especially LDAP_NO_SUCH_OBJECT
Resolves: RHBZ#1741530
- Resolves: #800545 [RFE] Support SUDO command rename
- Reworked the renaming mechanism
- Allow renaming of the sudorule objects
- Resolves: #872671 IPA WebUI login for AD Trusted User fails
- WebUI: check principals in lowercase
- WebUI: add method for disabling item in user dropdown menu
- WebUI: Add support for login for AD users
- Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
certificates on smart cards (pkinit)
- ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
- IPA certauth plugin
- ipa-kdb: do not depend on certauth_plugin.h
- spec file: bump krb5-devel BuildRequires for certauth
- Resolves: #1264370 RFE: disable last successful authentication by default in
ipa.
- Set "KDC:Disable Last Success" by default
- Resolves: #1318186 Misleading error message during external-ca IPA master
install
- certs: do not implicitly create DS pin.txt
- httpinstance: clean up /etc/httpd/alias on uninstall
- Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
CA certificate chain in ... incomplete"
- certs: do not implicitly create DS pin.txt
- httpinstance: clean up /etc/httpd/alias on uninstall
- Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
- configure: fix --disable-server with certauth plugin
- rpcserver.login_x509: Actually return reply from __call__ method
- spec file: Bump requires to make Certificate Login in WebUI work
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- extdom: do reverse search for domain separator
- extdom: improve cert request
- Resolves: #1430363 [RFE] HBAC rule names command rename
- Reworked the renaming mechanism
- Allow renaming of the HBAC rule objects
- Resolves: #1433082 systemctl daemon-reload needs to be called after
httpd.service.d/ipa.conf is manipulated
- tasks: run `systemctl daemon-reload` after httpd.service.d updates
- Resolves: #1434032 Run ipa-custodia with custom SELinux context
- Use Custodia 0.3.1 features
- Resolves: #1434384 RPC client should use HTTP persistent connection
- Use connection keep-alive
- Add debug logging for keep-alive
- Increase Apache HTTPD's default keep alive timeout
- Resolves: #1434729 man ipa-cacert-manage install needs clarification
- man ipa-cacert-manage install needs clarification
- Resolves: #1434910 replica install against IPA v3 master fails with ACIError
- Fixing replica install: fix ldap connection in domlvl 0
- Resolves: #1435394 Ipa-kra-install fails with weird output when backspace is
used during typing Directory Manager password
- ipapython.ipautil.nolog_replace: Do not replace empty value
- Resolves: #1435397 ipa-replica-install can't install replica file produced by
ipa-replica-prepare on 4.5
- replica prepare: fix wrong IPA CA nickname in replica file
- Resolves: #1435599 WebUI: in self-service Vault menu item is shown even if
KRA is not installed
- WebUI: Fix showing vault in selfservice view
- Resolves: #1435718 As a ID user I cannot call a command with --rights option
- ldap2: use LDAP whoami operation to retrieve bind DN for current connection
- Resolves: #1436319 "Truncated search results" pop-up appears in user details
in WebUI
- WebUI: Add support for suppressing warnings
- WebUI: suppress truncation warning in select widget
- Resolves: #1436333 Uninstall fails with No such file or directory:
'/var/run/ipa/services.list'
- Create temporaty directories at the begining of uninstall
- Resolves: #1436334 WebUI: Adding certificate mapping data using certificate
fails
- WebUI: Allow to add certs to certmapping with CERT LINES around
- Resolves: #1436338 CLI doesn't work after ipa-restore
- Backup ipa-specific httpd unit-file
- Backup CA cert from kerberos folder
- Resolves: #1436342 Bump samba version, required for FIPS mode and privilege
separation
- Bump samba version for FIPS and priv. separation
- Resolves: #1436642 [ipalib/rpc.py] - "maximum recursion depth exceeded" with
ipa vault commands
- Avoid growing FILE ccaches unnecessarily
- Handle failed authentication via cookie
- Work around issues fetching session data
- Prevent churn on ccaches
- Resolves: #1436657 Add workaround for pki_pin for FIPS
- Generate PIN for PKI to help Dogtag in FIPS
- Resolves: #1436714 [vault] cache KRA transport cert
- Simplify KRA transport cert cache
- Resolves: #1436723 cert-find does not find all certificates without
sizelimit=0
- cert: do not limit internal searches in cert-find
- Resolves: #1436724 Renewal of IPA RA fails on replica
- dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
- Resolves: #1436753 Master tree fails to install
- httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not
available
- webui IdP: Remove arrow notation due to uglify-js limitation
Related: RHBZ#2141316
- Use java-1.8.0-openjdk-devel
- Update to upstream 2.2.0 alpha 1 (2.1.90.pre1)
- Support krb5 1.18
Resolves: RHBZ#1817579
- Fix ipa-replica-install crashes
- Fix ipa-server-install and ipa-dns-install logging
- Set minimum version of pki-ca to 9.0.17 to fix sslget problem
caused by FEDORA-2011-17400 update (#771357)
- Set minimum version of certmonger to 0.26 (to pck up #621670)
- Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
- Set minimum version of pki-ca to 1.3.6
- Set minimum version of sssd to 1.2.1
- diffstat was missing as a build dependency causing multilib problems
- Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
Resolves: RHBZ#1790663
- Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
certificates on smart cards (pkinit)
- spec file: bump krb5 Requires for certauth fixes
- Resolves: #1438729 Configure local PKINIT on DL0 or when '--no-pkinit' option
is used
- separate function to set ipaConfigString values on service entry
- Allow for configuration of all three PKINIT variants when deploying KDC
- API for retrieval of master's PKINIT status and publishing it in LDAP
- Use only anonymous PKINIT to fetch armor ccache
- Stop requesting anonymous keytab and purge all references of it
- Use local anchor when armoring password requests
- Upgrade: configure local/full PKINIT depending on the master status
- Do not test anonymous PKINIT after install/upgrade
- Resolves: #1442427 ipa.ipaserver.install.plugins.adtrust.
update_tdo_gidnumber: ERROR Default SMB Group not found
- upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
installed
- Resolves: #1442932 ipa restore fails to restore IPA user
- restore: restart/reload gssproxy after restore
- Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
- Fix CA/server cert validation in FIPS
- Resolves: #1444947 Deadlock between topology and schema-compat plugins
- compat-manage: behave the same for all users
- Move the compat plugin setup at the end of install
- compat: ignore cn=topology,cn=ipa,cn=etc subtree
- Resolves: #1445358 ipa vault-add raises TypeError
- vault: piped input for ipa vault-add fails
- Resolves: #1445382 ipa vault-retrieve fails to retrieve data from vault
- Vault: Explicitly default to 3DES CBC
- Resolves: #1445432 uninstall ipa client automount failed with RuntimeWarning
- automount install: fix checking of SSSD functionality on uninstall
- Resolves: #1446137 pki_client_database_password is shown in
ipaserver-install.log
- Hide PKI Client database password in log file
- Prepare spec file for release
- Using git snapshot 80e87e75bd6ab56e3e20c49ece55bd4d52f1a503
- Version bump for release
- Add missing ipa-selinux package
Resolves: RHBZ#1853263
- Remove unnecessary moving of v1 CA serial number file in post script
- Add Obsoletes for server-selinxu subpackage
- Using git snapshot 442d6ad30ce1156914e6245aa7502499e50ec0da
- PassSync does not sync passwords due to missing ACIs (#1181093)
- ipa-replica-manage list does not list synced domain (#1181010)
- Do not assume certmonger is running in httpinstance (#1181767)
- ipa-replica-manage disconnect fails without password (#1183279)
- Put LDIF files to their original location in ipa-restore (#1175277)
- DUA profile not available anonymously (#1184149)
- IPA replica missing data after master upgraded (#1176995)
- Included LICENSE and README in all packages for documentation
- Move user-modifiable content to /etc/ipa and linked back to
/usr/share/ipa/html
- Changed some references to /usr to the {_usr} macro and /etc
to {_sysconfdir}
- Added popt-devel to BuildRequires for Fedora 8 and higher and
popt for Fedora 7
- Package the egg-info for Fedora 9 and higher for ipa-python
- Updated to upstream 3.0.0 beta 2
- 2.1.3
- Force to use 389-ds 1.2.10-0.8.a7 or above
- Improve upgrade script to handle systemd 389-ds change
- Fix freeipa to work with python-ldap 2.4.6
- Fix bug #702633
- Resolves: #1256840 [webui] majority of required fields is no longer marked as
required
- fix missing information in object metadata
- Resolves: #1256842 [webui] no option to choose trust type when creating a
trust
- webui: add option to establish bidirectional trust
- Resolves: #1256853 Clear text passwords in KRA install log
- Removed clear text passwords from KRA install log.
- Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
discouraged
- vault: change default vault type to symmetric
- Resolves: #1257163 renaming certificatte profile with --rename option leads
to integrity issues
- certprofile: prevent rename (modrdn)
- Allow the admin user to be disabled
Resolves: RHEL-34756
- ipa-otptoken-import: open the key file in binary mode
Resolves: RHEL-39616
- ipa-crlgen-manage: manage the cert status task execution time
Resolves: RHEL-30280
- idrange-add: add a warning because 389ds restart is required
Resolves: RHEL-28996
- PKINIT certificate: fix renewal on hidden replica
Resolves: RHEL-4913, RHEL-45908
- Mass rebuild 2014-01-24
- Require certmonger 0.79.7-1
Related: RHBZ#1708095
- Do not check if port 8443 is available in step 2 of external CA install
(#1129481)
- Resolves: #1249226 IPA dnssec-validation not working for AD dnsforwardzone
- DNSSEC: fix forward zone forwarders checks
- Resolves: #1250190 idrange is not added for sub domain
- trusts: format Kerberos principal properly when fetching trust topology
- Resolves: #1252334 User life cycle: missing ability to provision a stage user
from a preserved user
- Add user-stage command
- Resolves: #1252863 After applying RHBA-2015-1554 errata, IPA service fails to
start.
- spec file: Add Requires(post) on selinux-policy
- Resolves: #1254304 Changing vault encryption attributes
- Change internal rsa_(public|private)_key variable names
- Added support for changing vault encryption.
- Resolves: #1256715 Executing user-del --preserve twice removes the user
pernamently
- improve the usability of `ipa user-del --preserve` command
- Pull upstream changelog 608 which renamed several files
- Fix for CVE-2008-3274
- Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
- Add fix for bug #453185
- Rebuild against openldap libraries, mozldap ones do not work properly
- TurboGears is currently broken in rawhide. Added patch to not build
the UI locales and removed them from the ipa-server files section.
- Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
- Fix regression introduced in ipa-certupdate
- Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
- Do not initialize API in ipa-client-automount uninstall
- Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
client changes
- idrange: fix unassigned global variable
- Resolves: #1360792 Migrating users doesn't update krbCanonicalName
- re-set canonical principal name on migrated users
- Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
and 'bool' objects
- Fix ipa hbactest output
- Resolves: #1362260 ipa vault-mod no longer allows defining salt
- vault: add missing salt option to vault_mod
- Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
public key
- vault: Catch correct exception in decrypt
- Resolves: #1362537 ipa-server-install fails to create symlink from
/etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
- Correct path to HTTPD's systemd service directory
- Resolves: #1363756 Increase length of passwords generated by installer
- Increase default length of auto generated passwords
- Update to upstream 3.3.0 Beta 2 (#991064)
- Update Requires on pki-ca to 10.1.2-4 (#1129558)
- build: increase java stack size for all arches
- Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
- Fix dns zonemgr validation regression (#1056202)
- Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
- Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
(#886645)
- Add bind-dyndb-ldap working dir to IPA specfile
- Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
(#886645)
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
- Deadlock in schema compat plugin (#1161131)
- ipactl stop should stop dirsrv last (#1161129)
- Upgrade 3.3.5 to 4.1 failed (#1161128)
- CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)
- Fix status trust-add command status message (#910453)
- NetBIOS was not trimmed at 15 characters (#1030517)
- Harden CA subsystem certificate renewal on CA clones (#1040018)
- remove ipa-fix-CVE-2008-3274
- Resolves: #1382812 Creation of replica for disconnected environment is
failing with CA issuance errors; Need good steps.
- gracefully handle setting replica bind dn group on old masters
- Resolves: #1397439 ipa-ca-install on promoted replica hangs on creating a
temporary CA admin
- replication: ensure bind DN group check interval is set on replica config
- add missing attribute to ipaca replica during CA topology update
- Resolves: #1401088 IPA upgrade of replica without DNS fails during restart of
named-pkcs11
- bindinstance: use data in named.conf to determine configuration status
- Resolves: #1348948 IPA server install fails with build
ipa-server-4.4.0-0.el7.1.alpha1
- Revert "Increased mod_wsgi socket-timeout"
- Resolves: #1449189 ipa-kra-install timeouts on replica
- ipa-kra-install: fix check_host_keys
- Require python-wehjit >= 0.2.0
- Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
- Resolves: #1375269 ipa trust-fetch-domains throws internal error
- Set minimum level of 389-ds-base to 1.2.7 for enhanced memberof plugin
- Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
- ipa-sam: replace encode_nt_key() with E_md4hash()
- ipa_pwd_extop: do not generate NT hashes in FIPS mode
- Resolves: #1377973 ipa-server-install fails when the provided or resolved
IP address is not found on local interfaces
- Fix local IP address validation
- ipa-dns-install: remove check for local ip address
- refactor CheckedIPAddress class
- CheckedIPAddress: remove match_local param
- Remove ip_netmask from option parser
- replica install: add missing check for non-local IP address
- Remove network and broadcast address warnings
- Resolves: #1477178 - [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic
key for host
- Always check peer has keys before connecting
- Resolves: #1482802 - Unable to set ca renewal master on replica
- Fix ipa config-mod --ca-renewal-master
- Resolves: #1486283 - TypeError in renew_ca_cert prevents from swiching
back to self-signed CA
- Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
- Resolves: #1480102 - ipa-server-upgrade failes with "This entry already exists"
- Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
- Resolves: #1484826 - FreeIPA/IdM installations which were upgraded from
versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
thus startup of Web UI fails
- Adds whoami DS plugin in case that plugin is missing
- Resolves: #1478251 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
- Fixing how sssd.conf is updated when promoting a client to replica
- Resolves: #1461177 - ipa-otptoken-import - XML file is missing PBKDF2
parameters!
- ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
- Resolves: #1484428 - Updating from RHEL 7.3 fails with Server-Cert not found
(ipa-server-upgrade)
- Backport 4-5: Fix ipa-server-upgrade with server cert tracking
- kdb: Use-krb5_pac_full_sign_compat() when available
Resolves: RHBZ#2176406
- OTP: fix-data-type-to-avoid-endianness-issue
Resolves: RHBZ#2218293
- Upgrade: fix replica agreement
Resolves: RHBZ#2216551
- Upgrade: add PKI drop-in file if missing
Resolves: RHBZ#2215336
- Use the python-cryptography parser directly in cert-find
Resolves: RHBZ#2164349
- Backport test updates
Resolves: RHBZ#221884
- Initial rpm version
- SELinux Policy: let custodia replicate keys
Resolves: RHBZ#1868432
- Update slapi-nis dependency to pull 0.54-2 (#891984)
- ipa-restore: Don't crash if AD trust is not installed (#951581)
- Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
- Trust setting not restored for CA cert with ipa-restore command (#1159011)
- ipa-server-install fails when restarting named (#1162340)
- Rebuild against samba4 beta8
- Resolves: #1170770 [AD TRUST]IPA should detect inconsistent realm domains
that conflicts with AD DC
- trusts: Check for AD root domain among our trusted domains
- Resolves: #1195339 ipa-client-install changes the label on various files
which causes SELinux denials
- sysrestore: copy files instead of moving them to avoind SELinux issues
- Resolves: #1196656 [ipa-client][rhel71] enable debugging for spawned
commands / ntpd -qgc $tmpfile hangs
- enable debugging of ntpd during client installation
- Resolves: #1205264 Migration UI Does Not Work When Anonymous Bind is Disabled
- migration: Use api.env variables.
- Resolves: #1212719 abort-clean-ruv subcommand should allow
replica-certifyall: no
- Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand
- Resolves: #1216935 ipa trust-add shows ipa: ERROR: an internal error has
occurred
- dcerpc: Expand explanation for WERR_ACCESS_DENIED
- dcerpc: Fix UnboundLocalError for ccache_name
- Resolves: #1222778 idoverride group-del can delete user and user-del can
delete group
- dcerpc: Add get_trusted_domain_object_type method
- idviews: Restrict anchor to name and name to anchor conversions
- idviews: Enforce objectclass check in idoverride*-del
- Resolves: #1234919 Be able to request certificates without certmonger service
running
- cermonger: Use private unix socket when DBus SystemBus is not available.
- ipa-client-install: Do not (re)start certmonger and DBus daemons.
- Resolves: #1240939 Please add dependency on bind-pkcs11
- Create server-dns sub-package.
- ipaplatform: Add constants submodule
- DNS: check if DNS package is installed
- Resolves: #1242914 Bump minimal selinux-policy and add booleans to allow
calling out oddjobd-activated services
- selinux: enable httpd_run_ipa to allow communicating with oddjobd services
- Resolves: #1243261 non-admin users cannot search hbac rules
- fix hbac rule search for non-admin users
- fix selinuxusermap search for non-admin users
- Resolves: #1243652 Client has missing dependency on memcache
- do not import memcache on client
- Resolves: #1243835 [webui] user change password dialog does not work
- webui: fix user reset password dialog
- Resolves: #1244802 spec: selinux denial during kdcproxy user creation
- Fix selinux denial during kdcproxy user creation
- Resolves: #1246132 trust-fetch-domains: Do not chown keytab to the sssd user
- oddjob: avoid chown keytab to sssd if sssd user does not exist
- Resolves: #1246136 Adding a privilege to a permission avoids validation
- Validate adding privilege to a permission
- Resolves: #1246141 DNS Administrators cannot search in zones
- DNS: Consolidate DNS RR types in API and schema
- Resolves: #1246143 User plugin - user-find doesn't work properly with manager
option
- fix broken search for users by their manager
- ipa-kdb: Detect and block Bronze-Bit attacks
Resolves: RHEL-9984
- Fix for CVE-2023-5455
Resolves: RHEL-12578
- Temporarily move ipa-backup and ipa-restore functionality
back to make them available in public Beta (#1003933)
- Added patch to fix problem reported by ldapmodify
- Add dependency for python-krbV
- Resolves: #1438833 [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic key for
host
- Make sure remote hosts have our keys
- Resolves: #1442815 Replica install fails during migration from older IPA
master
- Refresh Dogtag RestClient.ca_host property
- Remove the cachedproperty class
- Resolves: #1444787 Update warning message when KRA installation fails
- kra install: update installation failure message
- Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
- ipa-server-install with external CA: fix pkinit cert issuance
- Resolves: #1445397 GET in KerberosSession.finalize_kerberos_acquisition()
must use FreeIPA CA
- kerberos session: use CA cert with full cert chain for obtaining cookie
- Resolves: #1447375 ipa-client-install: extra space in pkinit_anchors
definition
- ipa-client-install: remove extra space in pkinit_anchors definition
- Resolves: #1447703 Fix SELinux contex of http.keytab during upgrade
- Use proper SELinux context with http.keytab
- Fix upgrade issue with AD trust when no trust yet established
Fixes: RHBZ#1708874
Related: RHBZ#1684528
- Resolves: #1131907 [ipa-client-install] cannot write certificate file
'/etc/ipa/ca.crt.new': must be string or buffer, not None
- Resolves: #1195775 unsaved changes dialog internally inconsistent
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- Stageusedr-activate: show username instead of DN
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Prevent to rename certprofile profile id
- Resolves: #1222047 IPA to AD Trust: IPA ERROR 4016: Remote Retrieve Error
- Resolves: #1224769 copy-schema-to-ca.py does not overwrites schema files
- copy-schema-to-ca: allow to overwrite schema files
- Resolves: #1241941 kdc component installation of IPA failed
- spec file: Update minimum required version of krb5
- Resolves: #1242036 Replica install fails to update DNS records
- Fix DNS records installation for replicas
- Resolves: #1242884 Upgrade to 4.2.0 fails when enabling kdc proxy
- Start dirsrv for kdcproxy upgrade
- ipa-kdb: fix error handling of is_master_host()
Resolves: RHBZ#2214638
- ipatests: enable firewall rule for http service on acme client
Resolves: RHBZ#2230256
- User plugin: improve error related to non existing idp
Resolves: RHBZ#2224572
- Prevent admin user from being deleted
Resolves: RHBZ#1821181
- Fix memory leak in the OTP last token plugin
Resolves: RHBZ#2227783
- Fix Fedora package changelog after merging systemd changes
- Backport latest test fixes in python3-ipatests
Resolves: RHBZ#2060841
- extdom: user getorigby{user|group}name if available
Resolves: RHBZ#2062379
- Set the mode on ipaupgrade.log during RPM post snipppet
Resolves: RHBZ#2061957
- test_krbtpolicy: skip SPAKE-related tests in FIPS mode
Resolves: RHBZ#1909630
- Fixed kdcproxy_version to 0.4-3
- Fixed krb5_version to 1.17-7
Related: RHBZ#1684528
- Handle NFS configuration file changes. nfs-utils moved the
configuration file from /etc/sysconfig/nfs to /etc/nfs.conf.
Resolves: RHBZ#1676981
- webui: Allow grace login limit
Resolves: RHBZ#2109243
- check_repl_update: in progress is a boolean
Resolves: RHBZ#2117303
- Disabling gracelimit does not prevent LDAP binds
Resolves: RHBZ#2109236
- Set passwordgracelimit to match global policy on group pw policies
Resolves: RHBZ#2115475
- Add Requires on krb5-pkinit-openssl
- Upstream release FreeIPA 4.9.6
Related: RHBZ#1945038
- Revise PKINIT upgrade code
Resolves: RHBZ#1886837
- ipa-cert-fix man page: add note about certmonger renewal
Resolves: RHBZ#1780317
- Certificate Serial Number issue
Resolves: RHBZ#1919384
- Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
- Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to
handle PKINIT certificates/anchors
- certdb: add named trust flag constants
- certdb, certs: make trust flags argument mandatory
- certdb: use custom object for trust flags
- install: trust IPA CA for PKINIT
- client install: fix client PKINIT configuration
- install: introduce generic Kerberos Augeas lens
- server install: fix KDC PKINIT configuration
- ipapython.ipautil.run: Add option to set umask before executing command
- certs: do not export keys world-readable in install_key_from_p12
- certs: do not export CA certs in install_pem_from_p12
- server install: fix KDC certificate validation in CA-less
- replica install: respect --pkinit-cert-file
- cacert manage: support PKINIT
- server certinstall: support PKINIT
- Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
option
- certs: do not export CA certs in install_pem_from_p12
- server install: fix KDC certificate validation in CA-less
- Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
decommissioned
- ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname
- Resolves: #1451712 KRA installation fails on server that was originally
installed as CA-less
- ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
- Resolves: #1441499 ipa cert-show does not raise error if no file name
specified
- ca/cert-show: check certificate_out in options
- Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
- Remove pkinit-anonymous command
- Resolves: #1449523 Provide an API command to retrieve PKINIT status
in the FreeIPA topology
- Allow for multivalued server attributes
- Refactor the role/attribute member reporting code
- Add an attribute reporting client PKINIT-capable servers
- Add the list of PKINIT servers as a virtual attribute to global config
- Add `pkinit-status` command
- test_serverroles: Get rid of MockLDAP and use ldap2 instead
- Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
- Fix rare race condition with missing ccache file
- Resolves: #1455045 Simple service uninstallers must be able to handle
missing service files gracefully
- only stop/disable simple service if it is installed
- Resolves: #1455541 after upgrade login from web ui breaks
- krb5: make sure KDC certificate is readable
- Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
command "ipa cert-request --add" after upgrade
- Change python-cryptography to python2-cryptography
- Require krb5 release 1.18.2-25 or later
Resolves: RHBZ#2234711
- Rebase ipa to 4.9.12
Resolves: RHBZ#2196425
- user or group name: explain the supported format
Resolves: RHBZ#2150217
- Allow insecure binds for migration
Resolves: RHBZ#1731963
- Trust add tries to add same value of --base-id for sub domain,
causing an error (#1033068)
- Improved error reporting for adding trust case (#1029856)
- Do not fetch a principal two times, remove potential memory leak (#1070924)
- Depend on krb5-kdb-version-devel for BuildRequires
- Update nss dependency to 3.44.0-4
- Reset per-indicator Kebreros policy
Resolves: RHBZ#1784761
- Resolves: #1339233 CA installed on replica is always marked as renewal master
- Related: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.3.1.201605241723GIT1b427d3
- Pull upstream changelog 722
- Add Conflicts mod_ssl (435360)
- Use default ssh host key algorithms
Resolves: RHBZ#1756432
- Do not run trust upgrade code if master lacks Samba bindings
Resolves: RHBZ#1757064
- Finish group membership management UI
Resolves: RHBZ#1773528
- Add ipa-host-net-manage script
- Use the OpenSSL certificate parser in cert-find
Resolves: RHBZ#2209947
- Add a- heck into ipa-cert-fix tool to avoid updating certs if CA is close to expire
Resolves: RHEL-4941
- Fix rpminspect's 'patches' warnings
Resolves: RHEL-22497
- replica install failing with avc denial for custodia component
Resolves: RHBZ#1857157
- Upstream pre release FreeIPA 4.9.0rc1
Resolves: RHBZ#1891832
- Requirements and design for libpwquality integration
Resolves: RHBZ#1340463
- When parsing options require name/value pairs
Resolves: RHBZ#1357495
- WebUI: Fix issue with opening links in new tab/window
Resolves: RHBZ#1484088
- Use a state to determine if a 389-ds upgrade is in progress
Resolves: RHBZ#1569011
- Unlock user accounts after a password reset and replicate that unlock to
all IdM servers
Resolves: RHBZ#1784657
- Set the certmonger subject with a string, not an object
Resolves: RHBZ#1810148
- Implement ACME certificate enrolment
Resolves: RHBZ#1851835
- [WebUI] Backport jQuery patches from newer versions of the library (e.g.
3.5.0)
Resolves: RHBZ#1859249
- It is not possible to edit KDC database when the FreeIPA server is running
Resolves: RHBZ#1875001
- Fix nsslapd-db-lock tuning of BDB backend
Resolves: RHBZ#1882340
- ipa-kdb: support subordinate/superior UPN suffixes
Resolves: RHBZ#1891056
- wgi/plugins.py: ignore empty plugin directories
Resolves: RHBZ#1894800
- Default to systemd for Fedora 16 and onwards
- Update to upstream 3.2.0 GA
- ipa-client-install fails if /etc/ipa does not exist (#961483)
- Certificate status is not visible in Service and Host page (#956718)
- ipa-client-install removes needed options from ldap.conf (#953991)
- Handle socket.gethostbyaddr() exceptions when verifying hostnames (#953957)
- Add triggerin scriptlet to support OpenSSH 6.2 (#953617)
- Require nss 3.14.3-12.0 to address certutil certificate import
errors (#953485)
- Require pki-ca 10.0.2-3 to pull in fix for sslget and mixed IPv4/6
environments. (#953464)
- ipa-client-install removes 'sss' from /etc/nsswitch.conf (#953453)
- ipa-server-install --uninstall doesn't stop dirsrv instances (#953432)
- Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for
socket based connections (#960222)
- Require libsss_nss_idmap-python
- Add Conflicts on nss-pam-ldapd < 0.8.4. The mapping from uniqueMember to
member is now done automatically and having it in the config file raises
an error.
- Add backup and restore tools, directory.
- require at least systemd 38 which provides the journal (we no longer
need to require syslog.target)
- Update Requires on policycoreutils to 2.1.14-37
- Update Requires on selinux-policy to 3.12.1-42
- Update Requires on 389-ds-base to 1.3.1.0
- Remove a Requires for java-atk-wrapper
- Preserve user: fix the confusing summary
Resolves: RHBZ#2022028
- Only calculate LDAP password grace when the password is expired
Related: RHBZ#782917
- Resolves: #1260663 crash of ipa-dnskeysync-replica component during
ipa-restore
- IPA Restore: allows to specify files that should be removed
- Resolves: #1261806 Installing ipa-server package breaks httpd
- Handle timeout error in ipa-httpd-kdcproxy
- Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
- Server Upgrade: backup CS.cfg when dogtag is turned off
- ipa-server-install crashes when AD subpackage is not installed (#1026434)
- Resolves: #1228671 pkispawn fails in ipa-ca-install and ipa-kra-install
- Related: #1204809 Rebase ipa to 4.2
- Fix minimum version of slapi-nis
- Require python-sss and python-sss-murmur (provided by sssd-1.13.0)
- Drop conflicts on mod_nss
- Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
- Drop a slew of conditionals on older Fedora releases (< 12)
- Add a few conditionals against RHEL 6
- Add Requires of nss-tools on ipa-client
- Upstream release FreeIPA 4.9.3
Resolves: RHBZ#1945038
- Fix systemd-user HBAC rule
Resolves: RHBZ#1664974
- sudo rule for "admins" members should be created by default (#1609873)
- New upstream release 1.2.1
- Updated to current upstream state of 3.0.0 beta 2 development
- Wrong directories created on full restore (#1186398)
- ipa-restore crashes if replica is unreachable (#1186396)
- idoverrideuser-add option --sshpubkey does not work (#1185410)
- Missing objectclasses when empty password passed to host-add (#1052979)
- sudoOrder missing in sudoers (#1052983)
- Missing examples in sudorule help (#1049464)
- Client automount does not uninstall when fstore is empty (#910899)
- Error not clear for invalid realm given to trust-fetch-domains (#1052981)
- trust-fetch-domains does not add idrange for subdomains found (#1049926)
- Add option to show if an AD subdomain is enabled/disabled (#1052973)
- ipa-adtrust-install still failed with long NetBIOS names (#1030517)
- Error not clear for invalid relam given to trustdomain-find (#1049455)
- renewed client cert not recognized during IPA CA renewal (#1033273)
- Revert bind-pkcs11-utils configuration in freeipa.spec.
Resolves: RHBZ#2026732
- Replace TurboGears requirement with python-cherrypy
- Update to upstream 3.2.1
- Drop dogtag-pki-server-theme requires, it won't be build for RHEL-7.0
- Remove ipa-idoverride-memberof as superceded by ipa-server 4.8.7
Resolves: RHBZ#1846434
- Respin after the tarball has been re-released upstream
New hash is 506c9c92dcaf9f227cba5030e999f177
- Allow Web-based migration to work with tightened SE Linux policy (#769440)
- Rebuild slapi plugins against re-enterant version of libldap
- Remove strict dependencies to krb5-server version in order to allow
update of krb5 to 1.17 and change dependency to KDB DAL version.
Resolves: RHBZ#1700121
- Fixed: rhbz#1643445 - External CA step 2 fails with pki_client_database_dir is missing
- Fixed: rhbz#1642834 - Smart card advise script uses hard-coded Python interpreter
- Resolves: #1277696 IPA certificate auto renewal fail with "Invalid
Credential"
- cert renewal: make renewal of ipaCert atomic
- Resolves: #1278330 installer options are not validated at the beginning of
installation
- install: fix command line option validation
- Resolves: #1282845 sshd_config change on ipa-client-install can prevent sshd
from starting up
- client install: do not corrupt OpenSSH config with Match sections
- Resolves: #1282935 ipa upgrade causes vault internal error
- install: export KRA agent PEM file in ipa-kra-install
- Resolves: #1283429 Default CA ACL rule is not created during
ipa-replica-install
- TLS and Dogtag HTTPS request logging improvements
- Avoid race condition caused by profile delete and recreate
- Do not erroneously reinit NSS in Dogtag interface
- Add profiles and default CA ACL on migration
- disconnect ldap2 backend after adding default CA ACL profiles
- do not disconnect when using existing connection to check default CA ACLs
- Resolves: #1283430 ipa-kra-install: fails to apply updates
- suppress errors arising from adding existing LDAP entries during KRA
install
- Resolves: #1283748 Caching of ipaconfig does not work in framework
- fix caching in get_ipa_config
- Resolves: #1283943 IPA DNS Zone/DNS Forward Zone details missing after
upgrade from RHEL 7.0 to RHEL 7.2
- upgrade: fix migration of old dns forward zones
- Fix upgrade of forwardzones when zone is in realmdomains
- Resolves: #1284413 ipa-cacert-manage renew fails on nonexistent ldap
connection
- ipa-cacert-renew: Fix connection to ldap.
- Resolves: #1284414 ipa-otptoken-import fails on nonexistent ldap connection
- ipa-otptoken-import: Fix connection to ldap.
- Resolves: #1286635 IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using
"yum update ipa* sssd"
- Set minimal required version for openssl
- Resolves: #1286781 ipa-nis-manage does not update ldap with all NIS maps
- Upgrade: Fix upgrade of NIS Server configuration
- Resolves: #1289311 umask setting causes named-pkcs11 issue with directory
permissions on /var/lib/ipa/dnssec
- DNS: fix file permissions
- Explicitly call chmod on newly created directories
- Fix: replace mkdir with chmod
- Resolves: #1290142 Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
- Fix version comparison
- use FFI call to rpmvercmp function for version comparison
- Resolves: #1292595 In IPA-AD trust environment some secondary IPA based Posix
groups are missing
- ipa-kdb: map_groups() consider all results
- Resolves: #1293870 User should be notified for wrong password in password
reset page
- Fixed login error message box in LoginScreen page
- Resolves: #1296196 Sysrestore did not restore state if a key is specified in
mixed case
- Allow to used mixed case for sysrestore
- Resolves: #1296214 DNSSEC key purging is not handled properly
- DNSSEC: Improve error reporting from ipa-ods-exporter
- DNSSEC: Make sure that current state in OpenDNSSEC matches key state in
LDAP
- DNSSEC: Make sure that current key state in LDAP matches key state in BIND
- DNSSEC: remove obsolete TODO note
- DNSSEC: add debug mode to ldapkeydb.py
- DNSSEC: logging improvements in ipa-ods-exporter
- DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP
- DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
- DNSSEC: ipa-ods-exporter: add ldap-cleanup command
- DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removal
- DNSSEC: Log debug messages at log level DEBUG
- Resolves: #1296216 ipa-server-upgrade fails if certmonger is not running
- prevent crash of CA-less server upgrade due to absent certmonger
- always start certmonger during IPA server configuration upgrade
- Resolves: #1297811 The ipa -e skip_version_check=1 still issues
incompatibility error when called against RHEL 6 server
- ipalib: assume version 2.0 when skip_version_check is enabled
- Resolves: #1298289 install fails when locale is "fr_FR.UTF-8"
- Do not decode HTTP reason phrase from Dogtag
- Resolves: #1300252 shared certificateProfiles container is missing on a
freshly installed RHEL7.2 system
- upgrade: unconditional import of certificate profiles into LDAP
- Resolves: #1301674 --setup-dns and other options is forgotten for using an
external PKI
- installer: Propagate option values from components instead of copying them.
- installer: Fix logic of reading option values from cache.
- Resolves: #1301687 issues with migration from RHEL 6 self-signed to RHEL 7 CA
IPA setup
- ipa-ca-install: print more specific errors when CA is already installed
- cert renewal: import all external CA certs on IPA CA cert renewal
- CA install: explicitly set dogtag_version to 10
- fix standalone installation of externally signed CA on IPA master
- replica install: validate DS and HTTP server certificates
- replica install: improvements in the handling of CA-related IPA config
entries
- Resolves: #1301901 [RFE] compat tree: show AD members of IPA groups
- slapi-nis: update configuration to allow external members of IPA groups
- Resolves: #1305533 ipa trust-add succeded but after that ipa trust-find
returns "0 trusts matched"
- upgrade: fix config of sidgen and extdom plugins
- trusts: use ipaNTTrustPartner attribute to detect trust entries
- Warn user if trust is broken
- fix upgrade: wait for proper DS socket after DS restart
- Insure the admin_conn is disconnected on stop
- Fix connections to DS during installation
- Fix broken trust warnings
- Resolves: #1321092 Installers fail when there are multiple versions of the
same certificate
- certdb: never use the -r option of certutil
- Related: #1317381 Crash during IPA upgrade due to slapd
- spec file: update minimum required version of slapi-nis
- Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112
CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws
[rhel-7.3]
- Rebuild against newer Samba version
- RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
(#1169591)
- CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
(#1172578)
- Re-arrange doc and defattr to clean up rpmlint warnings
- Remove conditionals on older releases
- Move some man pages into admintools subpackage
- Remove some explicit Requires in client that aren't needed
- Consistent use of buildroot vs RPM_BUILD_ROOT
- Update to upstream 3.3.1 (#991064)
- Update minimum version of bind-dyndb-ldap to 3.5
- Remove release from krb5-server in strict sub-package to allow for rebuilds.
- Fix krb5-kdb-server -> krb5-kdb-version
Related: RHBZ#1700121
- Unified spec file
- Update to upstream 3.1.2
- CVE-2012-4546: Incorrect CRLs publishing
- CVE-2012-5484: MITM Attack during Join process
- CVE-2013-0199: Cross-Realm Trust key leak
- Updated strict dependencies to 389-ds-base = 1.3.0.2 and
pki-ca = 10.0.1
- IPA Replicate creation fails with error "Update failed! Status: [10 Total
update abortedLDAP error: Referral]" (#1166265)
- running ipa-server-install --setup-dns results in a crash (#1072502)
- DNS zones are not migrated into forward zones if 4.0+ replica is added
(#1175384)
- gid is overridden by uid in default trust view (#1168904)
- When migrating warn user if compat is enabled (#1177133)
- Clean up debug log for trust-add (#1168376)
- No error message thrown on restore(full kind) on replica from full backup
taken on master (#1175287)
- ipa-restore proceed even IPA not configured (#1175326)
- Data replication not working as expected after data restore from full backup
(#1175277)
- IPA externally signed CA cert expiration warning missing from log (#1178128)
- ipa-upgradeconfig fails in CA-less installs (#1181767)
- IPA certs fail to autorenew simultaneouly (#1173207)
- More validation required on ipa-restore's options (#1176034)
- Installer did not detect different server and IPA domain (#1026845)
- Allow kernel keyring CCACHE when supported (#1026861)
- Resolves: #1442233 IPA client commands fail when pointing to replica
- httpinstance: wait until the service entry is replicated
- Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
not indexed
- Fix index definition for ipaAnchorUUID
- Resolves: #1438016 gssapi errors after IPA server upgrade
- Avoid possible endless recursion in RPC call
- rpc: preparations for recursion fix
- rpc: avoid possible recursion in create_connection
- Resolves: #1446087 services entries missing krbCanonicalName attribute.
- Changing cert-find to do not use only primary key to search in LDAP.
- Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
- ipa-kdb: reload certificate mapping rules periodically
- Resolves: #1455541 after upgrade login from web ui breaks
- kdc.key should not be visible to all
- Resolves: #1435606 Add pkinit_indicator option to KDC configuration
- ipa-kdb: add pkinit authentication indicator in case of a successful
certauth
- Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
issuance when ipa-ca records are not resolvable
- Turn off OCSP check
- Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
server_del - TypeError: 'NoneType' object is not iterable
- fix incorrect suffix handling in topology checks
- Hardening for CVE-2020-25717
- Related: RHBZ#2019668
- Require python-wehjit >= 0.2.2
- Resolves: #837369 [RFE] Switch to client promotion to replica model
- Resolves: #1199516 [RFE] Move replication topology to the shared tree
- Resolves: #1206588 [RFE] Visualize FreeIPA server replication topology
- Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
- Resolves: #1212713 ipa-csreplica-manage: it could be nice to have also
list-ruv / clean-ruv / abort-clean-ruv for o=ipaca backend
- Resolves: #1267206 ipa-server-install uninstall should warn if no
installation found
- Resolves: #1295865 The Domain option is not correctly set in idmapd.conf when
ipa-client-automount is executed.
- Resolves: #1327092 URI details missing and OCSP-URI details are incorrectly
displayed when certificate generated using IPA on RHEL 7.2up2.
- Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
because of missing dependencies
- Related: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.3.1.201605191449GITf8edf37
- Update to upstream 4.6.90.pre1
- Resolves: #1355753 adding two way non transitive(external) trust displays
internal error on the console
- Always fetch forest info from root DCs when establishing two-way trust
- factor out `populate_remote_domain` method into module-level function
- Always fetch forest info from root DCs when establishing one-way trust
- Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
after `ipa-replica-install`
- Track lightweight CAs on replica installation
- Resolves: #1357488 ipa command stuck forever on higher versioned client with
lower versioned server
- compat: Save server's API version in for pre-schema servers
- compat: Fix ping command call
- schema cache: Store and check info for pre-schema servers
- Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
- Fix man page ipa-replica-manage: remove duplicate -c option
from --no-lookup
- Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
when revoking certificate
- cert: include CA name in cert command output
- WebUI add support for sub-CAs while revoking certificates
- Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
- Add support for additional options taken from table facet
- WebUI: Fix showing certificates issued by sub-CA
- Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
internactively
- dns: normalize record type read interactively in dnsrecord_add
- dns: prompt for missing record parts in CLI
- dns: fix crash in interactive mode against old servers
- Resolves: #1370519 Certificate revocation in service-del and host-del isn't
aware of Sub CAs
- cert: fix cert-find --certificate when the cert is not in LDAP
- Make host/service cert revocation aware of lightweight CAs
- Resolves: #1371901 Use OAEP padding with custodia
- Use RSA-OAEP instead of RSA PKCS#1 v1.5
- Resolves: #1371915 When establishing external two-way trust, forest root
Administrator account is used to fetch domain info
- do not use trusted forest name to construct domain admin principal
- Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
certificate request
- Fix CA ACL Check on SubjectAltNames
- Resolves: #1373272 CLI always sends default command version
- cli: use full name when executing a command
- Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
- Fix ipa-certupdate for CA-less installation
- Resolves: #1373540 client-install with IPv6 address fails on link-local
address (always)
- Fix parse errors with link-local addresses
- man page: update ipa-server-upgrade.1
Resolves: RHBZ#1973273
- Fall back to krbprincipalname when validating host auth indicators
Resolves: RHBZ#1979625
- Add dependency for sssd-winbind-idmap to server-trust-ad
Resolves: RHBZ#1982211
- Fix replica installation failing on certificate subject (#983075)
- Rebase ipa to 4.9.11
Resolves: RHBZ#2141316
- updates: fix memberManager ACI to allow managers from a specified group
Resolves: RHBZ#2056009
- Defer creating the final krb5.conf on clients
Resolves: RHBZ#2148259
- Exclude installed policy module file from RPM verification
Resolves: RHBZ#2149567
- Spec file: ipa-client depends on krb5-pkinit-openssl
Resolves: RHBZ#2149889
- When IdM server trusts multiple AD forests, IPA client returns invalid group
membership info (#1079498)
- IPA server in debug mode fails to run because time.perf_counter_ns is
Python 3.7+
Resolves: RHBZ#1974822
- Add checks to prevent assigning authentication indicators to internal IPA
services
Resolves: RHBZ#1979625
- Unable to set ipaUserAuthType with stageuser-add
Resolves: RHBZ#1979605
- Replica installation fails for RHEL 6.4 master (#1004680)
- Server uninstallation crashes if DS is not available (#998069)
- Updated to upstream 3.1.0 GA
- Set minimum for sssd to 1.9.2
- Set minimum for pki-ca to 10.0.0-1
- Set minimum for 389-ds-base to 1.3.0
- Set minimum for selinux-policy to 3.11.1-60
- Remove unneeded dogtag package requires
- Updated to upstream 3.0.0 rc 1
- Update BR for 389-ds-base to 1.2.11.14
- Update BR for krb5 to 1.10
- Update BR for samba4-devel to 4.0.0-139 (rc1)
- Add BR for python-polib
- Update BR and Requires on sssd to 1.9.0
- Update Requires on policycoreutils to 2.1.12-5
- Update Requires on 389-ds-base to 1.2.11.14
- Update Requires on selinux-policy to 3.11.1-21
- Update Requires on dogtag to 10.0.0-0.33.a1
- Update Requires on certmonger to 0.60
- Update Requires on tomcat to 7.0.29
- Update minimum version of bind to 9.9.1-10.P3
- Update minimum version of bind-dyndb-ldap to 1.1.0-0.16.rc1
- Remove Requires on authconfig from python sub-package
- Update Requires on krb5-server to 1.11
- Moved directory install/static to install/ui
- Fix ipa-pwd-extop global configuration caching (#1187342)
- group-detach does not add correct objectclasses (#1187540)
- Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
- Keep NSS trust flags of existing certificates
- Resolves: #1360813 ipa-server-certinstall does not update all certificate
stores and doesn't set proper trust permissions
- Add cert checks in ipa-server-certinstall
- Resolves: #1371479 cert-find --all does not show information about revocation
- cert: add revocation reason back to cert-find output
- Resolves: #1375133 WinSync users who have First.Last casing creates users who
can have their password set
- ipa passwd: use correct normalizer for user principals
- Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
- Properly handle LDAP socket closures in ipa-otpd
- Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
- Make httpd publish its CA certificate on DL1
- ipatests: remove additional check for failed units.
Resolves: RHBZ#2053024
- ipa-cldap: fix memory leak.
Resolves: RHBZ#2032738
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Resolves: #1382053 Need to have validation for idrange names
- idrange-add: properly handle empty --dom-name option
- Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
helper when installing replica
- dsinstance: reconnect ldap2 after DS is restarted by certmonger
- httpinstance: avoid httpd restart during certificate request
- dsinstance, httpinstance: consolidate certificate request code
- install: request service certs after host keytab is set up
- renew agent: revert to host keytab authentication
- renew agent, restart scripts: connect to LDAP after kinit
- Resolves: #1436987 ipasam: gidNumber attribute is not created in the trusted
domain entry
- ipa-sam: create the gidNumber attribute in the trusted domain entry
- Upgrade: add gidnumber to trusted domain entry
- Resolves: #1438679 [ipa-replica-install] - IncorrectPasswordException:
Incorrect client security database password
- Add pki_pin only when needed
- Resolves: #1438348 Console output message while adding trust should be
mapped with texts changed in Samba.
- ipaserver/dcerpc: unify error processing
- Resolves: #1438366 ipa trust-fetch-domains: ValidationError: invalid
'Credentials': Missing credentials for cross-forest communication
- trust: always use oddjobd helper for fetching trust information
- Resolves: #1441192 Add the name of URL parameter which will be check for
username during cert login
- WebUI: cert login: Configure name of parameter used to pass username
- Resolves: #1437879 [copr] Replica install failing
- Create system users for FreeIPA services during package installation
- Resolves: #1441316 WebUI cert auth fails after ipa-adtrust-install
- Fix s4u2self with adtrust
- Require samba 4.14.5-13 with IPA DC server role fixes
- Related: RHBZ#2021443
- Update to upstream 3.2.2
- Drop ipa-server-selinux subpackage
- Drop redundant directory /var/cache/ipa/sessions
- Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
- Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
issues when there are still old parts of software (like entitlements plugin)
- Version bump for release
- Add versioned dependency of samba-client-libs to ipa-server
- Related: RHBZ#2021443
- Upstream release FreeIPA 4.8.7
- Require new samba build 4.12.3-0
Related: RHBZ#1818765
- New client-epn sub package
Resolves: RHBZ#913799
ipa-common-4.9.13-20.module+el8.10.0+2067+377bdd64.noarch.rpm | - Resolves: #846033 [RFE] Documentation for JSONRPC IPA API
- Resolves: #989091 Ability to manage IdM/IPA directly from a standard LDAP
client
- Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
users in IdM
- Resolves: #1115294 [RFE] Add support for DNSSEC
- Resolves: #1145748 [RFE] IPA running with One Way Trust
- Resolves: #1199520 [RFE] Introduce single upgrade tool - ipa-server-upgrade
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Resolves: #1200728 [RFE] Replicate PKI Profile information
- Resolves: #1200735 [RFE] Allow issuing certificates for user accounts
- Resolves: #1204054 SSSD database is not cleared between installs and
uninstalls of ipa
- Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
Trusts
- Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
- Resolves: #1204504 [RFE] Add access control so hosts can create their own
services
- Resolves: #1206534 [RFE] Offer Kerberos over HTTP (kdcproxy) by default
- Resolves: #1206613 [RFE] Configure IPA to be a trust agent by default
- Resolves: #1209476 package ipa-client does not require package dbus-python
- Resolves: #1211589 [RFE] Add option to skip the verify_client_version
- Resolves: #1211608 [RFE] Generic support for unknown DNS RR types (RFC 3597)
- Resolves: #1215735 ipa-replica-prepare automatically adds a DNS zone
- Resolves: #1217010 OTP Manager field is not exposed in the UI
- Resolves: #1222475 krb5kdc : segfault at 0 ip 00007fa9f64d82bb sp
00007fffd68b2340 error 6 in libc-2.17.so
- Related: #1204809 Rebase ipa to 4.2
- Update to upstream 4.2.0
- Move /etc/ipa/kdcproxy to the server subpackage
- Hardening for CVE-2020-25717
- Rebuild against samba-4.14.5-11.el8
- Resolves: RHBZ#2021443
- PKI database is ugraded during replica installation (#1075118)
- Resolves: #1254689 Storing big file as a secret in vault raises traceback
- vault: Limit size of data stored in vault
- Resolves: #1255880 ipactl status should distinguish between different
pki-tomcat services
- ipactl: Do not start/stop/restart single service multiple times
- Upstream pre release FreeIPA 4.9.0rc3
Related: RHBZ#1891832
- Updated to upstream 3.0.0 GA
- Set minimum for samba to 4.0.0-153.
- Make sure server-trust-ad subpackage alternates winbind_krb5_locator.so
plugin to /dev/null since they cannot be used when trusts are configured
- Restrict krb5-server to 1.10.
- Update BR for 389-ds-base to 1.3.0
- Add directory /var/lib/ipa/pki-ca/publish for CRL published by pki-ca
- Add Requires on zip for generating FF browser extension
- Resolves: #1614301 Remove --no-sssd and --noac options
- Resolves: #1613879 Disable Domain Level 0
- New patch sets to disable domain level 0
- New adapted patch to disable DL0 specific tests (pytest_ipa vs.
pytest_plugins)
- Adapted branding patch in ipa-replica-install.1 due to DL0 removal
- Set mode of /etc/ipa/ca.crt to 0644 in CA-less installations
Resolves: RHBZ#1870202
- Resolves: #1475238 Use CommonNameToSANDefault in default profile
(new installs only)
- Restore old version of caIPAserviceCert for upgrade only
- Remove ipa-server-selinux obsoletes as upgrades from version prior to
3.3.0 are not allowed
- Wrap server-trust-ad subpackage description better
- Add (noreplace) flag for %{_sysconfdir}/tmpfiles.d/ipa.conf
- Change permissions on default_encoding_utf8.so to fix ipa-python Provides
- Use default crypto policy for TLS and enable TLS 1.3 support
Resolves: RHBZ#1777809
- Covscan fixes
Resolves: RHBZ#1777920
- Change pki_version to 10.8.0
Related: RHBZ#1748987
- Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
- Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
- Related: #1356134 'kinit -E' does not work for IPA user
- Add bash completion script and own /etc/bash_completion.d in case it
doesn't already exist
- Bump up minimum version of python-nss to pick up nss_is_initialize() API
- Updated to upstream 3.0.0 beta 1
- Resolves: #1416454 replication race condition prevents IPA to install
- wait_for_entry: use only DN as parameter
- Wait until HTTPS principal entry is replicated to replica
- Use proper logging for error messages
- Unable to remove replica by ipa-replica-manage (#1001662)
- Before uninstalling a server, warn about active replicas (#998069)
- Move initialization of Guests mapping after cifs/ principal is created
- Related: rhbz#1623895
- Upstream release FreeIPA 4.9.1
Related: RHBZ#1891832
- Fix mapping of BUILTIN\Guests to 'nobody' group during upgrade
to not use generated Samba config at this point
- Related: rhbz#1623895
- Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
- Increase default timeout for IPA services (#1033273)
- Error while running trustdomain-find (#1054376)
- group-show lists SID instead of name for external groups (#1054391)
- Fix IPA server NetBIOS name in samba configuration (#1030517)
- dnsrecord-mod produces missing API version warning (#1054869)
- Hide trust-resolve command as internal (#1052860)
- Add Trust domain Web UI (#1054870)
- ipasam cannot delete multiple child trusted domains (#1056120)
- Require 389-ds-base-legacy-tools for setup tools
- ipatests: Update ipa-adtrust-install test
Resolves: RHEL-40894
- Conditionally restart also dirsrv and httpd when upgrading
- IPA extdom plugin fails when encountering large groups (#1193759)
- CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
(#1202998)
- Added auto* BuildRequires
- Added httpd SELinux policy so CRLs can be read
- Revert DNSResolver Fix use of nameservers with ports.
Related: RHBZ#2141316
- Fix NetBIOS name generation in CLDAP plugin (#1030517)
- ipa-kdb: Fix double free in ipadb_reinit_mspac()
Resolves: RHEL-25742
- kra: set RSA-OAEP as default wrapping algo when FIPS is enabled
Resolves: RHEL-12153
- Vault: improve vault server archival/retrieval calls error handling
Resolves: RHEL-12153
- Vault: add support for RSA-OAEP wrapping algo
Resolves: RHEL-12153
- Fix postin scriplet for F-15/F-16
- Deletion of active subdomain range should not be allowed (#1075615)
- Fallback to global policy in ipa lockout plugin (#912725)
- Migration does not add users to default group (#903232)
- ipa-kdb: Make AD-SIGNEDPATH optional with krb5 DAL 8 and older
Resolves: RHEL-12198
- Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
tracked
- cert renewal: Include KRA users in Dogtag LDAP update
- cert renewal: Automatically update KRA agent PEM file
- Resolves: #1257163 renaming certificatte profile with --rename option leads
to integrity issues
- certprofile: remove 'rename' option
- Resolves: #1257968 kinit stop working after ipa-restore
- Backup: back up the hosts file
- Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
- DNSSEC: remove "DNSSEC is experimental" warnings
- Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
- Installer: do not modify /etc/hosts before user agreement
- Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
zone
- DNSSEC: backup and restore opendnssec zone list file
- DNSSEC: remove ccache and keytab of ipa-ods-exporter
- DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
- DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
- DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
key master
- DNSSEC: Fix key metadata export
- DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
- Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
- Using LDAPI to setup CA and KRA agents.
- Resolves: #1259848 server closes connection and refuses commands after
deleting user that is still logged in
- ldap: Make ldap2 connection management thread-safe again
- Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
'ra_certprofile' while ipa-ca-install
- load RA backend plugins during standalone CA install on CA-less IPA master
- Remove dependency on nss_ldap/nss-pam-ldapd
- The official client is sssd and that's what we use by default.
- Resolves: #1461177 ipa-otptoken-import - XML file is missing PBKDF2
parameters!
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
search in cn=ad, cn=trusts,dc=example,dc=com
- Resolves: #1467887 iommu platform support for ipxe
- Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic key for
host
- Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
4.5
- Resolves: #1480102 ipa-server-upgrade failes with "This entry already
exists"
- Resolves: #1482802 Unable to set ca renewal master on replica
- Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
(ipa-server-upgrade)
- Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
thus startup of Web UI fails
- Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
to self-signed CA
- Resolves: #1469246 Replica install fails to configure IPA-specific
temporary files/directories
- Resolves: #1469480 bind package is not automatically updated during
ipa-server upgrade process
- Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
installs only)
- Resolves: #1477703 IPA upgrade fails for latest ipa package
- Prevent multilib failures in *.pyo and *.pyc files
- Update dependencies for samba, 389-ds and sssd
Resolves: RHBZ#1792848
- Remove v1-style /etc/ipa/ipa.conf, replacing with /etc/ipa/default.conf
- Removed python-asset based webui
- Improve server affinity for CA-less deployments
Resolves: RHEL-22283
- host: update system: Manage Host Keytab permission
Resolves: RHEL-22286
- adtrustinstance: make sure NetBIOS name defaults are set properly
Resolves: RHEL-21938
- ipatests: Fix healthcheck report when nsslapd accesslog logbuffering is set to off
Resolves: RHEL-19672
- Resolves: #1377973 ipa-server-install fails when the provided or resolved
IP address is not found on local interfaces
- Only warn when specified server IP addresses don't match intf
- Resolves: #1438016 gssapi errors after IPA server upgrade
- Bump version of python-gssapi
- Resolves: #1457942 certauth: use canonical principal for lookups
- ipa-kdb: use canonical principal in certauth plugin
- Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
breaking older clients
- Add code to be able to set default kinit lifetime
- Revert setting sessionMaxAge for old clients
- Add missing entry for /var/cache/ipa/kpasswd (444624)
- Added patch to fix permissions problems with the Apache NSS database.
- Added patch to fix problem with DNS querying where the query could be
returned as the answer.
- Fix spec error where patch1 was in the wrong section
- Update to upstream 3.3.3 (#991064)
- Rebuild against samba4 beta7
- [WebUI] IPA Error 3007: RequirmentError" while adding members in
"User ID overrides" tab (updated)
Resolves: RHBZ#1757045
- ipa-client-install: use the authselect backup during uninstall
Resolves: RHBZ#1810179
- Replace SSLCertVerificationError with CertificateError for py36
Resolves: RHBZ#1858318
- Fix AVC denial during ipa-adtrust-install --add-agents
Resolves: RHBZ#1859213
- ipa-server-install fails if --subject parameter is other than default
realm (#983075)
- do not allow configuring bind-dyndb-ldap without persistent search (#967876)
- Lockout plugin crashed during ipa-server-install (#912725)
- Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
- ldap: limit the retro changelog to dns subtree
- Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
of "CA:FALSE" IPA CA CSR
- Include the CA basic constraint in CSRs when renewing a CA
- Resolves: #1493145 ipa-replica-install might fail because of an already
existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
- Checks if replica-s4u2proxy.ldif should be applied
- Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
- ds: ignore time skew during initial replication step
- ipa-replica-manage: implicitly ignore initial time skew in force-sync
- Resolves: #1500218 Replica installation at domain-level 0 fails against
upgraded ipa-server
- Fix ipa-replica-conncheck when called with --principal
- Resolves: #1506188 server-del doesn't remove dns-server configuration
from ldap
- Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
- Fix an integer underflow bug in libotp
- Resolves: #1262996 ipa vault internal error on replica without KRA
- install: always export KRA agent PEM file
- vault: select a server with KRA for vault operations
- Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
- do not overwrite files with local users/groups when restoring authconfig
- Renamed patch 1011 to 0138, as it was merged upstream
- Resolves: #1469246 Replica install fails to configure IPA-specific
temporary files/directories
- replica install: drop-in IPA specific config to tmpfiles.d
- Resolves: #1469480 bind package is not automatically updated during
ipa-server upgrade process
- Bumped Required version of bind-dyndb-ldap and bind package
- Set minimum version of sssd to 1.5.1
- Update to upstream freeipa-2.0.0.rc1
- Move server-only binaries from admintools subpackage to server
- Resolves: #1455946 Provide a tooling automating the configuration
of Smart Card authentication on a FreeIPA master
- smart-card advises: configure systemwide NSS DB also on master
- smart-card advises: add steps to store smart card signing CA cert
- Allow to pass in multiple CA cert paths to the smart card advises
- add a class that tracks the indentation in the generated advises
- delegate the indentation handling in advises to dedicated class
- advise: add an infrastructure for formatting Bash compound statements
- delegate formatting of compound Bash statements to dedicated classes
- Fix indentation of statements in Smart card advises
- Use the compound statement formatting API for configuring PKINIT
- smart card advises: use a wrapper around Bash `for` loops
- smart card advise: use password when changing trust flags on HTTP cert
- smart-card-advises: ensure that krb5-pkinit is installed on client
- Resolves: #1475238 Use CommonNameToSANDefault in default profile
(new installs only)
- Add CommonNameToSANDefault to default cert profile
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s
during search in cn=ad,cn=trusts,dc=example,dc=com
- NULL LDAP context in call to ldap_search_ext_s during search
- Fixed share/ipa/wsgi.py so .pyc, .pyo files are included
- No need to create /var/log/ipa_error.log since we aren't using
TurboGears any more.
- Update to upstream 2.1.0
- Upstream pre release FreeIPA 4.9.0rc2
Related: RHBZ#1891832
- Synchronize spec file with upstream and Fedora
Related: RHBZ#1891832
- Traceback while doing ipa-backup
Resolves: RHBZ#1901068
- ipa-client-install changes system wide ssh configuration
Resolves: RRBZ#1544379
- ipa-kdb: support subordinate/superior UPN suffixes
Resolves: RHBZ#1891056
- KRA Transport and Storage Certificates do not renew
Resolves: RHBZ#1872603
- Move where the restore state is marked during IPA server upgrade
Resolves: RHBZ#1569011
- Intermittent IdM Client Registration Failures
Resolves: RHBZ#1812871
- Nightly test failure in test_acme.py::TestACME::test_third_party_certs
(updates-testing)
Resolves: RHBZ#1903025
- Add IPA RA Agent to ACME group on the CA
Resolves: RHBZ#1902727
- Resolves: #1356102 Server uninstall does not stop tracking lightweight sub-CA
with certmonger
- uninstall: untrack lightweight CA certs
- Resolves: #1351807 ipa-nis-manage config.get_dn missing
- ipa-nis-manage: Use server API to retrieve plugin status
- Resolves: #1353452 ipa-compat-manage command failed,
exception: NotImplementedError: config.get_dn()
- ipa-compat-manage: use server API to retrieve plugin status
- Resolves: #1353899 ipa-advise: object of type 'type' has no len()
- ipa-advise: correct handling of plugin namespace iteration
- Resolves: #1356134 'kinit -E' does not work for IPA user
- kdb: check for local realm in enterprise principals
- Resolves: #1353072 ipa unknown command vault-add
- Enable vault-* commands on client
- vault-add: set the default vault type on the client side if none was given
- Resolves: #1353995 Default CA can be used without a CA ACL
- caacl: expand plugin documentation
- Resolves: #1356144 host-find should not print SSH keys by default, only
SSH fingerprints
- host-find: do not show SSH key by default
- Resolves: #1353506 ipa migrate-ds command fails for IPA in RHEL 7.3
- Removed unused method parameter from migrate-ds
- Expand the token auth/sync windows (#919228)
- Access is not rejected for disabled domain (#1172598)
- krb5kdc crash in ldap_pvt_search (#1170695)
- RHEL7.1 IPA server httpd avc denials after upgrade (#1164896)
- Ensure that /etc/ipa exists before moving user-modifiable html files there
- Put html files into /etc/ipa/html instead of /etc/ipa
- Replica CA installation: ignore skew during initial replication
Resolves RHEL-80995
- Update to upstream version 1.1.0
- Patch for indexing memberof attribute
- Patch for indexing uidnumber and gidnumber
- Patch to change DNA default values for replicas
- Patch to fix uninitialized variable in ipa-getkeytab
- Fix --external-ca-profile not passed to CSR
Resolves: RHBZ#1731813
- Upgrade: fix replica agreement, fix backported patch
Related: RHBZ#2216551
- Enforce uniqueness across krbprincipalname and krbcanonicalname
ipa-kdb: enforce PAC presence on TGT for TGS-REQ
ipatests: extend test for unique krbcanonicalname
Resolves: RHEL-110061
- Resolve: #1455946 Provide a tooling automating the configuration
of Smart Card authentication on a FreeIPA master
- server certinstall: update KDC master entry
- pkinit manage: introduce ipa-pkinit-manage
- server upgrade: do not enable PKINIT by default
- Extend the advice printing code by some useful abstractions
- Prepare advise plugin for smart card auth configuration
- Resolve: #1461053 allow to modify list of UPNs of a trusted forest
- trust-mod: allow modifying list of UPNs of a trusted forest
- WebUI: add support for changing trust UPN suffixes
- Rebuilt for glibc bug#747377
- Update to upstream freeipa-2.0.0.rc2
- Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
- Set minimum version of sssd to 1.5.1
- Patch to include SuiteSpotGroup when setting up 389-ds instances
- Move a lot of BuildRequires so this will build with ONLY_CLIENT enabled
- Added support for ipa_kpasswd and ipa_pwd_extop
- Rebase to upstream release 4.8.4
- Removed upstream patches 0001 to 0008 that are part of version 4.8.3-3
Resolves: RHBZ#1782658
Resolves: RHBZ#1782169
Resolves: RHBZ#1783046
Related: RHBZ#1748987
- Update to upstream GA release
- Automatically apply updates when the package is upgraded
- Remove ipa_webgui, its functions rolled into ipa_httpd
- kdb: keeep ipadb_get_connection() from succeding with null LDAP context
Resolves: RHEL-58453
- CVE-2019-14867: Denial of service in IPA server due to wrong use of ber_scanf()
Resolves: RHBZ#1767304
- CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
Resolves: RHBZ#1776939
- Removed python-cherrypy from BuildRequires and Requires
- Added Requires python-assets, python-wehjit
- Resolves: #1609883 ipaserver/plugins/cert.py: Add reason to raise of
errors.NotFound
- Resolves: #1615765 do-not-use-RC4-in-FIPS-mode
- Move fips_enabled to a common library to share across different plugins
- ipasam: do not use RC4 in FIPS mode
- Marked with wrong license. IPA is GPLv2.
- Update to upstream 3.2.0 Prerelease 1
- Use upstream reference spec file as a base for Fedora spec file
- Change Requires from fedora-ds-base to 389-ds-base
- Set minimum level of 389-ds-base to 1.2.6 for the replication
version plugin.
- Resolves: #747612 [RFE] IPA should support and manage DNS sites
- Resolves: #826790 Disabling password expiration (--maxlife=0 and --minlife=0)
in the default global_policy in IPA sets user's password expiration
(krbPasswordExpiration) to be 90 days
- Resolves: #896699 ipa-replica-manage -H does not delete DNS SRV records
- Resolves: #1084018 [RFE] Add IdM user password change support for legacy
client compat tree
- Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
aliases)
- Fix incorrect check for principal type when evaluating CA ACLs
- Resolves: #1146860 [RFE] Offer OTP generation for host enrollment in the UI
- Resolves: #1238190 ipasam unable to lookup group in directory yet manual
search works
- Resolves: #1250110 search by users which don't have read rights for all attrs
in search_attributes fails
- Resolves: #1263764 Show Certificate displays in useless format
- Resolves: #1272491 [WebUI] Certificate action dropdown does not display all
the options after adding new certificate
- Resolves: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.4.0
- Resolves: #1294503 IPA fails to issue 3rd party certs
- Resolves: #1298242 [RFE] API compatibility - compatibility of clients
- Resolves: #1298848 [RFE] Centralized topology management
- Resolves: #1298966 [RFE] Extend Smart Card support
- Resolves: #1315146 Multiple clients cannot join domain simultaneously:
/var/run/httpd/ipa/clientcaches race condition?
- Resolves: #1318903 ipa server install failing when SUBCA signs the cert
- Resolves: #1319003 ipa-winsync-migrate: Traceback should be fixed with proper
console output
- Resolves: #1324055 IPA always qualify requests for admin
- Resolves: #1328552 [RFE] Allow users to authenticate with alternative names
- Resolves: #1334582 Inconsistent UI and CLI options for removing certificate
hold
- Resolves: #1346321 Exclude o=ipaca subtree from Retro Changelog (syncrepl)
- Resolves: #1349281 Fix `Conflicts` with ipa-python
- Resolves: #1350695 execution of copy-schema script fails
- Resolves: #1351118 upgrade failed for RHEL-7.3 from RHEL-7.2.z
- Resolves: #1351153 AVC seen on Replica during ipa-server upgrade test
execution to 7.3
- Resolves: #1351276 ipa-server-install with dns cannot resolve itself to
create ipa-ca entry
- Related: #1343422 [RFE] Add GssapiImpersonate option
- Pull upstream changelog 698
- Fix ownership of /var/log/ipa_error.log during install (435119)
- Add pwpolicy command and man page
- Fix requirement for python3-kdcproxy, add no autoreqprov for ipatests sub
package
Related: RHBZ#1891832
- ipa-csreplica-manage connect fails (#1157735)
- error message which is not understandable when IDNA2003 characters are
present in --zonemgr (#1163849)
- Fix warning message should not contain CLI commands (#1114013)
- Renewing the CA signing certificate does not extend its validity period end
(#1163498)
- RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
httpd (#1159330)
- Make sure ipa-server depends on krb5-kdb-version to pick up
right MIT Kerberos KDB ABI
Related: RHBZ#1700121
- User field separator uses '$$' within ipaSELInuxUserMapOrder
Fixes: RHBZ#1729099
- Require the Python interpreter directly instead of using the package name
- Related: rhbz#1619153
- DNS install check: Fix overlapping DNS zone from the master itself
Resolves: RHBZ#1784003
- Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
Trusts
- winsync-migrate: Convert entity names to posix friendly strings
- winsync-migrate: Properly handle collisions in the names of external groups
- Resolves: #1261074 Adjust Firefox configuration to new extension signing
policy
- webui: use manual Firefox configuration for Firefox >= 40
- Resolves: #1263337 IPA Restore failed with installed KRA
- ipa-backup: Add mechanism to store empty directory structure
- Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
and private key in world readable file [rhel-7.2]
- install: fix KRA agent PEM file permissions
- Resolves: #1265086 Mark IdM API Browser as experimental
- WebUI: add API browser is experimental warning
- Resolves: #1265277 Fix kdcproxy user creation
- install: create kdcproxy user during server install
- platform: add option to create home directory when adding user
- install: fix kdcproxy user home directory
- Resolves: #1265559 GSS failure after ipa-restore
- destroy httpd ccache after stopping the service
- Resolves: #1432630 python2-jinja2 needed for python2-ipaclient
- Remove csrgen
- Resolves: #1432903 Set GssProxy options to enable caching of ldap tickets
- Add options to allow ticket caching
- Update to upstream version 1.2.0
- Set fedora-ds-base minimum version to 1.1.3 for winsync header
- Set the minimum version for SELinux policy
- Remove references to Fedora 7
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650139
- Added support for libipa-dna-plugin
- Rebuild to samba 4.17.2.
Related: RHBZ#2132051
- Update to upstream 4.7.0 GA
- ipatests: fix TestOTPToken::test_check_otpd_after_idle_timeout
Related: RHBZ#2053024
- Resolves: #1477703 IPA upgrade fails for latest ipa package
- Restore old version of caIPAserviceCert for upgrade only
- Reinstalling ipa server hangs when configuring certificate
server (#1018804)
- Allow longer dirsrv startup with systemd:
- IPAdmin class will wait until dirsrv instance is available up to 10 seconds
- Helps with restarts during upgrade for ipa-ldap-updater
- Fix pylint warnings from F16 and Rawhide
- selinux don't audit rules deny fetching trust topology
Resolves: RHBZ#1845596
- fix iPAddress cert issuance for >1 host/service
Resolves: RHBZ#1846352
- Specify cert_paths when calling PKIConnection
Resolves: RHBZ#1849155
- Update crypto policy to allow AD-SUPPORT when installing IPA
Resolves: RHBZ#1851139
- Add version to ipa-idoverride-memberof obsoletes
Related: RHBZ#1846434
- Resolves: #1365858 ipa-ca-install fails on replica when IPA Master is
installed without CA
- Set up DS TLS on replica in CA-less topology
- Resolves: #1398600 IPA replica install fails with dirsrv errors.
- Do not configure PKI ajp redirection to use "::1"
- Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
ca-del, ca-disable and ca-enable commands
- ca: correctly authorise ca-del, ca-enable and ca-disable
- Rebuild for Python 2.6
- Allow ipa-tests to work with older version (1.7.7) of python-paramiko
- Resolves: #1477367 ipa-server-upgrade timeouts on wait_for_open ports
expecting IPA services listening on IPv6 ports
- Make sure upgrade also checks for IPv6 stack
- control logging of host_port_open from caller
- log progress of wait_for_open_ports
- Resolves: #1477243 ipa help command returns traceback when no cache
is present
- Store help in Schema before writing to disk
- Disable pylint in get_help function because of type confusion.
- Require samba packages instead of obsoleted samba4 packages
- Fixed License in specfile
- Include files from /usr/lib/python*/site-packages/ipaserver
- Set the N-V-R so rc1 is an update to beta2.
- Resolves: #1452216 Replica installation grants HTTP principal
access in WebUI
- Make sure we check ccaches in all rpcserver paths
- Mass rebuild 2013-12-27
- Drop Requires of python-krbV on ipa-client
- Resolves: #828866 [RFE] enhance --subject option for ipa-server-install
- Resolves: #1160555 ipa-server-install: Cannot handle double hyphen "--" in
hostname
- Resolves: #1286288 Insufficient 'write' privilege to the 'ipaExternalMember'
attribute
- Resolves: #1321652 ipa-server-install fails when using external certificates
that encapsulate RDN components in double quotes
- Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
revocation reasons
- Resolves: #1340880 ipa-server-install: improve prompt on interactive
installation
- Resolves: #1353841 ipa-replica-install fails to install when resolv.conf
incomplete entries
- Resolves: #1356104 cert-show command does not display Subject Alternative
Names
- Resolves: #1357511 Traceback message seen when ipa is provided with invalid
configuration file name
- Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
converted from CA-less to CA-full
- Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
- Resolves: #1367572 improve error message in ipa migrate-ds: mention ipa
config-mod --enable-migration=TRUE
- Resolves: #1367868 Add options to retrieve lightweight CA certificate/chain
- Resolves: #1371927 Implement ca-enable/disable commands.
- Resolves: #1372202 Add Users into User Group editors fails to show Full names
- Resolves: #1373091 Adding an auth indicator from the CLI creates an extra
check box in the UI
- Resolves: #1375596 Ipa-server WebUI - long user/group name show wrong error
message
- Resolves: #1375905 "Normal" group type in the UI is confusing
- Resolves: #1376040 IPA client ipv6 - invalid --ip-address shows traceback
- Resolves: #1376630 IDM admin password gets written to
/root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
- Resolves: #1376729 ipa-server-install script option --no_hbac_allow should
match other options
- Resolves: #1378461 IPA Allows Password Reuse with History value defined when
admin resets the password.
- Resolves: #1379029 conncheck failing intermittently during single step
replica installs
- Resolves: #1379858 [RFE] better debugging for ipa-replica-conncheck
- Resolves: #1384310 ipa dnsrecord-add fails with Keyerror stack trace
- Resolves: #1392778 Update man page for ipa-adtrust-install by
removing --no-msdcs option
- Resolves: #1392858 Rebase to FreeIPA 4.5+
- Rebase to 4.5.0
- Resolves: #1399133 Delete option shouldn't be available for hosts applied to
view.
- Resolves: #1399190 [RFE] Certificates issued by externally signed IdM CA
should contain full trust chain
- Resolves: #1400416 RFE: Provide option to take backup of IPA server before
uninstalling IPA server
- Resolves: #1400529 cert-request is not aware of Kerberos principal aliases
- Resolves: #1401526 IPA WebUI certificates are grayed out on overview page but
not on details page
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- Resolves: #1404750 ipa-client-install fails to get CA cert via LDAP when
non-FQDN name of IPA server is first in /etc/hosts
- Resolves: #1409628 [RFE] Semi-automatic integration with external DNS using
nsupdate
- Resolves: #1413742 Backport request for bug/issue Change IP address
validation errors to warnings
- Resolves: #1415652 IPA replica install log shows password in plain text
- Resolves: #1427897 different behavior regarding system wide certs in master
and replica.
- Resolves: #1430314 The ipa-managed-entries command failed, exception:
AttributeError: ldap2
- Throw zonemgr error message before installation proceeds (#1163849)
- Winsync: Setup is broken due to incorrect import of certificate (#1169867)
- Enable last token deletion when password auth type is configured (#919228)
- ipa-otp-lasttoken loads all user's tokens on every mod/del (#1166641)
- add --hosts and --hostgroup options to allow/retrieve keytab methods
(#1007367)
- Extend host-show to add the view attribute in set of default attributes
(#1168916)
- Prefer TCP connections to UDP in krb5 clients (#919228)
- [WebUI] Not able to unprovisioning service in IPA 4.1 (#1168214)
- webui: increase notification duration (#1171089)
- RHEL7.1 ipa automatic CA cert renewal stuck in submitting state (#1166931)
- RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
(#1170003)
- Improve validation of --instance and --backend options in ipa-restore
(#951581)
- RHEL7.1 ipa replica unable to replicate to rhel6 master (#1167964)
- Disable TLS 1.2 in nss.conf until mod_nss supports it (#1156466)
- Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
error observed during ipa upgrade with latest package.
- ipa-server-install: fix uninstall
- Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
replica
- ca install: merge duplicated code for DM password
- installutils: add DM password validator
- ca, kra install: validate DM password
- Rebase to upstream release 4.8.2
- Removed upstream patches 0001 to 0010 that are part of version 4.8.2
- Updated branding patch
Resolves: RHBZ#1748987
- Update dependency for bind-dndb-ldap to 11.2-2
Related: RHBZ#1762813
- Upstream release FreeIPA 4.9.5
Related: RHBZ#1945038
- IPA to allow setting a new range type
Resolves: RHBZ#1688267
- ipa-server-install displays debug output when --debug output is not
specified.
Resolves: RHBZ#1943151
- ACME fails to generate a cert on migrated RHEL8.4 server
Resolves: RHBZ#1934991
- Switch ipa-client to use the JSON API
Resolves: RHBZ#1937856
- IDM - Allow specifying permanent logging settings for BIND
Resolves: RHBZ#1951511
- Cache LDAP data within a request
Resolves: RHBZ#1953656
- ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4
Resolves: RHBZ#1957768
- Rebuild for broken deps
- Fix 389-ds-base strict dep to be 1.3.0.5 and krb5-server 1.11.1
- Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
- Re-adding existing trust fails (#1033216)
- IPA uninstall exits with a samba error (#1033075)
- Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
- Fixed ownership of /usr/share/ipa/ui/js (#1026260)
- ipa-tests: support external names for hosts (#1032668)
- ipa-client-install fail due fail to obtain host TGT (#1029354)
- Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
by abusing password policy
- ipa-kdb: search for password policies globally
- Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream
- [ipa-python] ipalib.errors.LDAPError: failed to decode certificate:
(SEC_ERROR_INVALID_ARGS) security library: invalid arguments. (#1194312)
- Set krb5 DAL version to 7.0 (#1580711)
- Rebuild aclocal and configure during build
- hbactest does not work for external users (#848531)
- Resolves: #1443869 Command "openssl pkcs12 ..." failed during IPA upgrade
- Fix CAInstance.import_ra_cert for empty passwords
- New upstream release 4.8.0
- New subpackage: freeipa-client-samba
- Added command ipa-cert-fix with man page
- New sysconfdir sysconfig/certmonger
- Updated pki_version, certmonger_version, sssd_version and kdcproxy_version
Related: RHBZ#1684528
- Update to upstream 2.2.0 beta 1 (2.1.90.rc1)
- Set minimum n-v-r for pki-ca and pki-silent to 9.0.18.
- Add Conflicts on mod_ssl
- Update minimum n-v-r of 389-ds-base to 1.2.10.4
- Update minimum n-v-r of sssd to 1.8.0
- Update minimum n-v-r of slapi-nis to 0.38
- Update minimum n-v-r of pki-* to 9.0.18
- Update conflicts on bind-dyndb-ldap to < 1.1.0-0.9.b1
- Update conflicts on bind to < 9.9.0-1
- Drop requires on krb5-server-ldap
- Add patch to remove escaping arguments to pkisilent
- Re-add accidentally removed patches for #1170695 and #1164896
- Fix wrong path in packaging freeipa-systemd-upgrade
- Create systemd-user HBAC service and rule
Resolves: RHBZ#1664974
- ipaserver/dcerpc: fix exclusion entry with a forest trust domain info returned
Resolves: RHBZ#1664023
- trustdomain-find with pkey-only fails (#1068611)
- Invalid credential cache in trust-add (#1069182)
- ipa-replica-install prints unexpected error (#1069722)
- Too big font in input fields in details facet in Firefox (#1069720)
- trust-add for POSIX AD does not fetch trustdomains (#1070925)
- Misleading trust-add error message in some cases (#1070926)
- Access is not rejected for disabled domain (#1070924)
- Set minimum level of sssd to 1.1.1 to pull in required hbac fixes.
- Add OTP patches
- Add patch to set KRB5CCNAME for 389-ds-base
- Resolves: #1431520 ipa cert-find runs a large number of searches, so IPA
WebUI is slow to display user details page
- cert: defer cert-find result post-processing
- Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
helper when installing replica
- server-install: No double Kerberos install
- Resolves: #1437502 ipa-replica-install fails with requirement to
use --force-join that is a client install option.
- Add the force-join option to replica install
- replicainstall: better client install exception handling
- Resolves: #1437953 Server CA-less impossible option check
- server-install: remove broken no-pkinit check
- Resolves: #1441160 FreeIPA client <= 4.4 fail to parse 4.5 cookies
- Add debug log in case cookie retrieval went wrong
- Resolves: #1441548 ipa server install fails with --external-ca option
- ext. CA: correctly write the cert chain
- Resolves: #1441718 Conversion of CA-less server to CA fails on CA instance
spawn
- Fix CA-less to CA-full upgrade
- Resolves: #1442133 Do not link libkrad, liblber, libldap_r and
libsss_nss_idmap to every binary in IPA
- configure: fix AC_CHECK_LIB usage
- Resolves: #1442815 Replica install fails during migration from older IPA
master
- Fix RA cert import during DL0 replication
- Related: #1442004 Building IdM/FreeIPA internally on all architectures -
filtering unsupported packages
- Build all subpackages on all architectures
- Hardening for CVE-2020-25717
- Harden processing of trusted domains' users in S4U operations
- Resolves: RHBZ#2021443
- Updated to upstream 2.2.0 GA
- Update minimum n-v-r of certmonger to 0.53
- Update minimum n-v-r of slapi-nis to 0.40
- Add Requires in client to oddjob-mkhomedir and python-krbV
- Update minimum selinux-policy to 3.10.0-110
- 4.7.1
- Fixes: rhbz#1633105 - rebase to 4.7.1
- Fix otptoken_sync plugin
Resolves: RHBZ#1777811
- Fix automount behavior with authselect
Resolves: RHBZ#1740167
- Require mod_nss-1.0.7-2 for mod_proxy fixes
- Pull upstream changelog 678
- Add new subpackage, ipa-server-selinux
- Add Requires: authconfig to ipa-python (bz #433747)
- Package i18n files
- Fix breakage caused by python-kerberos update to 1.1
- Fix Requires for krb5-server that was missing for Fedora versions > 9
- Remove quotes around test for fedora version to package egg-info
- Load ipa_dogtag.pp in post install
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- user-undel: Fix error messages.
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Prohibit deletion of predefined profiles
- Resolves: #1232819 testing ipa-restore on fresh system install fails
- Backup/resore authentication control configuration
- Resolves: #1243331 pkispawn fails when migrating to 4.2 server from 3.0
server
- Require Dogtag PKI >= 10.2.6
- Resolves: #1245225 Asymmetric vault drops traceback when the key is not
proper
- Asymmetric vault: validate public key in client
- Resolves: #1248399 Missing DNSSEC related files in backup
- fix typo in BasePathNamespace member pointing to ods exporter config
- ipa-backup: archive DNSSEC zone file and kasp.db
- Resolves: #1248405 PassSync should be disabled after ipa-winsync-migrate is
finished
- winsync-migrate: Add warning about passsync
- winsync-migrate: Expand the man page
- Resolves: #1248524 User can't find any hosts using "ipa host-find $HOSTNAME"
- adjust search so that it works for non-admin users
- Resolves: #1250093 ipa certprofile-import accepts invalid config
- Require Dogtag PKI >= 10.2.6
- Resolves: #1250107 IPA framework should not allow modifying trust on AD trust
agents
- trusts: Detect missing Samba instance
- Resolves: #1250111 User lifecycle - preserved users can be assigned
membership
- ULC: Prevent preserved users from being assigned membership
- Resolves: #1250145 Add permission for user to bypass caacl enforcement
- Add permission for bypassing CA ACL enforcement
- Resolves: #1250190 idrange is not added for sub domain
- idranges: raise an error when local IPA ID range is being modified
- trusts: harden trust-fetch-domains oddjobd-based script
- Resolves: #1250928 Man page for ipa-server-install is out of sync
- install: Fix server and replica install options
- Resolves: #1251225 IPA default CAACL does not allow cert-request for services
after upgrade
- Fix default CA ACL added during upgrade
- Resolves: #1251561 ipa vault-add Unknown option: ipavaultpublickey
- validate mutually exclusive options in vault-add
- Resolves: #1251579 ipa vault-add --user should set container owner equal to
user on first run
- Fixed vault container ownership.
- Resolves: #1252517 cert-request rejects request with correct
krb5PrincipalName SAN
- Fix KRB5PrincipalName / UPN SAN comparison
- Resolves: #1252555 ipa vault-find doesn't work for services
- vault: Add container information to vault command results
- Add flag to list all service and user vaults
- Resolves: #1252556 Missing CLI param and ACL for vault service operations
- Added CLI param and ACL for vault service operations.
- Resolves: #1252557 certprofile: improve profile format documentation
- certprofile-import: improve profile format documentation
- certprofile: add profile format explanation
- Resolves: #1253443 ipa vault-add creates vault with invalid type
- vault: validate vault type
- Resolves: #1253480 ipa vault-add-owner does not fail when adding an existing
owner
- baseldap: Allow overriding member param label in LDAPModMember
- vault: Fix param labels in output of vault owner commands
- Resolves: #1253511 ipa vault-find does not use criteria
- vault: Fix vault-find with criteria
- Resolves: #1254038 ipa-replica-install pk12util error returns exit status 10
- install: Fix replica install with custom certificates
- Resolves: #1254262 ipa-dnskeysync-replica crash cannot contact kdc
- improve the handling of krb5-related errors in dnssec daemons
- Resolves: #1254412 when dirsrv is off ,upgrade from 7.1 to 7.2 fails with
starting CA and named-pkcs11.service
- Server Upgrade: Start DS before CA is started.
- Resolves: #1254637 Add ACI and permission for managing user userCertificate
attribute
- add permission: System: Manage User Certificates
- Resolves: #1254641 Remove CSR allowed-extensions restriction
- cert-request: remove allowed extensions check
- Resolves: #1254693 vault --service does not normalize service principal
- vault: normalize service principal in service vault operations
- Resolves: #1254785 ipa-client-install does not properly handle dual stacked
hosts
- client: Add support for multiple IP addresses during installation.
- Add dependency to SSSD 1.13.1
- client: Add description of --ip-address and --all-ip-addresses to man page
- Remove dependency on python-paramiko (#1002884)
- Broken redirection when deleting last entry of DNS resource
record (#1006360)
- "an internal error has occurred" during ipa host-del --updatedns (#1198431)
- Renamed patch 1013 to 0114, as it was merged upstream
- Fax number not displayed for user-show when kinit'ed as normal user.
(#1198430)
- Replication agreement with replica not disabled when ipa-restore done without
IPA installed (#1199060)
- Limit deadlocks between DS plugin DNA and slapi-nis (#1199128)
- Build radius separately
- Fix a few minor issues
- Broke invididual Requires and BuildRequires onto separate lines and
reordered them
- Added python-tgexpandingformwidget as a dependency
- Require at least fedora-ds-base 1.1
- Server install failure during client enrollment shouldn't
roll back (#1023086)
- nsds5ReplicaStripAttrs are not set on agreements (#1023085)
- ipa-server conflicts with mod_ssl (#1018172)
- Update to upstream 3.3.2 (#991064)
- Add delegation info to MS-PAC (#915799)
- Warn about incompatibility with AD when IPA realm and domain
differs (#1009044)
- Allow PKCS#12 files with empty password in install tools (#1002639)
- Privilege "SELinux User Map Administrators" did not list
permissions (#997085)
- SSH key upload broken when client joins an older server (#1009024)
- Set minimum pki-ca and pki-silent versions to 9.0.0
- Set krbCanonicalName admin@REALM on the admin user
Resolves: RHEL-89895
- Rebuild against samba4 beta4
- Resolves: #1361119 UPN-based search for AD users does not match an entry in
slapi-nis map cache
- support multiple uid values in schema compatibility tree
- Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
version to 1.0.7-4 so we pick up the NSS fixes.
- Add selinux-policy-base(post) to Requires (446496)
- Resolves: #1296140 Remove redhat-access-plugin-ipa support
- Obsolete and conflict redhat-access-plugin-ipa
- Resolves: #1351119 Multiple issues while uninstalling ipa-server
- server uninstall fails to remove krb principals
- Resolves: #1351758 ipa commands not showing expected error messages
- frontend: copy command arguments to output params on client
- Show full error message for selinuxusermap-add-hostgroup
- Resolves: #1352883 Traceback on adding default automember group and hostgroup
set
- allow 'value' output param in commands without primary key
- Resolves: #1353888 Fix the help for ipa otp and other topics
- schema: Fix subtopic -> topic mapping
- Resolves: #1354348 ipa trustconfig-show throws internal error.
- allow 'value' output param in commands without primary key
- Resolves: #1354381 ipa trust-add with raw option gives internal error.
- trust-add: handle `--all/--raw` options properly
- Resolves: #1354493 Replica install fails with old IPA master
- DNS install: Ensure that DNS servers container exists
- Resolves: #1354628 ipa hostgroup-add-member does not return error message
when adding itself as member
- frontend: copy command arguments to output params on client
- Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
- messages: specify message type for ResultFormattingError
- Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
secret key
- expose `--secret` option in radiusproxy-* commands
- prevent search for RADIUS proxy servers by secret
- Resolves: #1356099 Bug in the ipapwd plugin
- Heap corruption in ipapwd plugin
- Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
client changes
- Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
- Resolves: #1356964 Renaming a user removes all of his principal aliases
- Preserve user principal aliases during rename operation
- Require slapi-nis 0.47.7 delivering a core feature of 3.3.0 release
- ipa man page format the EXAMPLES section
Resolves: RHBZ#2129895
- Fix canonicalization issue in Web UI
Resolves: RHBZ#2127035
- Remove idnssoaserial argument from dns zone API.
Resolves: RHBZ#2108630
- Warn for permissions with read/write/search/compare and no attrs
Resolves: RHBZ#2098187
- Add PKINIT support to ipa-client-install
Resolves: RHBZ#2075452
- Generate CNAMEs for TXT+URI location krb records
Resolves: RHBZ#2104185
- Vault: fix interoperability issues with older RHEL systems
Resolves: RHBZ#2144737
- Fix typo on ipaupgrade.log chmod during RPM %post snipppet
Resolves: RHBZ#2140994
- Set minimum of python-pyasn1 to 0.0.9a so we have support for the ASN.1
Any type
- Remove ipa-server dependency from ipa-selinux subpackage
- Related: RHBZ#1891832
- clean up spec
- Depend on sssd >= 1.6.2 for better user experience
- webui: Do not allow empty pagination size
Resolves: RHBZ#2094672
- [WebUI] IPA Error 3007: RequirmentError" while adding members in
"User ID overrides" tab
Resolves: RHBZ#1757045
- EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in
freeipa-client-epn
Resolves: RHBZ#1847999
- FreeIPA - Utilize 256-bit AJP connector passwords
Resolves: RHBZ#1849914
- ipa: typo issue in ipanthomedirectoryrive deffinition
Resolves: RHBZ#1851411
- FreeIPA 4.8.0 tarball lacks two update files that are in git
Resolves: RHBZ#1741170
- Proxy PKI URI /ca/ee/ca/profileSubmit to enable replication with future
PKI versions (#1080865)
- kdb: apply combinatorial logic for ticket flags (CVE-2024-3183)
Resolves: RHEL-29927
- kdb: fix vulnerability in GCD rules handling (CVE-2024-2698)
Resolves: RHEL-29692
- Drop workaround for building on AArch64 (#1482244)
- Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)
- schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
build fails (#1167196)
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
- "ipa trust-add ... " cmd says : (Trust status: Established and verified)
while in the logs we see "WERR_ACCESS_DENIED" during verification step.
(#1144121)
- POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
(#1156466)
- Add support/hooks for a one-time password system like SecureID in IPA
(#919228)
- Tracebacks with latest build for --zonemgr cli option (#1167270)
- ID Views: Support migration from the sync solution to the trust solution
(#891984)
- Remove posixAccount from service_find search filter
Resolves: RHBZ#1731437
- Fix repeated uninstallation of ipa-client-samba crashes
Resolves: RHBZ#1732529
- WebUI: Add PKINIT status field to 'Configuration' page
Resolves: RHBZ#1518153
- Resolve user/group names in idoverride*-find
Resolves: RHBZ#1657745
- Configure CA replication to use TLS instead of SSL
- New command automember-find-orphans to find and remove orphan automemeber
rules has been added
Resolves: RHBZ#1638373
- Moved ipa/idm logos and background to redhat-logos-ipa-80.4:
header-logo.png, login-screen-background.jpg, login-screen-logo.png,
product-name.png
New requirement to redhat-logos-ipa >= 80.4 in ipa-server-common
Resolves: RHBZ#1626507
- Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
users in IdM
- store certificates issued for user entries as
- user-show: add --out option to save certificates to file
- Resolves: #1145748 [RFE] IPA running with One Way Trust
- Fix upgrade of sidgen and extdom plugins
- Resolves: #1195339 ipa-client-install changes the label on various files
which causes SELinux denials
- Use 'mv -Z' in specfile to restore SELinux context
- Resolves: #1198796 Text in UI should describe differing LDAP vs Krb behavior
for combinations of "User authentication types"
- webui: add LDAP vs Kerberos behavior description to user auth
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- ULC: Fix stageused-add --from-delete command
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- certprofile-import: do not require profileId in profile data
- Give more info on virtual command access denial
- Allow SAN extension for cert-request self-service
- Add profile for DNP3 / IEC 62351-8 certificates
- Work around python-nss bug on unrecognised OIDs
- Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
- Validate vault's file parameters
- Fixed missing KRA agent cert on replica.
- Resolves: #1225866 display browser config options that apply to the browser.
- webui: add Kerberos configuration instructions for Chrome
- Remove ico files from Makefile
- Resolves: #1246342 Unapply idview raises internal error
- idviews: Check for the Default Trust View only if applying the view
- Resolves: #1248102 [webui] regression - incorrect/no failed auth messages
- webui: fix regressions failed auth messages
- Resolves: #1248396 Internal error in DomainValidator.__search_in_dc
- dcerpc: Fix UnboundLocalError for ccache_name
- Resolves: #1249455 ipa trust-add failed CIFS server configuration does not
allow access to \\pipe\lsarpc
- Fix selector of protocol for LSA RPC binding string
- dcerpc: Simplify generation of LSA-RPC binding strings
- Resolves: #1250192 Error in ipa trust-fecth-domains
- Fix incorrect type comparison in trust-fetch-domains
- Resolves: #1251553 Winsync setup fails with unexpected error
- replication: Fix incorrect exception invocation
- Resolves: #1251854 ipa aci plugin is not parsing aci's correctly.
- ACI plugin: correctly parse bind rules enclosed in
- Resolves: #1252414 Trust agent install does not detect available replicas to
add to master
- adtrust-install: Correctly determine 4.2 FreeIPA servers
- Introduce upgrade script to recover existing configuration after systemd migration
as user has no means to recover FreeIPA from systemd migration
- Upgrade script:
- recovers symlinks in Dogtag instance install
- recovers systemd configuration for FreeIPA's directory server instances
- recovers freeipa.service
- migrates directory server and KDC configs to use proper keytabs for systemd services
- Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
- Remove references to admin server in ipa-server-setupssl
- Generate a client certificate for the XML-RPC server to connect to LDAP with
- Create a keytab for Apache
- Create an ldif with a test user
- Provide a certmap.conf for doing SSL client authentication
- Update to 4.7.90-pre1
Related: RHBZ#1684528
- Removed patches 0002 to 0031 as these are upsteram and part of 4.7.90-pre1
- Added new patches 0001-revert-minssf-defaults.patch and
0001-Correct-default-fontawesome-path-broken-by-da2cf1c5.patch
- Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
- Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
- Resolves: #1341249 Subsequent external CA installation fails
- install: fix external CA cert validation
- Resolves: #1353831 ipa-server-install fails in container because of
hostnamectl set-hostname
- server-install: Fix --hostname option to always override api.env values
- install: Call hostnamectl set-hostname only if --hostname option is used
- Resolves: #1356091 ipa-cacert-manage --help and man differ
- Improvements for the ipa-cacert-manage man and help
- Resolves: #1360631 ipa-backup is not keeping the
/etc/tmpfiles.d/dirsrv-.conf
- ipa-backup: backup /etc/tmpfiles.d/dirsrv-.conf
- Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
file is needed
- Update ipa-replica-install documentation
- Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
not rpm-require it
- client: RPM require initscripts to get *-domainname.service
- Resolves: #1364197 caacl: error when instantiating rules with service
principals
- caacl: fix regression in rule instantiation
- Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
- parameters: move the `confirm` kwarg to Param
- Resolves: #1364464 Topology graph: ca and domain adders shows question marks
instead of plus icon
- Fix unicode characters in ca and domain adders
- Resolves: #1365083 Incomplete output returned for command ipa vault-add
- client: add missing output params to client-side commands
- Resolves: #1365526 build fails during "make check"
- ipa-kdb: Fix unit test after packaging changes in krb5
- Rebase to security release 4.8.3 (CVE-2019-14867, CVE-2019-10195)
Resolves: RHBZ#1767304
Resolves: RHBZ#1776939
- Support KDC ticket policies for authentication indicators
Resolves: RHBZ#1777564
- Fix misleading errors during client install rollback
Resolves: RHBZ#1658283
- ipa-advise: update url of cacerdir_rehash tool
Resolves: RHBZ#1658287
- Handle NTP configuration in a replica server installation
Resolves: RHBZ#1651679
- Fix defects found by static analysis
Resolves: RHBZ#1658182
- ipa-replica-install --setup-adtrust: check for package ipa-server-trust-ad
Resolves: RHBZ#1658294
- ipaldap: invalid modlist when attribute encoding can vary
Resolves: RHBZ#1658302
- Allow ipaapi and Apache user to access SSSD IFP
Resolves: RHBZ#1639910
- Add sysadm_r to default SELinux user map order
Resolves: RHBZ#1658303
- certdb: ensure non-empty Subject Key Identifier and validate server cert sig
Resolves: RHBZ#1641988
- ipa-replica-install: password and admin-password options mutually exclusive
Resolves: RHBZ#1658309
- ipa upgrade: handle double-encoded certificates
Resolves: RHBZ#1658310
- PKINIT: fix ipa-pkinit-manage enable|disable
Resolves: RHBZ#1658313
- Enable LDAP debug output in client to display TLS errors in join
Resolves: RHBZ#1658316
- rpc: always read response
Resolves: RHBZ#1639890
- ipa vault-retrieve: fix internal error
Resolves: RHBZ#1658485
- Move ipa's systemd tmpfiles from /var/run to /run
Resolves: RHBZ#1658487
- Fix authselect invocations to work with 1.0.2
Resolves: RHBZ#1654291
- ipa-client-automount and NFS unit name changes
Resolves: RHBZ#1645501
- Fix compile issue with new 389-ds
Resolves: RHBZ#1659448
- ipatests: fix test_topology
Resolves: RHBZ#2232351
- Installer: activate nss and pam services in sssd.conf
Resolves: RHBZ#2216532
- Update to upstream 4.1.0 (#1109726)
- Re-enable otptoken_yubikey plugin
- Convert to autotools-based build
- Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
because of missing dependencies
- Rebuild with krb5-1.14.1
- Update to upstream 3.3.0 (#991064)
- Set 0.14 as minimum version for slapi-nis
- ipa-client-automount fails with incompatibility error when installed against
older IPA server (#1083108)
- Server installation fails using external signed certificates with
"IndexError: list index out of range" (#1111320)
- Add rhino to BuildRequires to fix Web UI build error
- Abstracted client class to work directly or over RPC
- Fix S4U2Self regression for cross-realm requester SID buffer
- Related: RHBZ#2021443
- Add dep for freeipa-admintools and acl
- Add Requires: python-nss to ipa-python sub-package
- Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
- python2-ipalib: add missing python dependency
- installer service: fix typo in service entry
- upgrade: add missing suffix to http instance
- Resolves: #1444791 Update man page of ipa-kra-install
- ipa-kra-install manpage: document domain-level 1
- Resolves: #1441493 ipa cert-show raises stack traces when
--certificate-out=/tmp
- cert-show: writable files does not mean dirs
- Resolves: #1441192 Add the name of URL parameter which will be check for
username during cert login
- Bump version of ipa.conf file
- Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
- Turn on NSSOCSP check in mod_nss conf
- Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
template on
- renew agent: respect CA renewal master setting
- server upgrade: always fix certmonger tracking request
- cainstance: use correct profile for lightweight CA certificates
- renew agent: allow reusing existing certs
- renew agent: always export CSR on IPA CA certificate renewal
- renew agent: get rid of virtual profiles
- ipa-cacert-manage: add --external-ca-type
- Resolves: #1441593 error adding authenticator indicators to host
- Fixing adding authenticator indicators to host
- Resolves: #1449525 Set directory ownership in spec file
- Added plugins directory to ipaclient subpackages
- ipaclient: fix missing RPM ownership
- Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
- otptoken-add-yubikey: When --digits not provided use default value
- Upstream release FreeIPA 4.9.2
Related: RHBZ#1891832
- Rebuild for broken deps in rawhide
- Fix 389-ds-base strict dep to be 1.3.0.3
- Move ipa-tests package to separate srpm (#1032668)
- Don't always override the port in import_included_profiles
Fixes: RHBZ#2022483
- Remove ipa-join errors from behind the debug option
Fixes: RHBZ#2048558
- Enable the ccache sweep timer during installation
Fixes: RHBZ#2051575
- ipa-replica-install never checks for 7389 port (#1075165)
- Non-terminated string may be passed to LDAP search (#1075091)
- ipa-sam may fail to translate group SID into GID (#1073829)
- Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
- Update to upstream version 1.0.0
- rpcserver: validate Kerberos principal name before running kinit
Resolves: RHEL-26153
- Vault: add additional fallback to RSA-OAEP wrapping algo
Resolves: RHEL-28259
- Set min version of 389-ds-base to 1.2.8
- Set min version of mod_nss 1.0.8-10
- Set min version of selinux-policy to 3.9.7-27
- Add dogtag themes to Requires
- Update to upstream freeipa-2.0.0.pre2
- Resolves: #1339483 ipa-server-install fails with ERROR pkinit_cert_files
- Fix incorrect rebase of patch 1001
- Fixed weekday in 4.8.4-2 changelog date
Related: RHBZ#1784003
- adtrust: print DNS records for external DNS case after role is enabled
Resolves: RHBZ#1665051
- AD user without override receive InternalServerError with API
Resolves: RHBZ#1782572
- ipa-client-automount fails after repeated installation/uninstallation
Resolves: RHBZ#1790886
- install/updates: move external members past schema compat update
Resolves: RHBZ#1803165
- kdb: make sure audit_as_req callback signature change is preserved
Resolves: RHBZ#1803786
- Resolves: #1449189 ipa-kra-install timeouts on replica
- kra: promote: Get ticket before calling custodia
- Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
- Fix ipa-server-install in pure IPv6 environment
- Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
reachable via the forest root
- trust: make sure ID range is created for the child domain even if it exists
- ipa-kdb: simplify trusted domain parent search
- Resolves: #1335567 Update Warning in IdM Web UI API browser
- WebUI: add API browser is tech preview warning
- Resolves: #1348560 Mulitple domain Active Directory Trust conflict
- ipaserver/dcerpc: reformat to make the code closer to pep8
- trust: automatically resolve DNS trust conflicts for triangle trusts
- Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
certificate revocation
- cert-revoke: fix permission check bypass (CVE-2016-5404)
- Resolves: #1353936 custodia.conf and server.keys file is world-readable.
- Remove Custodia server keys from LDAP
- Secure permissions of Custodia server.keys
- Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
converted from CA-less to CA-full
- custodia: include known CA certs in the PKCS#12 file for Dogtag
- custodia: force reconnect before retrieving CA certs from LDAP
- Resolves: #1362333 ipa vault container owner cannot add vault
- Fix: container owner should be able to add vault
- Resolves: #1365546 External trust with root domain is transitive
- trust: make sure external trust topology is correctly rendered
- Resolves: #1365572 IPA server broken after upgrade
- Require pki-core-10.3.3-7
- Resolves: #1367864 Server assumes latest version of command instead of
version 1 for old / 3rd party clients
- rpcserver: assume version 1 for unversioned command calls
- rpcserver: fix crash in XML-RPC system commands
- Resolves: #1367773 thin client ignores locale change
- schema cache: Fallback to 'en_us' when locale is not available
- Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
- Fail on topology disconnect/last role removal
- Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
- otptoken, permission: Convert custom type parameters on server
- Resolves: #1369414 ipa server-del fails with Python stack trace
- Handled empty hostname in server-del command
- Resolves: #1369761 ipa-server must depend on a version of httpd that support
mod_proxy with UDS
- Require httpd 2.4.6-31 with mod_proxy Unix socket support
- Resolves: #1370512 Received ACIError instead of DuplicatedError in
stageuser_tests
- Raise DuplicatedEnrty error when user exists in delete_container
- Resolves: #1371479 cert-find --all does not show information about revocation
- cert: add missing param values to cert-find output
- Renamed patch 1011 to 0100, as it was merged upstream
- Add BuildRequires for authconfig
- Add explicit dependency for libvert-libev
Resolves: RHBZ#2104929
- ipatests: Backport test fixes in python3-ipatests.
Resolves: RHBZ#2057505
- Rely on sssd-krb5 to include SSSD-generated krb5 configuration
Resolves: RHBZ#2214563
- Refactor ipatests for unique krbcanonicalname
Resolves: RHEL-110061
- Move ipalib to ipa-python subpackage
- Bump minimum version of slapi-nis to 0.15
- Remove client-epn left over files for ONLY_CLIENT
Related: RHBZ#1847999
- Resolves: #1252556 Missing CLI param and ACL for vault service operations
- vault: fix private service vault creation
- Update to upstream 2.1.4 (CVE-2011-3636)
- Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
by abusing password policy
- password policy: Add explicit default password policy for hosts and
services
- Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
certprofile-mod
- certprofile-mod: correctly authorise config update
- Update to upstream 4.1.0 Alpha 1 (#1109726)
- PKI service restart after CA renewal failed (#1040018)
- Preverse mode on ipa-keytab-util
- Version bump for relase and rpm name change
- Resolves: #1318186 Misleading error message during external-ca IPA master
install
- httpinstance: make sure NSS database is backed up
- Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
CA certificate chain in ... incomplete"
- httpinstance: make sure NSS database is backed up
- Resolves: #1393726 Enumerate all available request type options in ipa
cert-request help
- Hide request_type doc string in cert-request help
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- spec file: bump libsss_nss_idmap-devel BuildRequires
- server: make sure we test for sss_nss_getlistbycert
- Resolves: #1437378 ipa-adtrust-install produced an error and failed on
starting smb when hostname is not FQDN
- adtrust: make sure that runtime hostname result is consistent with the
configuration
- Resolves: #1437555 ipa-replica-install with DL0 fails to get annonymous
keytab
- Always check and create anonymous principal during KDC install
- Remove duplicate functionality in upgrade
- Resolves: #1437946 Upgrade to FreeIPA 4.5.0 does not configure anonymous
principal for PKINIT
- Upgrade: configure PKINIT after adding anonymous principal
- Remove unused variable from failed anonymous PKINIT handling
- Split out anonymous PKINIT test to a separate method
- Ensure KDC is propery configured after upgrade
- Resolves: #1437951 Remove pkinit-related options from server/replica-install
on DL0
- Fix the order of cert-files check
- Don't allow setting pkinit-related options on DL0
- replica-prepare man: remove pkinit option refs
- Remove redundant option check for cert files
- Resolves: #1438490 CA-less installation fails on publishing CA certificate
- Get correct CA cert nickname in CA-less
- Remove publish_ca_cert() method from NSSDatabase
- Resolves: #1438838 Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
- IPA-KDB: use relative path in ipa-certmap config snippet
- Resolves: #1439038 Allow erasing ipaDomainResolutionOrder attribute
- Allow erasing ipaDomainResolutionOrder attribute
- Upstream release FreeIPA 4.8.6
- New SELinux sub package to provide own module
- Depend on selinux-policy-devel 3.14.3-43 for build due to a makefile issue in
SELinux external policy support
Related: RHBZ#1818765
- CAless installation: set the perms on KDC cert file
Resolves: RHBZ#1863616
- EPN: handle empty attributes
Resolves: RHBZ#1866938
- IPA-EPN: enhance input validation
Resolves: RHBZ#1866291
- EPN: enhance input validation
Resolves: RHBZ#1863079
- Require new samba build 4.12.3-52
Related: RHBZ#1868558
- Require new selinux-policy build 3.14.3-52
Related: RHBZ#1869311
- Resolves: #1398670 Check IdM Topology for broken record caused by replication
conflict before upgrading it
- Check for conflict entries before raising domain level
- package the sessions dir /var/cache/ipa/sessions
- Pull upstream changelog 597
- Add call to /usr/sbin/upgradeconfig to post install
- Resolves: #1262996 ipa vault internal error on replica without KRA
- upgrade: make sure ldap2 is connected in export_kra_agent_pem
- Resolves: #1270608 IPA upgrade fails for server with CA cert signed by
external CA
- schema: do not derive ipaVaultPublicKey from ipaPublicKey
- dcerpc: invalidate forest trust intfo cache when filtering out realm domains
Resolves: RHEL-28559
- Backport latests test fixes in python3-tests
ipatests: add xfail for autoprivate group test with override
ipatests: remove xfail thanks to sssd 2.9.4
ipatests: adapt for new automembership fixup behavior
ipatests: Fixes for test_ipahealthcheck_ipansschainvalidation testcases
test_xmlrpc: adopt to automember plugin message changes in 389-ds
Resolves: RHEL-29908
- Config plugin: return EmptyModlist when no change is applied.
Resolves: RHBZ#2031825
- Custodia: use a stronger encryption algo when exporting keys.
Resolves: RHBZ#2032806
- ipa-kdb: do not remove keys for hardened auth-enabled users.
Resolves: RHBZ#2033342
- ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus
Resolves: RHBZ#2049167
- Backport latest test fxes in python3 ipatests.
Resolves: RHBZ#2048509
- Removed unused patch files that were part of 4.9.8 rebase.
- Upstream final release FreeIPA 4.9.0
Related: RHBZ#1891832
- Add end to end integration tests for external IdP
Resolves: RHBZ#2106346
- Upstream release FreeIPA 4.9.8
Related: RHBZ#2015607
- Hardening for CVE-2020-25717
- Resolves: #1419735 ipa-replica-install fails promotecustodia.create_replica
with cert errors (untrusted)
- added ssl verification using IPA trust anchor
- Resolves: #1428472 batch param compatibility is incorrect
- compat: fix `Any` params in `batch` and `dnsrecord`
- Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream
- rebuild with new openssl
- Rebase ipa to 4.9.13
Resolves: RHEL-16936
- Remove the IPA DNA plugin, use the DS one
- Drop requires on python-configobj (not used any more)
- Drop ipa-ldap-updater message, upgrades are done differently now
- Update minimum selinux-policy to 3.9.16-18
- Update minimum pki-ca and pki-selinux to 9.0.7
- Update minimum 389-ds-base to 1.2.8.0-1
- Update to upstream 2.0.1
- Remove radius subpackages
- Pull upstream changelog 641
- Require minimum version of krb5-server on F-7 and F-8
- Package some new files
- Add ipa init script
- Update to upstream 4.0.3 (#1109726)
- Update Requires on selinux-policy to 3.13.1-4
- Add missing part of backported CVE-2024-3183 fix
Resolves: RHEL-29927
- Drop BuildRequires on mozldap-devel
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
- Updated upstream pull (596) to fix bug in ipa_webgui that was causing the
UI to not start.
- Remove duplicate %files entries on share/ipa/static
- Add python default encoding shared library
- Winsync agreement cannot be created (#1023085)
- Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
aliases)
- harden the check for trust namespace overlap in new principals
- Resolves: #1351142 CLI is not using session cookies for communication with
IPA API
- Fix session cookies
- Resolves: #1353888 Fix the help for ipa otp and other topics
- help: Add dnsserver commands to help topic 'dns'
- Resolves: #1354406 host-del updatedns options complains about missing ptr
record for host
- Host-del: fix behavior of --updatedns and PTR records
- Resolves: #1355718 ipa-replica-manage man page example output differs actual
command output
- Minor fix in ipa-replica-manage MAN page
- Resolves: #1358229 Traceback message should be fixed, seen while editing
winsync migrated user information in Default trust view.
- baseldap: Fix MidairCollision instantiation during entry modification
- Resolves: #1358849 CA replica install logs to wrong log file
- unite log file name of ipa-ca-install
- Resolves: #1359130 ipa-server-install command fails to install IPA server.
- DNS Locations: fix update-system-records unpacking error
- Resolves: #1359237 AVC on dirsrv config caused by IPA installer
- Use copy when replacing files to keep SELinux context
- Resolves: #1359692 ipa-client-install join fail with traceback against
RHEL-6.8 ipa-server
- compat: fix ping call
- Resolves: #1359738 ipa-replica-install --domain= option
does not work
- replica-install: Fix --domain
- Resolves: #1360778 Vault commands are available in CLI even when the server
does not support them
- Revert "Enable vault-* commands on client"
- client: fix hiding of commands which lack server support
- Related: #1281704 Rebase to softhsm 2.1.0
- Remove the workaround for softhsm bug #1293340
- Related: #1298288 [RFE] Improve performance in large environments.
- Create indexes for krbCanonicalName attribute
- Use OpenJDK 8 to bootstrap on AArch64 until RH1482244 is resolved in
buildroot
- Resolves: #1470177 - Rebase IPA to latest 4.5.x version
- Resolves: #1398594 ipa topologysuffix-verify should only warn about
maximum number of replication agreements.
- Resolves: #1404236 Web UI: Change "Host Based" and "Role Based"
to "Host-Based" and "Role-Based"
- Resolves: #1409786 Second phase of --external-ca ipa-server-install
setup fails when dirsrv is not running
- Resolves: #1451576 ipa cert-request failed to generate certificate from csr
- Resolves: #1452086 Pagination Size under Customization in IPA WebUI
accepts negative values
- Resolves: #1458169 --force-join option is not mentioned in
ipa-replica-install man page
- Resolves: #1463186 IPA shouldn't allow objectclass if not all in lower case
- Resolves: #1478322 user-show command fails when sizelimit is configured
to number <= number of entity which is user member of
- Resolves: #1496775 Enterprise principals should be able to trigger
a refresh of the trusted domain data in the KDC
- Resolves: #1502533 Changing cert-find to go through the proxy
instead of using the port 8080
- Resolves: #1502663 pkinit-status command fails after an upgrade from
a pre-4.5 IPA
- Resolves: #1498168 Error when trying to modify a PTR record
- Resolves: #1457876 ipa-backup fails silently
- Resolves: #1493531 In case full PKINIT configuration is failing during
server/replica install the error message should be more meaningful.
- Resolves: #1449985 Suggest CA installation command in KRA installation
warning
- Display server name in ipa command's verbose mode (#1061703)
- Remove sourcehostcategory from default HBAC rule (#1061187)
- dnszone-add cannot add classless PTR zones (#1058688)
- Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)
- Add ipa-rmkeytab tool
- ipaclient-install: chmod needs octal permissions (#1609880)
- Added Require mod_wsgi, added share/ipa/wsgi.py
- Improve otptoken help messages (#919228)
- Ensure users exist when assigning tokens to them (#919228)
- Enable QR code display by default in otptoken-add (#919228)
- Show warning instead of error if CA did not start (#1158410)
- CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
- Traceback when adding zone with long name (#1164859)
- Backup & Restore mechanism (#951581)
- ignoring user attributes in migrate-ds does not work if uppercase characters
are returned by ldap (#1159816)
- Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
- Failure when installing on dual stacked system with external ca (#1128380)
- ipa-server should keep backup of CS.cfg (#1059135)
- Tracebacks with latest build for --zonemgr cli option (#1167270)
- webui: use domain name instead of domain SID in idrange adder dialog
(#891984)
- webui: normalize idview tab labels (#891984)
- Unable to add trust successfully with --trust-secret (#1075704)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Resolves: #1258965 ipa vault: set owner of vault container
- baseldap: make subtree deletion optional in LDAPDelete
- vault: add vault container commands
- vault: set owner to current user on container creation
- vault: update access control
- vault: add permissions and administrator privilege
- install: support KRA update
- Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
- config: allow user/host attributes with tagging options
- Resolves: #1262315 Unable to establish winsync replication
- winsync: Add inetUser objectclass to the passsync sysaccount
- Update SELinux policy to allow ipa_kpasswd to connect ldap and
read /dev/urandom. (#759679)
- Adopt to samba4 beta6 (libsecurity -> libsamba-security)
- Add dependency to samba4-winbind
- Resolves: #1298288 [RFE] Improve performance in large environments.
- cert: speed up cert-find
- Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
authentication
- service: add flag to allow S4U2Self
- Add 'trusted to auth as user' checkbox
- Added new authentication method
- Resolves: #1353881 ipa-replica-install suggests about
non-existent --force-ntpd option
- Don't show --force-ntpd option in replica install
- Resolves: #1354441 DNS forwarder check is too strict: unable to add
sub-domain to already-broken domain
- DNS: allow to add forward zone to already broken sub-domain
- Resolves: #1356146 performance regression in CLI help
- schema: Speed up schema cache
- frontend: Change doc, summary, topic and NO_CLI to class properties
- schema: Introduce schema cache format
- schema: Generate bits for help load them on request
- help: Do not create instances to get information about commands and topics
- schema cache: Do not reset ServerInfo dirty flag
- schema cache: Do not read fingerprint and format from cache
- Access data for help separately
- frontent: Add summary class property to CommandOverride
- schema cache: Read server info only once
- schema cache: Store API schema cache in memory
- client: Do not create instance just to check isinstance
- schema cache: Read schema instead of rewriting it when SchemaUpToDate
- Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
- server install: do not prompt for cert file PIN repeatedly
- Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
cache directory: [Errno 13] Permission denied: '/home/test_user'
- schema: Speed up schema cache
- Resolves: #1366604 `cert-find` crashes on invalid certificate data
- cert: do not crash on invalid data in cert-find
- Resolves: #1366612 Middle replica uninstallation in line topology works
without '--ignore-topology-disconnect'
- Fail on topology disconnect/last role removal
- Resolves: #1366626 caacl-add-service: incorrect error message when service
does not exists
- Fix ipa-caalc-add-service error message
- Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
does not happen to run during dnf upgrade
- DNS server upgrade: do not fail when DNS server did not respond
- Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
with CA
- Add warning about only one existing CA server
- Set servers list as default facet in topology facet group
- Resolves: #1367773 thin client ignores locale change
- schema check: Check current client language against cached one
- Resolves: #1434032 Run ipa-custodia with custom SELinux context
- Require correct custodia version
- Fix: DNS installer adds invalid zonemgr email (#1056202)
- ipaplatform: Use the dirsrv service, not target (#951581)
- Fix: DNS policy upgrade raises asertion error (#1161128)
- Fix upgrade referint plugin (#1161128)
- Upgrade: fix trusts objectclass violationi (#1161128)
- group-add doesn't accept gid parameter (#1149124)
- Remove redundat Requires versions that are already in Fedora 17
- Replace python-crypto Requires with m2crypto
- Add missing Requires(post) for client and server-trust-ad subpackages
- Restart httpd service when server-trust-ad subpackage is installed
- Bump selinux-policy Requires to pick up PKI/LDAP port labeling fixes
- Fix SELinux code
- Resolves: #1378353 Replica install fails with old IPA master sometimes during
replication process
- spec file: bump minimal required version of 389-ds-base
- Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
- Fix missing file that fails DL1 replica installation
- Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
- WebUI: services without canonical name are shown correctly
- Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
- trustdomain-del: fix the way how subdomain is searched
- kdb: PAC generator: do not fail if canonical principal is missing
Resolves: RHEL-23630
- ipa-kdb: Fix memory leak during PAC verification
Resolves: RHEL-22644
- Fix session cookie access
Resolves: RHEL-23622
- Do not ignore staged users in sidgen plugin
Resovlves: RHEL-23626
- ipa-kdb: Disable Bronze-Bit check if PAC not available
Resolves: RHEL-22313
- krb5kdc: Fix start when pkinit and otp auth type are enabled
Resolves: RHEL-4874
- hbactest was not collecting or returning messages
Resolves: RHEL-12780
- Resolves: #712109 "krbExtraData not allowed" is logged in DS error log while
setting password for default sudo binddn.
- Resolves: #747612 [RFE] IPA should support and manage DNS sites
- Resolves: #768316 [RFE] ipa-getkeytab should auto-detect the ipa server name
- Resolves: #825391 [RFE] Replica installation should provide a means for
inheriting nssldap security access settings
- Resolves: #921497 Incorrect *.py[co] files placement
- Resolves: #1029640 RHEL7 IPA to add DNA Plugin config for dnaRemote support
- Resolves: #1029905 389 DS cache sizes not replicated to IPA replicas
- Resolves: #1196958 IPA replica installation failing with high number of users
(160000).
- Resolves: #1219402 IPA suggests to uninstall a client when the user needs to
uninstall a replica
- Resolves: #1224057 [RFE] TGS authorization decisions in KDC based on
Authentication Indicator
- Resolves: #1234222 [WebUI] UI error message is not appropriate for "Kerberos
principal expiration"
- Resolves: #1234223 [WebUI] General invalid password error message appearing
for "Locked user"
- Resolves: #1254267 ipa-server-install failure applying ldap updates with
limits exceeded
- Resolves: #1258626 realmdomains-mod --add-domain command throwing error when
doamin already is in forwardzone.
- Resolves: #1259020 ipa-server-adtrust-install doesn't allow
NetBIOS-name=EXAMPLE-TEST.COM (dash character)
- Resolves: #1260993 DNSSEC signing enablement on dnszone should throw error
message when DNSSEC master not installed
- Resolves: #1262747 dnssec options missing in ipa-dns-install man page
- Resolves: #1265900 Fail installation immediately after dirsrv fails to
install using ipa-server-install
- Resolves: #1265915 idoverrideuser-find fails if any SID anchor is not
resolvable anymore
- Resolves: #1268027 ipa-dnskeysync-replica crash with backtrace -
LimitsExceeded: limits exceeded for this query
- Resolves: #1269089 Certificate of managed-by host/service fails to resubmit
- Resolves: #1269200 ipa-server crashing while trying to preserve admin user
- Resolves: #1271321 Reduce ioblocktimeout and idletimeout defaults
- Resolves: #1271579 Automember rule expressions disappear from tables on
single expression delete
- Resolves: #1275816 Incomplete ports for IPA ad-trust
- Resolves: #1276351 [RFE] Remove
/usr/share/ipa/updates/50-lockout-policy.update file from IPA releases
- Resolves: #1277109 Add tool tips for Revert, Refresh, Undo, and Undo All in
the IPA UI
- Resolves: #1278426 Better error message needed for invalid ca-signing-algo
option
- Resolves: #1279932 ipa-client-install --request-cert needs workaround in
anaconda chroot
- Resolves: #1282521 Creating a user w/o private group fails when doing so in
WebUI
- Resolves: #1283879 ipa-winsync-migrate: Traceback message should be replaced
by "IPA is not configured on this system"
- Resolves: #1285071 ipa-kra-install fails on replica looking for admin cert
file
- Resolves: #1287194 [RFE] Support of UPN for trusted domains
- Resolves: #1288967 Normalize Manager entry in ipa user-add
- Resolves: #1289487 Priority field missing in Password Policy detail tab
- Resolves: #1291140 ipa client should configure kpasswd_server directive in
krb5.conf
- Resolves: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.4.0.alpha1
- Resolves: #1298848 [RFE] Centralized topology management
- Resolves: #1300576 Browser setup page includes instructions for Internet
Explorer
- Resolves: #1301586 ipa host-del --updatedns should remove related dns
entries.
- Resolves: #1304618 Residual Files After IPA Server Uninstall
- Resolves: #1305144 ipa-python does not require its dependencies
- Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
- Resolves: #1313798 Console output post ipa-winsync-migrate command should be
corrected.
- Resolves: #1314786 [RFE] External Trust with Active Directory domain
- Resolves: #1319023 Include description for 'status' option in man page for
ipactl command.
- Resolves: #1319912 ipa-server-install does not completely change hostname and
named-pkcs11 fails
- Resolves: #1320891 IPA Error 3009: Validation error: Invalid 'ptrrecord':
Reverse zone in-addr.arpa. requires exactly 4 IP address compnents, 5 given
- Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
revocation reasons
- Resolves: #1328549 "ipa-kra-install" command reports incorrect message when
it is executed on server already installed with KRA.
- Resolves: #1329209 ipa-nis-manage enable: change service name from 'portmap'
to 'rpcbind'
- Resolves: #1329275 ipa-nis-manage command should include status option
- Resolves: #1330843 'man ipa' should be updated with latest commands
- Resolves: #1333755 ipa cert-request causes internal server error while
requesting certificate
- Resolves: #1337484 EOF is not handled for ipa-client-install command
- Resolves: #1338031 Insufficient 'write' privilege on some attributes for the
members of the role which has "User Administrators" privilege.
- Resolves: #1343142 IPA DNS should do better verification of DNS zones
- Resolves: #1347928 Frontpage exposes runtime error with no cookies enabled in
browser
- Use NSS protocol range API to set available TLS protocols (#1156466)
- Updated to upstream 3.0.0 rc 2
- Include new FF configuration extension
- Set minimum Requires of selinux-policy to 3.11.1-33
- Set minimum Requires dogtag to 10.0.0-0.43.b1
- Add new optional strict sub-package to allow users to limit other
package upgrades.
- Add ipa-idrange-fix
Resolves: RHEL-56920
- Unconditionally add MS-PAC to global config on update
Resolves: RHEL-49437
- ipatests: Update ipa-adtrust-install test
Resolves: RHEL-40894
- Require python-qrcode version 5.3 or later
Related: RHEL-15090
- ipa-kdb: Rework ipadb_reinit_mspac()
Resolves: RHEL-25742
- ipatests: wait for replica update in test_dns_locations
Resolves: RHEL-22373
- ipatests: fix tasks.wait_for_replication() method
Resolves: RHEL-25708
- Resolves: #805188 [RFE] "ipa migrate-ds" ldapsearches with scope=1
- Resolves: #1019272 With 20000+ users, adding a user to a group intermittently
throws Internal server error
- Resolves: #1035494 Unable to add Kerberos principal via kadmin.local
- Resolves: #1045153 ipa-managed-entries --list -p still requires
DM password
- Resolves: #1125950 ipa-server-install --uinstall doesn't remove port 7389
from ldap_port_t
- Resolves: #1132540 [RFE] Expose service delegation rules in UI and CLI
- Resolves: #1145584 ipaserver/install/cainstance.py creates pkiuser not
matching uidgid
- Resolves: #1176036 IDM client registration failure in a high load environment
- Resolves: #1183116 Remove Requires: subscription-manager
- Resolves: #1186054 permission-add does not prompt to enter --right option in
interactive mode
- Resolves: #1187524 Replication agreement with replica not disabled when
ipa-restore done without IPA installed
- Resolves: #1188195 Fax number not displayed for user-show when kinit'ed as
normal user.
- Resolves: #1189034 "an internal error has occurred" during ipa host-del
--updatedns
- Resolves: #1193554 ipa-client-automount: failing with error LDAP server
returned UNWILLING_TO_PERFORM. This likely means that minssf is enabled.
- Resolves: #1193759 IPA extdom plugin fails when encountering large groups
- Resolves: #1194312 [ipa-python] ipalib.errors.LDAPError: failed to decode
certificate: (SEC_ERROR_INVALID_ARGS) security library: invalid arguments.
- Resolves: #1194633 Default trust view can be deleted in lower case
- Resolves: #1196455 ipa-server-install step [8/27]: starting certificate
server instance - confusing CA staus message on TLS error
- Resolves: #1198263 Limit deadlocks between DS plugin DNA and slapi-nis
- Resolves: #1199527 [RFE] Use datepicker component for datetime fields
- Resolves: #1200867 [RFE] Make OTP validation window configurable
- Resolves: #1200883 [RFE] Switch apache to use mod_auth_gssapi
- Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using
get_user_grouplist() [rhel-7.2]
- Resolves: #1204637 slow group operations
- Resolves: #1204642 migrate-ds: slow add o users to default group
- Resolves: #1208461 IPA CA master server update stuck on checking getStatus
via https
- Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
- Resolves: #1211708 ipa-client-install gets stuck during NTP sync
- Resolves: #1215197 ipa-client-install ignores --ntp-server option during time
sync
- Resolves: #1215200 ipa-client-install configures IPA server as NTP source
even if IPA server has not ntpd configured
- Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
- Related: #1204809 Rebase ipa to 4.2
- Update to upstream 4.2.0.alpha1
- ipatests: NAMED_CRYPTO_POLICY_FILE not defined for RHEL
Resolves: RHBZ#1982956
- Add sssd and certmonger as a Requires on ipa-client
- Rebase to upstream release 4.9.10
Remove upstream patches 0002 to 0016 that are part of version 4.9.10
Remove patches 1101 that is part of version 4.9.10
Rename patch 0001 to 1002 as it will be used in future RHEL 8 releases
Add patches 0001 and 0002 to fix build on RHEL 8.7
Resolves: RHBZ#2079466
Resolves: RHBZ#2063155
Resolves: RHBZ#1958777
Resolves: RHBZ#2068088
Resolves: RHBZ#2004646
Resolves: RHBZ#782917
Resolves: RHBZ#2059396
Resolves: RHBZ#2092015
- Handle new samba exception types.
Resolves: RHEL-17623
- Deprecate --serial-autoincrement option (#1016645)
- CA installation always failed on replica (#1005446)
- Re-initializing a winsync connection exited with error (#994980)
- Update to upstream 3.2.0 Beta 1
- Add a Requires for java-atk-wrapper until we can determine which package
should be pulling it in, dogtag or tomcat.
- Add redhat-access-plugin-ipa dependency
- extdom: unify error code handling especially LDAP_NO_SUCH_OBJECT
Resolves: RHBZ#1741530
- Resolves: #800545 [RFE] Support SUDO command rename
- Reworked the renaming mechanism
- Allow renaming of the sudorule objects
- Resolves: #872671 IPA WebUI login for AD Trusted User fails
- WebUI: check principals in lowercase
- WebUI: add method for disabling item in user dropdown menu
- WebUI: Add support for login for AD users
- Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
certificates on smart cards (pkinit)
- ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
- IPA certauth plugin
- ipa-kdb: do not depend on certauth_plugin.h
- spec file: bump krb5-devel BuildRequires for certauth
- Resolves: #1264370 RFE: disable last successful authentication by default in
ipa.
- Set "KDC:Disable Last Success" by default
- Resolves: #1318186 Misleading error message during external-ca IPA master
install
- certs: do not implicitly create DS pin.txt
- httpinstance: clean up /etc/httpd/alias on uninstall
- Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
CA certificate chain in ... incomplete"
- certs: do not implicitly create DS pin.txt
- httpinstance: clean up /etc/httpd/alias on uninstall
- Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
- configure: fix --disable-server with certauth plugin
- rpcserver.login_x509: Actually return reply from __call__ method
- spec file: Bump requires to make Certificate Login in WebUI work
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- extdom: do reverse search for domain separator
- extdom: improve cert request
- Resolves: #1430363 [RFE] HBAC rule names command rename
- Reworked the renaming mechanism
- Allow renaming of the HBAC rule objects
- Resolves: #1433082 systemctl daemon-reload needs to be called after
httpd.service.d/ipa.conf is manipulated
- tasks: run `systemctl daemon-reload` after httpd.service.d updates
- Resolves: #1434032 Run ipa-custodia with custom SELinux context
- Use Custodia 0.3.1 features
- Resolves: #1434384 RPC client should use HTTP persistent connection
- Use connection keep-alive
- Add debug logging for keep-alive
- Increase Apache HTTPD's default keep alive timeout
- Resolves: #1434729 man ipa-cacert-manage install needs clarification
- man ipa-cacert-manage install needs clarification
- Resolves: #1434910 replica install against IPA v3 master fails with ACIError
- Fixing replica install: fix ldap connection in domlvl 0
- Resolves: #1435394 Ipa-kra-install fails with weird output when backspace is
used during typing Directory Manager password
- ipapython.ipautil.nolog_replace: Do not replace empty value
- Resolves: #1435397 ipa-replica-install can't install replica file produced by
ipa-replica-prepare on 4.5
- replica prepare: fix wrong IPA CA nickname in replica file
- Resolves: #1435599 WebUI: in self-service Vault menu item is shown even if
KRA is not installed
- WebUI: Fix showing vault in selfservice view
- Resolves: #1435718 As a ID user I cannot call a command with --rights option
- ldap2: use LDAP whoami operation to retrieve bind DN for current connection
- Resolves: #1436319 "Truncated search results" pop-up appears in user details
in WebUI
- WebUI: Add support for suppressing warnings
- WebUI: suppress truncation warning in select widget
- Resolves: #1436333 Uninstall fails with No such file or directory:
'/var/run/ipa/services.list'
- Create temporaty directories at the begining of uninstall
- Resolves: #1436334 WebUI: Adding certificate mapping data using certificate
fails
- WebUI: Allow to add certs to certmapping with CERT LINES around
- Resolves: #1436338 CLI doesn't work after ipa-restore
- Backup ipa-specific httpd unit-file
- Backup CA cert from kerberos folder
- Resolves: #1436342 Bump samba version, required for FIPS mode and privilege
separation
- Bump samba version for FIPS and priv. separation
- Resolves: #1436642 [ipalib/rpc.py] - "maximum recursion depth exceeded" with
ipa vault commands
- Avoid growing FILE ccaches unnecessarily
- Handle failed authentication via cookie
- Work around issues fetching session data
- Prevent churn on ccaches
- Resolves: #1436657 Add workaround for pki_pin for FIPS
- Generate PIN for PKI to help Dogtag in FIPS
- Resolves: #1436714 [vault] cache KRA transport cert
- Simplify KRA transport cert cache
- Resolves: #1436723 cert-find does not find all certificates without
sizelimit=0
- cert: do not limit internal searches in cert-find
- Resolves: #1436724 Renewal of IPA RA fails on replica
- dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
- Resolves: #1436753 Master tree fails to install
- httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not
available
- webui IdP: Remove arrow notation due to uglify-js limitation
Related: RHBZ#2141316
- Use java-1.8.0-openjdk-devel
- Update to upstream 2.2.0 alpha 1 (2.1.90.pre1)
- Support krb5 1.18
Resolves: RHBZ#1817579
- Fix ipa-replica-install crashes
- Fix ipa-server-install and ipa-dns-install logging
- Set minimum version of pki-ca to 9.0.17 to fix sslget problem
caused by FEDORA-2011-17400 update (#771357)
- Set minimum version of certmonger to 0.26 (to pck up #621670)
- Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
- Set minimum version of pki-ca to 1.3.6
- Set minimum version of sssd to 1.2.1
- diffstat was missing as a build dependency causing multilib problems
- Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
Resolves: RHBZ#1790663
- Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
certificates on smart cards (pkinit)
- spec file: bump krb5 Requires for certauth fixes
- Resolves: #1438729 Configure local PKINIT on DL0 or when '--no-pkinit' option
is used
- separate function to set ipaConfigString values on service entry
- Allow for configuration of all three PKINIT variants when deploying KDC
- API for retrieval of master's PKINIT status and publishing it in LDAP
- Use only anonymous PKINIT to fetch armor ccache
- Stop requesting anonymous keytab and purge all references of it
- Use local anchor when armoring password requests
- Upgrade: configure local/full PKINIT depending on the master status
- Do not test anonymous PKINIT after install/upgrade
- Resolves: #1442427 ipa.ipaserver.install.plugins.adtrust.
update_tdo_gidnumber: ERROR Default SMB Group not found
- upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
installed
- Resolves: #1442932 ipa restore fails to restore IPA user
- restore: restart/reload gssproxy after restore
- Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
- Fix CA/server cert validation in FIPS
- Resolves: #1444947 Deadlock between topology and schema-compat plugins
- compat-manage: behave the same for all users
- Move the compat plugin setup at the end of install
- compat: ignore cn=topology,cn=ipa,cn=etc subtree
- Resolves: #1445358 ipa vault-add raises TypeError
- vault: piped input for ipa vault-add fails
- Resolves: #1445382 ipa vault-retrieve fails to retrieve data from vault
- Vault: Explicitly default to 3DES CBC
- Resolves: #1445432 uninstall ipa client automount failed with RuntimeWarning
- automount install: fix checking of SSSD functionality on uninstall
- Resolves: #1446137 pki_client_database_password is shown in
ipaserver-install.log
- Hide PKI Client database password in log file
- Prepare spec file for release
- Using git snapshot 80e87e75bd6ab56e3e20c49ece55bd4d52f1a503
- Version bump for release
- Add missing ipa-selinux package
Resolves: RHBZ#1853263
- Remove unnecessary moving of v1 CA serial number file in post script
- Add Obsoletes for server-selinxu subpackage
- Using git snapshot 442d6ad30ce1156914e6245aa7502499e50ec0da
- PassSync does not sync passwords due to missing ACIs (#1181093)
- ipa-replica-manage list does not list synced domain (#1181010)
- Do not assume certmonger is running in httpinstance (#1181767)
- ipa-replica-manage disconnect fails without password (#1183279)
- Put LDIF files to their original location in ipa-restore (#1175277)
- DUA profile not available anonymously (#1184149)
- IPA replica missing data after master upgraded (#1176995)
- Included LICENSE and README in all packages for documentation
- Move user-modifiable content to /etc/ipa and linked back to
/usr/share/ipa/html
- Changed some references to /usr to the {_usr} macro and /etc
to {_sysconfdir}
- Added popt-devel to BuildRequires for Fedora 8 and higher and
popt for Fedora 7
- Package the egg-info for Fedora 9 and higher for ipa-python
- Updated to upstream 3.0.0 beta 2
- 2.1.3
- Force to use 389-ds 1.2.10-0.8.a7 or above
- Improve upgrade script to handle systemd 389-ds change
- Fix freeipa to work with python-ldap 2.4.6
- Fix bug #702633
- Resolves: #1256840 [webui] majority of required fields is no longer marked as
required
- fix missing information in object metadata
- Resolves: #1256842 [webui] no option to choose trust type when creating a
trust
- webui: add option to establish bidirectional trust
- Resolves: #1256853 Clear text passwords in KRA install log
- Removed clear text passwords from KRA install log.
- Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
discouraged
- vault: change default vault type to symmetric
- Resolves: #1257163 renaming certificatte profile with --rename option leads
to integrity issues
- certprofile: prevent rename (modrdn)
- Allow the admin user to be disabled
Resolves: RHEL-34756
- ipa-otptoken-import: open the key file in binary mode
Resolves: RHEL-39616
- ipa-crlgen-manage: manage the cert status task execution time
Resolves: RHEL-30280
- idrange-add: add a warning because 389ds restart is required
Resolves: RHEL-28996
- PKINIT certificate: fix renewal on hidden replica
Resolves: RHEL-4913, RHEL-45908
- Mass rebuild 2014-01-24
- Require certmonger 0.79.7-1
Related: RHBZ#1708095
- Do not check if port 8443 is available in step 2 of external CA install
(#1129481)
- Resolves: #1249226 IPA dnssec-validation not working for AD dnsforwardzone
- DNSSEC: fix forward zone forwarders checks
- Resolves: #1250190 idrange is not added for sub domain
- trusts: format Kerberos principal properly when fetching trust topology
- Resolves: #1252334 User life cycle: missing ability to provision a stage user
from a preserved user
- Add user-stage command
- Resolves: #1252863 After applying RHBA-2015-1554 errata, IPA service fails to
start.
- spec file: Add Requires(post) on selinux-policy
- Resolves: #1254304 Changing vault encryption attributes
- Change internal rsa_(public|private)_key variable names
- Added support for changing vault encryption.
- Resolves: #1256715 Executing user-del --preserve twice removes the user
pernamently
- improve the usability of `ipa user-del --preserve` command
- Pull upstream changelog 608 which renamed several files
- Fix for CVE-2008-3274
- Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
- Add fix for bug #453185
- Rebuild against openldap libraries, mozldap ones do not work properly
- TurboGears is currently broken in rawhide. Added patch to not build
the UI locales and removed them from the ipa-server files section.
- Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
- Fix regression introduced in ipa-certupdate
- Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
- Do not initialize API in ipa-client-automount uninstall
- Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
client changes
- idrange: fix unassigned global variable
- Resolves: #1360792 Migrating users doesn't update krbCanonicalName
- re-set canonical principal name on migrated users
- Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
and 'bool' objects
- Fix ipa hbactest output
- Resolves: #1362260 ipa vault-mod no longer allows defining salt
- vault: add missing salt option to vault_mod
- Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
public key
- vault: Catch correct exception in decrypt
- Resolves: #1362537 ipa-server-install fails to create symlink from
/etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
- Correct path to HTTPD's systemd service directory
- Resolves: #1363756 Increase length of passwords generated by installer
- Increase default length of auto generated passwords
- Update to upstream 3.3.0 Beta 2 (#991064)
- Update Requires on pki-ca to 10.1.2-4 (#1129558)
- build: increase java stack size for all arches
- Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
- Fix dns zonemgr validation regression (#1056202)
- Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
- Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
(#886645)
- Add bind-dyndb-ldap working dir to IPA specfile
- Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
(#886645)
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
- Deadlock in schema compat plugin (#1161131)
- ipactl stop should stop dirsrv last (#1161129)
- Upgrade 3.3.5 to 4.1 failed (#1161128)
- CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)
- Fix status trust-add command status message (#910453)
- NetBIOS was not trimmed at 15 characters (#1030517)
- Harden CA subsystem certificate renewal on CA clones (#1040018)
- remove ipa-fix-CVE-2008-3274
- Resolves: #1382812 Creation of replica for disconnected environment is
failing with CA issuance errors; Need good steps.
- gracefully handle setting replica bind dn group on old masters
- Resolves: #1397439 ipa-ca-install on promoted replica hangs on creating a
temporary CA admin
- replication: ensure bind DN group check interval is set on replica config
- add missing attribute to ipaca replica during CA topology update
- Resolves: #1401088 IPA upgrade of replica without DNS fails during restart of
named-pkcs11
- bindinstance: use data in named.conf to determine configuration status
- Resolves: #1348948 IPA server install fails with build
ipa-server-4.4.0-0.el7.1.alpha1
- Revert "Increased mod_wsgi socket-timeout"
- Resolves: #1449189 ipa-kra-install timeouts on replica
- ipa-kra-install: fix check_host_keys
- Require python-wehjit >= 0.2.0
- Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
- Resolves: #1375269 ipa trust-fetch-domains throws internal error
- Set minimum level of 389-ds-base to 1.2.7 for enhanced memberof plugin
- Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
- ipa-sam: replace encode_nt_key() with E_md4hash()
- ipa_pwd_extop: do not generate NT hashes in FIPS mode
- Resolves: #1377973 ipa-server-install fails when the provided or resolved
IP address is not found on local interfaces
- Fix local IP address validation
- ipa-dns-install: remove check for local ip address
- refactor CheckedIPAddress class
- CheckedIPAddress: remove match_local param
- Remove ip_netmask from option parser
- replica install: add missing check for non-local IP address
- Remove network and broadcast address warnings
- Resolves: #1477178 - [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic
key for host
- Always check peer has keys before connecting
- Resolves: #1482802 - Unable to set ca renewal master on replica
- Fix ipa config-mod --ca-renewal-master
- Resolves: #1486283 - TypeError in renew_ca_cert prevents from swiching
back to self-signed CA
- Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
- Resolves: #1480102 - ipa-server-upgrade failes with "This entry already exists"
- Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
- Resolves: #1484826 - FreeIPA/IdM installations which were upgraded from
versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
thus startup of Web UI fails
- Adds whoami DS plugin in case that plugin is missing
- Resolves: #1478251 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
- Fixing how sssd.conf is updated when promoting a client to replica
- Resolves: #1461177 - ipa-otptoken-import - XML file is missing PBKDF2
parameters!
- ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
- Resolves: #1484428 - Updating from RHEL 7.3 fails with Server-Cert not found
(ipa-server-upgrade)
- Backport 4-5: Fix ipa-server-upgrade with server cert tracking
- kdb: Use-krb5_pac_full_sign_compat() when available
Resolves: RHBZ#2176406
- OTP: fix-data-type-to-avoid-endianness-issue
Resolves: RHBZ#2218293
- Upgrade: fix replica agreement
Resolves: RHBZ#2216551
- Upgrade: add PKI drop-in file if missing
Resolves: RHBZ#2215336
- Use the python-cryptography parser directly in cert-find
Resolves: RHBZ#2164349
- Backport test updates
Resolves: RHBZ#221884
- Initial rpm version
- SELinux Policy: let custodia replicate keys
Resolves: RHBZ#1868432
- Update slapi-nis dependency to pull 0.54-2 (#891984)
- ipa-restore: Don't crash if AD trust is not installed (#951581)
- Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
- Trust setting not restored for CA cert with ipa-restore command (#1159011)
- ipa-server-install fails when restarting named (#1162340)
- Rebuild against samba4 beta8
- Resolves: #1170770 [AD TRUST]IPA should detect inconsistent realm domains
that conflicts with AD DC
- trusts: Check for AD root domain among our trusted domains
- Resolves: #1195339 ipa-client-install changes the label on various files
which causes SELinux denials
- sysrestore: copy files instead of moving them to avoind SELinux issues
- Resolves: #1196656 [ipa-client][rhel71] enable debugging for spawned
commands / ntpd -qgc $tmpfile hangs
- enable debugging of ntpd during client installation
- Resolves: #1205264 Migration UI Does Not Work When Anonymous Bind is Disabled
- migration: Use api.env variables.
- Resolves: #1212719 abort-clean-ruv subcommand should allow
replica-certifyall: no
- Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand
- Resolves: #1216935 ipa trust-add shows ipa: ERROR: an internal error has
occurred
- dcerpc: Expand explanation for WERR_ACCESS_DENIED
- dcerpc: Fix UnboundLocalError for ccache_name
- Resolves: #1222778 idoverride group-del can delete user and user-del can
delete group
- dcerpc: Add get_trusted_domain_object_type method
- idviews: Restrict anchor to name and name to anchor conversions
- idviews: Enforce objectclass check in idoverride*-del
- Resolves: #1234919 Be able to request certificates without certmonger service
running
- cermonger: Use private unix socket when DBus SystemBus is not available.
- ipa-client-install: Do not (re)start certmonger and DBus daemons.
- Resolves: #1240939 Please add dependency on bind-pkcs11
- Create server-dns sub-package.
- ipaplatform: Add constants submodule
- DNS: check if DNS package is installed
- Resolves: #1242914 Bump minimal selinux-policy and add booleans to allow
calling out oddjobd-activated services
- selinux: enable httpd_run_ipa to allow communicating with oddjobd services
- Resolves: #1243261 non-admin users cannot search hbac rules
- fix hbac rule search for non-admin users
- fix selinuxusermap search for non-admin users
- Resolves: #1243652 Client has missing dependency on memcache
- do not import memcache on client
- Resolves: #1243835 [webui] user change password dialog does not work
- webui: fix user reset password dialog
- Resolves: #1244802 spec: selinux denial during kdcproxy user creation
- Fix selinux denial during kdcproxy user creation
- Resolves: #1246132 trust-fetch-domains: Do not chown keytab to the sssd user
- oddjob: avoid chown keytab to sssd if sssd user does not exist
- Resolves: #1246136 Adding a privilege to a permission avoids validation
- Validate adding privilege to a permission
- Resolves: #1246141 DNS Administrators cannot search in zones
- DNS: Consolidate DNS RR types in API and schema
- Resolves: #1246143 User plugin - user-find doesn't work properly with manager
option
- fix broken search for users by their manager
- ipa-kdb: Detect and block Bronze-Bit attacks
Resolves: RHEL-9984
- Fix for CVE-2023-5455
Resolves: RHEL-12578
- Temporarily move ipa-backup and ipa-restore functionality
back to make them available in public Beta (#1003933)
- Added patch to fix problem reported by ldapmodify
- Add dependency for python-krbV
- Resolves: #1438833 [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic key for
host
- Make sure remote hosts have our keys
- Resolves: #1442815 Replica install fails during migration from older IPA
master
- Refresh Dogtag RestClient.ca_host property
- Remove the cachedproperty class
- Resolves: #1444787 Update warning message when KRA installation fails
- kra install: update installation failure message
- Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
- ipa-server-install with external CA: fix pkinit cert issuance
- Resolves: #1445397 GET in KerberosSession.finalize_kerberos_acquisition()
must use FreeIPA CA
- kerberos session: use CA cert with full cert chain for obtaining cookie
- Resolves: #1447375 ipa-client-install: extra space in pkinit_anchors
definition
- ipa-client-install: remove extra space in pkinit_anchors definition
- Resolves: #1447703 Fix SELinux contex of http.keytab during upgrade
- Use proper SELinux context with http.keytab
- Fix upgrade issue with AD trust when no trust yet established
Fixes: RHBZ#1708874
Related: RHBZ#1684528
- Resolves: #1131907 [ipa-client-install] cannot write certificate file
'/etc/ipa/ca.crt.new': must be string or buffer, not None
- Resolves: #1195775 unsaved changes dialog internally inconsistent
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- Stageusedr-activate: show username instead of DN
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Prevent to rename certprofile profile id
- Resolves: #1222047 IPA to AD Trust: IPA ERROR 4016: Remote Retrieve Error
- Resolves: #1224769 copy-schema-to-ca.py does not overwrites schema files
- copy-schema-to-ca: allow to overwrite schema files
- Resolves: #1241941 kdc component installation of IPA failed
- spec file: Update minimum required version of krb5
- Resolves: #1242036 Replica install fails to update DNS records
- Fix DNS records installation for replicas
- Resolves: #1242884 Upgrade to 4.2.0 fails when enabling kdc proxy
- Start dirsrv for kdcproxy upgrade
- ipa-kdb: fix error handling of is_master_host()
Resolves: RHBZ#2214638
- ipatests: enable firewall rule for http service on acme client
Resolves: RHBZ#2230256
- User plugin: improve error related to non existing idp
Resolves: RHBZ#2224572
- Prevent admin user from being deleted
Resolves: RHBZ#1821181
- Fix memory leak in the OTP last token plugin
Resolves: RHBZ#2227783
- Fix Fedora package changelog after merging systemd changes
- Backport latest test fixes in python3-ipatests
Resolves: RHBZ#2060841
- extdom: user getorigby{user|group}name if available
Resolves: RHBZ#2062379
- Set the mode on ipaupgrade.log during RPM post snipppet
Resolves: RHBZ#2061957
- test_krbtpolicy: skip SPAKE-related tests in FIPS mode
Resolves: RHBZ#1909630
- Fixed kdcproxy_version to 0.4-3
- Fixed krb5_version to 1.17-7
Related: RHBZ#1684528
- Handle NFS configuration file changes. nfs-utils moved the
configuration file from /etc/sysconfig/nfs to /etc/nfs.conf.
Resolves: RHBZ#1676981
- webui: Allow grace login limit
Resolves: RHBZ#2109243
- check_repl_update: in progress is a boolean
Resolves: RHBZ#2117303
- Disabling gracelimit does not prevent LDAP binds
Resolves: RHBZ#2109236
- Set passwordgracelimit to match global policy on group pw policies
Resolves: RHBZ#2115475
- Add Requires on krb5-pkinit-openssl
- Upstream release FreeIPA 4.9.6
Related: RHBZ#1945038
- Revise PKINIT upgrade code
Resolves: RHBZ#1886837
- ipa-cert-fix man page: add note about certmonger renewal
Resolves: RHBZ#1780317
- Certificate Serial Number issue
Resolves: RHBZ#1919384
- Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
- Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to
handle PKINIT certificates/anchors
- certdb: add named trust flag constants
- certdb, certs: make trust flags argument mandatory
- certdb: use custom object for trust flags
- install: trust IPA CA for PKINIT
- client install: fix client PKINIT configuration
- install: introduce generic Kerberos Augeas lens
- server install: fix KDC PKINIT configuration
- ipapython.ipautil.run: Add option to set umask before executing command
- certs: do not export keys world-readable in install_key_from_p12
- certs: do not export CA certs in install_pem_from_p12
- server install: fix KDC certificate validation in CA-less
- replica install: respect --pkinit-cert-file
- cacert manage: support PKINIT
- server certinstall: support PKINIT
- Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
option
- certs: do not export CA certs in install_pem_from_p12
- server install: fix KDC certificate validation in CA-less
- Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
decommissioned
- ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname
- Resolves: #1451712 KRA installation fails on server that was originally
installed as CA-less
- ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
- Resolves: #1441499 ipa cert-show does not raise error if no file name
specified
- ca/cert-show: check certificate_out in options
- Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
- Remove pkinit-anonymous command
- Resolves: #1449523 Provide an API command to retrieve PKINIT status
in the FreeIPA topology
- Allow for multivalued server attributes
- Refactor the role/attribute member reporting code
- Add an attribute reporting client PKINIT-capable servers
- Add the list of PKINIT servers as a virtual attribute to global config
- Add `pkinit-status` command
- test_serverroles: Get rid of MockLDAP and use ldap2 instead
- Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
- Fix rare race condition with missing ccache file
- Resolves: #1455045 Simple service uninstallers must be able to handle
missing service files gracefully
- only stop/disable simple service if it is installed
- Resolves: #1455541 after upgrade login from web ui breaks
- krb5: make sure KDC certificate is readable
- Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
command "ipa cert-request --add" after upgrade
- Change python-cryptography to python2-cryptography
- Require krb5 release 1.18.2-25 or later
Resolves: RHBZ#2234711
- Rebase ipa to 4.9.12
Resolves: RHBZ#2196425
- user or group name: explain the supported format
Resolves: RHBZ#2150217
- Allow insecure binds for migration
Resolves: RHBZ#1731963
- Trust add tries to add same value of --base-id for sub domain,
causing an error (#1033068)
- Improved error reporting for adding trust case (#1029856)
- Do not fetch a principal two times, remove potential memory leak (#1070924)
- Depend on krb5-kdb-version-devel for BuildRequires
- Update nss dependency to 3.44.0-4
- Reset per-indicator Kebreros policy
Resolves: RHBZ#1784761
- Resolves: #1339233 CA installed on replica is always marked as renewal master
- Related: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.3.1.201605241723GIT1b427d3
- Pull upstream changelog 722
- Add Conflicts mod_ssl (435360)
- Use default ssh host key algorithms
Resolves: RHBZ#1756432
- Do not run trust upgrade code if master lacks Samba bindings
Resolves: RHBZ#1757064
- Finish group membership management UI
Resolves: RHBZ#1773528
- Add ipa-host-net-manage script
- Use the OpenSSL certificate parser in cert-find
Resolves: RHBZ#2209947
- Add a- heck into ipa-cert-fix tool to avoid updating certs if CA is close to expire
Resolves: RHEL-4941
- Fix rpminspect's 'patches' warnings
Resolves: RHEL-22497
- replica install failing with avc denial for custodia component
Resolves: RHBZ#1857157
- Upstream pre release FreeIPA 4.9.0rc1
Resolves: RHBZ#1891832
- Requirements and design for libpwquality integration
Resolves: RHBZ#1340463
- When parsing options require name/value pairs
Resolves: RHBZ#1357495
- WebUI: Fix issue with opening links in new tab/window
Resolves: RHBZ#1484088
- Use a state to determine if a 389-ds upgrade is in progress
Resolves: RHBZ#1569011
- Unlock user accounts after a password reset and replicate that unlock to
all IdM servers
Resolves: RHBZ#1784657
- Set the certmonger subject with a string, not an object
Resolves: RHBZ#1810148
- Implement ACME certificate enrolment
Resolves: RHBZ#1851835
- [WebUI] Backport jQuery patches from newer versions of the library (e.g.
3.5.0)
Resolves: RHBZ#1859249
- It is not possible to edit KDC database when the FreeIPA server is running
Resolves: RHBZ#1875001
- Fix nsslapd-db-lock tuning of BDB backend
Resolves: RHBZ#1882340
- ipa-kdb: support subordinate/superior UPN suffixes
Resolves: RHBZ#1891056
- wgi/plugins.py: ignore empty plugin directories
Resolves: RHBZ#1894800
- Default to systemd for Fedora 16 and onwards
- Update to upstream 3.2.0 GA
- ipa-client-install fails if /etc/ipa does not exist (#961483)
- Certificate status is not visible in Service and Host page (#956718)
- ipa-client-install removes needed options from ldap.conf (#953991)
- Handle socket.gethostbyaddr() exceptions when verifying hostnames (#953957)
- Add triggerin scriptlet to support OpenSSH 6.2 (#953617)
- Require nss 3.14.3-12.0 to address certutil certificate import
errors (#953485)
- Require pki-ca 10.0.2-3 to pull in fix for sslget and mixed IPv4/6
environments. (#953464)
- ipa-client-install removes 'sss' from /etc/nsswitch.conf (#953453)
- ipa-server-install --uninstall doesn't stop dirsrv instances (#953432)
- Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for
socket based connections (#960222)
- Require libsss_nss_idmap-python
- Add Conflicts on nss-pam-ldapd < 0.8.4. The mapping from uniqueMember to
member is now done automatically and having it in the config file raises
an error.
- Add backup and restore tools, directory.
- require at least systemd 38 which provides the journal (we no longer
need to require syslog.target)
- Update Requires on policycoreutils to 2.1.14-37
- Update Requires on selinux-policy to 3.12.1-42
- Update Requires on 389-ds-base to 1.3.1.0
- Remove a Requires for java-atk-wrapper
- Preserve user: fix the confusing summary
Resolves: RHBZ#2022028
- Only calculate LDAP password grace when the password is expired
Related: RHBZ#782917
- Resolves: #1260663 crash of ipa-dnskeysync-replica component during
ipa-restore
- IPA Restore: allows to specify files that should be removed
- Resolves: #1261806 Installing ipa-server package breaks httpd
- Handle timeout error in ipa-httpd-kdcproxy
- Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
- Server Upgrade: backup CS.cfg when dogtag is turned off
- ipa-server-install crashes when AD subpackage is not installed (#1026434)
- Resolves: #1228671 pkispawn fails in ipa-ca-install and ipa-kra-install
- Related: #1204809 Rebase ipa to 4.2
- Fix minimum version of slapi-nis
- Require python-sss and python-sss-murmur (provided by sssd-1.13.0)
- Drop conflicts on mod_nss
- Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
- Drop a slew of conditionals on older Fedora releases (< 12)
- Add a few conditionals against RHEL 6
- Add Requires of nss-tools on ipa-client
- Upstream release FreeIPA 4.9.3
Resolves: RHBZ#1945038
- Fix systemd-user HBAC rule
Resolves: RHBZ#1664974
- sudo rule for "admins" members should be created by default (#1609873)
- New upstream release 1.2.1
- Updated to current upstream state of 3.0.0 beta 2 development
- Wrong directories created on full restore (#1186398)
- ipa-restore crashes if replica is unreachable (#1186396)
- idoverrideuser-add option --sshpubkey does not work (#1185410)
- Missing objectclasses when empty password passed to host-add (#1052979)
- sudoOrder missing in sudoers (#1052983)
- Missing examples in sudorule help (#1049464)
- Client automount does not uninstall when fstore is empty (#910899)
- Error not clear for invalid realm given to trust-fetch-domains (#1052981)
- trust-fetch-domains does not add idrange for subdomains found (#1049926)
- Add option to show if an AD subdomain is enabled/disabled (#1052973)
- ipa-adtrust-install still failed with long NetBIOS names (#1030517)
- Error not clear for invalid relam given to trustdomain-find (#1049455)
- renewed client cert not recognized during IPA CA renewal (#1033273)
- Revert bind-pkcs11-utils configuration in freeipa.spec.
Resolves: RHBZ#2026732
- Replace TurboGears requirement with python-cherrypy
- Update to upstream 3.2.1
- Drop dogtag-pki-server-theme requires, it won't be build for RHEL-7.0
- Remove ipa-idoverride-memberof as superceded by ipa-server 4.8.7
Resolves: RHBZ#1846434
- Respin after the tarball has been re-released upstream
New hash is 506c9c92dcaf9f227cba5030e999f177
- Allow Web-based migration to work with tightened SE Linux policy (#769440)
- Rebuild slapi plugins against re-enterant version of libldap
- Remove strict dependencies to krb5-server version in order to allow
update of krb5 to 1.17 and change dependency to KDB DAL version.
Resolves: RHBZ#1700121
- Fixed: rhbz#1643445 - External CA step 2 fails with pki_client_database_dir is missing
- Fixed: rhbz#1642834 - Smart card advise script uses hard-coded Python interpreter
- Resolves: #1277696 IPA certificate auto renewal fail with "Invalid
Credential"
- cert renewal: make renewal of ipaCert atomic
- Resolves: #1278330 installer options are not validated at the beginning of
installation
- install: fix command line option validation
- Resolves: #1282845 sshd_config change on ipa-client-install can prevent sshd
from starting up
- client install: do not corrupt OpenSSH config with Match sections
- Resolves: #1282935 ipa upgrade causes vault internal error
- install: export KRA agent PEM file in ipa-kra-install
- Resolves: #1283429 Default CA ACL rule is not created during
ipa-replica-install
- TLS and Dogtag HTTPS request logging improvements
- Avoid race condition caused by profile delete and recreate
- Do not erroneously reinit NSS in Dogtag interface
- Add profiles and default CA ACL on migration
- disconnect ldap2 backend after adding default CA ACL profiles
- do not disconnect when using existing connection to check default CA ACLs
- Resolves: #1283430 ipa-kra-install: fails to apply updates
- suppress errors arising from adding existing LDAP entries during KRA
install
- Resolves: #1283748 Caching of ipaconfig does not work in framework
- fix caching in get_ipa_config
- Resolves: #1283943 IPA DNS Zone/DNS Forward Zone details missing after
upgrade from RHEL 7.0 to RHEL 7.2
- upgrade: fix migration of old dns forward zones
- Fix upgrade of forwardzones when zone is in realmdomains
- Resolves: #1284413 ipa-cacert-manage renew fails on nonexistent ldap
connection
- ipa-cacert-renew: Fix connection to ldap.
- Resolves: #1284414 ipa-otptoken-import fails on nonexistent ldap connection
- ipa-otptoken-import: Fix connection to ldap.
- Resolves: #1286635 IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using
"yum update ipa* sssd"
- Set minimal required version for openssl
- Resolves: #1286781 ipa-nis-manage does not update ldap with all NIS maps
- Upgrade: Fix upgrade of NIS Server configuration
- Resolves: #1289311 umask setting causes named-pkcs11 issue with directory
permissions on /var/lib/ipa/dnssec
- DNS: fix file permissions
- Explicitly call chmod on newly created directories
- Fix: replace mkdir with chmod
- Resolves: #1290142 Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
- Fix version comparison
- use FFI call to rpmvercmp function for version comparison
- Resolves: #1292595 In IPA-AD trust environment some secondary IPA based Posix
groups are missing
- ipa-kdb: map_groups() consider all results
- Resolves: #1293870 User should be notified for wrong password in password
reset page
- Fixed login error message box in LoginScreen page
- Resolves: #1296196 Sysrestore did not restore state if a key is specified in
mixed case
- Allow to used mixed case for sysrestore
- Resolves: #1296214 DNSSEC key purging is not handled properly
- DNSSEC: Improve error reporting from ipa-ods-exporter
- DNSSEC: Make sure that current state in OpenDNSSEC matches key state in
LDAP
- DNSSEC: Make sure that current key state in LDAP matches key state in BIND
- DNSSEC: remove obsolete TODO note
- DNSSEC: add debug mode to ldapkeydb.py
- DNSSEC: logging improvements in ipa-ods-exporter
- DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP
- DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
- DNSSEC: ipa-ods-exporter: add ldap-cleanup command
- DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removal
- DNSSEC: Log debug messages at log level DEBUG
- Resolves: #1296216 ipa-server-upgrade fails if certmonger is not running
- prevent crash of CA-less server upgrade due to absent certmonger
- always start certmonger during IPA server configuration upgrade
- Resolves: #1297811 The ipa -e skip_version_check=1 still issues
incompatibility error when called against RHEL 6 server
- ipalib: assume version 2.0 when skip_version_check is enabled
- Resolves: #1298289 install fails when locale is "fr_FR.UTF-8"
- Do not decode HTTP reason phrase from Dogtag
- Resolves: #1300252 shared certificateProfiles container is missing on a
freshly installed RHEL7.2 system
- upgrade: unconditional import of certificate profiles into LDAP
- Resolves: #1301674 --setup-dns and other options is forgotten for using an
external PKI
- installer: Propagate option values from components instead of copying them.
- installer: Fix logic of reading option values from cache.
- Resolves: #1301687 issues with migration from RHEL 6 self-signed to RHEL 7 CA
IPA setup
- ipa-ca-install: print more specific errors when CA is already installed
- cert renewal: import all external CA certs on IPA CA cert renewal
- CA install: explicitly set dogtag_version to 10
- fix standalone installation of externally signed CA on IPA master
- replica install: validate DS and HTTP server certificates
- replica install: improvements in the handling of CA-related IPA config
entries
- Resolves: #1301901 [RFE] compat tree: show AD members of IPA groups
- slapi-nis: update configuration to allow external members of IPA groups
- Resolves: #1305533 ipa trust-add succeded but after that ipa trust-find
returns "0 trusts matched"
- upgrade: fix config of sidgen and extdom plugins
- trusts: use ipaNTTrustPartner attribute to detect trust entries
- Warn user if trust is broken
- fix upgrade: wait for proper DS socket after DS restart
- Insure the admin_conn is disconnected on stop
- Fix connections to DS during installation
- Fix broken trust warnings
- Resolves: #1321092 Installers fail when there are multiple versions of the
same certificate
- certdb: never use the -r option of certutil
- Related: #1317381 Crash during IPA upgrade due to slapd
- spec file: update minimum required version of slapi-nis
- Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112
CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws
[rhel-7.3]
- Rebuild against newer Samba version
- RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
(#1169591)
- CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
(#1172578)
- Re-arrange doc and defattr to clean up rpmlint warnings
- Remove conditionals on older releases
- Move some man pages into admintools subpackage
- Remove some explicit Requires in client that aren't needed
- Consistent use of buildroot vs RPM_BUILD_ROOT
- Update to upstream 3.3.1 (#991064)
- Update minimum version of bind-dyndb-ldap to 3.5
- Remove release from krb5-server in strict sub-package to allow for rebuilds.
- Fix krb5-kdb-server -> krb5-kdb-version
Related: RHBZ#1700121
- Unified spec file
- Update to upstream 3.1.2
- CVE-2012-4546: Incorrect CRLs publishing
- CVE-2012-5484: MITM Attack during Join process
- CVE-2013-0199: Cross-Realm Trust key leak
- Updated strict dependencies to 389-ds-base = 1.3.0.2 and
pki-ca = 10.0.1
- IPA Replicate creation fails with error "Update failed! Status: [10 Total
update abortedLDAP error: Referral]" (#1166265)
- running ipa-server-install --setup-dns results in a crash (#1072502)
- DNS zones are not migrated into forward zones if 4.0+ replica is added
(#1175384)
- gid is overridden by uid in default trust view (#1168904)
- When migrating warn user if compat is enabled (#1177133)
- Clean up debug log for trust-add (#1168376)
- No error message thrown on restore(full kind) on replica from full backup
taken on master (#1175287)
- ipa-restore proceed even IPA not configured (#1175326)
- Data replication not working as expected after data restore from full backup
(#1175277)
- IPA externally signed CA cert expiration warning missing from log (#1178128)
- ipa-upgradeconfig fails in CA-less installs (#1181767)
- IPA certs fail to autorenew simultaneouly (#1173207)
- More validation required on ipa-restore's options (#1176034)
- Installer did not detect different server and IPA domain (#1026845)
- Allow kernel keyring CCACHE when supported (#1026861)
- Resolves: #1442233 IPA client commands fail when pointing to replica
- httpinstance: wait until the service entry is replicated
- Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
not indexed
- Fix index definition for ipaAnchorUUID
- Resolves: #1438016 gssapi errors after IPA server upgrade
- Avoid possible endless recursion in RPC call
- rpc: preparations for recursion fix
- rpc: avoid possible recursion in create_connection
- Resolves: #1446087 services entries missing krbCanonicalName attribute.
- Changing cert-find to do not use only primary key to search in LDAP.
- Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
- ipa-kdb: reload certificate mapping rules periodically
- Resolves: #1455541 after upgrade login from web ui breaks
- kdc.key should not be visible to all
- Resolves: #1435606 Add pkinit_indicator option to KDC configuration
- ipa-kdb: add pkinit authentication indicator in case of a successful
certauth
- Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
issuance when ipa-ca records are not resolvable
- Turn off OCSP check
- Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
server_del - TypeError: 'NoneType' object is not iterable
- fix incorrect suffix handling in topology checks
- Hardening for CVE-2020-25717
- Related: RHBZ#2019668
- Require python-wehjit >= 0.2.2
- Resolves: #837369 [RFE] Switch to client promotion to replica model
- Resolves: #1199516 [RFE] Move replication topology to the shared tree
- Resolves: #1206588 [RFE] Visualize FreeIPA server replication topology
- Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
- Resolves: #1212713 ipa-csreplica-manage: it could be nice to have also
list-ruv / clean-ruv / abort-clean-ruv for o=ipaca backend
- Resolves: #1267206 ipa-server-install uninstall should warn if no
installation found
- Resolves: #1295865 The Domain option is not correctly set in idmapd.conf when
ipa-client-automount is executed.
- Resolves: #1327092 URI details missing and OCSP-URI details are incorrectly
displayed when certificate generated using IPA on RHEL 7.2up2.
- Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
because of missing dependencies
- Related: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.3.1.201605191449GITf8edf37
- Update to upstream 4.6.90.pre1
- Resolves: #1355753 adding two way non transitive(external) trust displays
internal error on the console
- Always fetch forest info from root DCs when establishing two-way trust
- factor out `populate_remote_domain` method into module-level function
- Always fetch forest info from root DCs when establishing one-way trust
- Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
after `ipa-replica-install`
- Track lightweight CAs on replica installation
- Resolves: #1357488 ipa command stuck forever on higher versioned client with
lower versioned server
- compat: Save server's API version in for pre-schema servers
- compat: Fix ping command call
- schema cache: Store and check info for pre-schema servers
- Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
- Fix man page ipa-replica-manage: remove duplicate -c option
from --no-lookup
- Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
when revoking certificate
- cert: include CA name in cert command output
- WebUI add support for sub-CAs while revoking certificates
- Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
- Add support for additional options taken from table facet
- WebUI: Fix showing certificates issued by sub-CA
- Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
internactively
- dns: normalize record type read interactively in dnsrecord_add
- dns: prompt for missing record parts in CLI
- dns: fix crash in interactive mode against old servers
- Resolves: #1370519 Certificate revocation in service-del and host-del isn't
aware of Sub CAs
- cert: fix cert-find --certificate when the cert is not in LDAP
- Make host/service cert revocation aware of lightweight CAs
- Resolves: #1371901 Use OAEP padding with custodia
- Use RSA-OAEP instead of RSA PKCS#1 v1.5
- Resolves: #1371915 When establishing external two-way trust, forest root
Administrator account is used to fetch domain info
- do not use trusted forest name to construct domain admin principal
- Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
certificate request
- Fix CA ACL Check on SubjectAltNames
- Resolves: #1373272 CLI always sends default command version
- cli: use full name when executing a command
- Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
- Fix ipa-certupdate for CA-less installation
- Resolves: #1373540 client-install with IPv6 address fails on link-local
address (always)
- Fix parse errors with link-local addresses
- man page: update ipa-server-upgrade.1
Resolves: RHBZ#1973273
- Fall back to krbprincipalname when validating host auth indicators
Resolves: RHBZ#1979625
- Add dependency for sssd-winbind-idmap to server-trust-ad
Resolves: RHBZ#1982211
- Fix replica installation failing on certificate subject (#983075)
- Rebase ipa to 4.9.11
Resolves: RHBZ#2141316
- updates: fix memberManager ACI to allow managers from a specified group
Resolves: RHBZ#2056009
- Defer creating the final krb5.conf on clients
Resolves: RHBZ#2148259
- Exclude installed policy module file from RPM verification
Resolves: RHBZ#2149567
- Spec file: ipa-client depends on krb5-pkinit-openssl
Resolves: RHBZ#2149889
- When IdM server trusts multiple AD forests, IPA client returns invalid group
membership info (#1079498)
- IPA server in debug mode fails to run because time.perf_counter_ns is
Python 3.7+
Resolves: RHBZ#1974822
- Add checks to prevent assigning authentication indicators to internal IPA
services
Resolves: RHBZ#1979625
- Unable to set ipaUserAuthType with stageuser-add
Resolves: RHBZ#1979605
- Replica installation fails for RHEL 6.4 master (#1004680)
- Server uninstallation crashes if DS is not available (#998069)
- Updated to upstream 3.1.0 GA
- Set minimum for sssd to 1.9.2
- Set minimum for pki-ca to 10.0.0-1
- Set minimum for 389-ds-base to 1.3.0
- Set minimum for selinux-policy to 3.11.1-60
- Remove unneeded dogtag package requires
- Updated to upstream 3.0.0 rc 1
- Update BR for 389-ds-base to 1.2.11.14
- Update BR for krb5 to 1.10
- Update BR for samba4-devel to 4.0.0-139 (rc1)
- Add BR for python-polib
- Update BR and Requires on sssd to 1.9.0
- Update Requires on policycoreutils to 2.1.12-5
- Update Requires on 389-ds-base to 1.2.11.14
- Update Requires on selinux-policy to 3.11.1-21
- Update Requires on dogtag to 10.0.0-0.33.a1
- Update Requires on certmonger to 0.60
- Update Requires on tomcat to 7.0.29
- Update minimum version of bind to 9.9.1-10.P3
- Update minimum version of bind-dyndb-ldap to 1.1.0-0.16.rc1
- Remove Requires on authconfig from python sub-package
- Update Requires on krb5-server to 1.11
- Moved directory install/static to install/ui
- Fix ipa-pwd-extop global configuration caching (#1187342)
- group-detach does not add correct objectclasses (#1187540)
- Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
- Keep NSS trust flags of existing certificates
- Resolves: #1360813 ipa-server-certinstall does not update all certificate
stores and doesn't set proper trust permissions
- Add cert checks in ipa-server-certinstall
- Resolves: #1371479 cert-find --all does not show information about revocation
- cert: add revocation reason back to cert-find output
- Resolves: #1375133 WinSync users who have First.Last casing creates users who
can have their password set
- ipa passwd: use correct normalizer for user principals
- Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
- Properly handle LDAP socket closures in ipa-otpd
- Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
- Make httpd publish its CA certificate on DL1
- ipatests: remove additional check for failed units.
Resolves: RHBZ#2053024
- ipa-cldap: fix memory leak.
Resolves: RHBZ#2032738
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Resolves: #1382053 Need to have validation for idrange names
- idrange-add: properly handle empty --dom-name option
- Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
helper when installing replica
- dsinstance: reconnect ldap2 after DS is restarted by certmonger
- httpinstance: avoid httpd restart during certificate request
- dsinstance, httpinstance: consolidate certificate request code
- install: request service certs after host keytab is set up
- renew agent: revert to host keytab authentication
- renew agent, restart scripts: connect to LDAP after kinit
- Resolves: #1436987 ipasam: gidNumber attribute is not created in the trusted
domain entry
- ipa-sam: create the gidNumber attribute in the trusted domain entry
- Upgrade: add gidnumber to trusted domain entry
- Resolves: #1438679 [ipa-replica-install] - IncorrectPasswordException:
Incorrect client security database password
- Add pki_pin only when needed
- Resolves: #1438348 Console output message while adding trust should be
mapped with texts changed in Samba.
- ipaserver/dcerpc: unify error processing
- Resolves: #1438366 ipa trust-fetch-domains: ValidationError: invalid
'Credentials': Missing credentials for cross-forest communication
- trust: always use oddjobd helper for fetching trust information
- Resolves: #1441192 Add the name of URL parameter which will be check for
username during cert login
- WebUI: cert login: Configure name of parameter used to pass username
- Resolves: #1437879 [copr] Replica install failing
- Create system users for FreeIPA services during package installation
- Resolves: #1441316 WebUI cert auth fails after ipa-adtrust-install
- Fix s4u2self with adtrust
- Require samba 4.14.5-13 with IPA DC server role fixes
- Related: RHBZ#2021443
- Update to upstream 3.2.2
- Drop ipa-server-selinux subpackage
- Drop redundant directory /var/cache/ipa/sessions
- Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
- Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
issues when there are still old parts of software (like entitlements plugin)
- Version bump for release
- Add versioned dependency of samba-client-libs to ipa-server
- Related: RHBZ#2021443
- Upstream release FreeIPA 4.8.7
- Require new samba build 4.12.3-0
Related: RHBZ#1818765
- New client-epn sub package
Resolves: RHBZ#913799
ipa-selinux-4.9.13-20.module+el8.10.0+2067+377bdd64.noarch.rpm | - Resolves: #846033 [RFE] Documentation for JSONRPC IPA API
- Resolves: #989091 Ability to manage IdM/IPA directly from a standard LDAP
client
- Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
users in IdM
- Resolves: #1115294 [RFE] Add support for DNSSEC
- Resolves: #1145748 [RFE] IPA running with One Way Trust
- Resolves: #1199520 [RFE] Introduce single upgrade tool - ipa-server-upgrade
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Resolves: #1200728 [RFE] Replicate PKI Profile information
- Resolves: #1200735 [RFE] Allow issuing certificates for user accounts
- Resolves: #1204054 SSSD database is not cleared between installs and
uninstalls of ipa
- Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
Trusts
- Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
- Resolves: #1204504 [RFE] Add access control so hosts can create their own
services
- Resolves: #1206534 [RFE] Offer Kerberos over HTTP (kdcproxy) by default
- Resolves: #1206613 [RFE] Configure IPA to be a trust agent by default
- Resolves: #1209476 package ipa-client does not require package dbus-python
- Resolves: #1211589 [RFE] Add option to skip the verify_client_version
- Resolves: #1211608 [RFE] Generic support for unknown DNS RR types (RFC 3597)
- Resolves: #1215735 ipa-replica-prepare automatically adds a DNS zone
- Resolves: #1217010 OTP Manager field is not exposed in the UI
- Resolves: #1222475 krb5kdc : segfault at 0 ip 00007fa9f64d82bb sp
00007fffd68b2340 error 6 in libc-2.17.so
- Related: #1204809 Rebase ipa to 4.2
- Update to upstream 4.2.0
- Move /etc/ipa/kdcproxy to the server subpackage
- Hardening for CVE-2020-25717
- Rebuild against samba-4.14.5-11.el8
- Resolves: RHBZ#2021443
- PKI database is ugraded during replica installation (#1075118)
- Resolves: #1254689 Storing big file as a secret in vault raises traceback
- vault: Limit size of data stored in vault
- Resolves: #1255880 ipactl status should distinguish between different
pki-tomcat services
- ipactl: Do not start/stop/restart single service multiple times
- Upstream pre release FreeIPA 4.9.0rc3
Related: RHBZ#1891832
- Updated to upstream 3.0.0 GA
- Set minimum for samba to 4.0.0-153.
- Make sure server-trust-ad subpackage alternates winbind_krb5_locator.so
plugin to /dev/null since they cannot be used when trusts are configured
- Restrict krb5-server to 1.10.
- Update BR for 389-ds-base to 1.3.0
- Add directory /var/lib/ipa/pki-ca/publish for CRL published by pki-ca
- Add Requires on zip for generating FF browser extension
- Resolves: #1614301 Remove --no-sssd and --noac options
- Resolves: #1613879 Disable Domain Level 0
- New patch sets to disable domain level 0
- New adapted patch to disable DL0 specific tests (pytest_ipa vs.
pytest_plugins)
- Adapted branding patch in ipa-replica-install.1 due to DL0 removal
- Set mode of /etc/ipa/ca.crt to 0644 in CA-less installations
Resolves: RHBZ#1870202
- Resolves: #1475238 Use CommonNameToSANDefault in default profile
(new installs only)
- Restore old version of caIPAserviceCert for upgrade only
- Remove ipa-server-selinux obsoletes as upgrades from version prior to
3.3.0 are not allowed
- Wrap server-trust-ad subpackage description better
- Add (noreplace) flag for %{_sysconfdir}/tmpfiles.d/ipa.conf
- Change permissions on default_encoding_utf8.so to fix ipa-python Provides
- Use default crypto policy for TLS and enable TLS 1.3 support
Resolves: RHBZ#1777809
- Covscan fixes
Resolves: RHBZ#1777920
- Change pki_version to 10.8.0
Related: RHBZ#1748987
- Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
- Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
- Related: #1356134 'kinit -E' does not work for IPA user
- Add bash completion script and own /etc/bash_completion.d in case it
doesn't already exist
- Bump up minimum version of python-nss to pick up nss_is_initialize() API
- Updated to upstream 3.0.0 beta 1
- Resolves: #1416454 replication race condition prevents IPA to install
- wait_for_entry: use only DN as parameter
- Wait until HTTPS principal entry is replicated to replica
- Use proper logging for error messages
- Unable to remove replica by ipa-replica-manage (#1001662)
- Before uninstalling a server, warn about active replicas (#998069)
- Move initialization of Guests mapping after cifs/ principal is created
- Related: rhbz#1623895
- Upstream release FreeIPA 4.9.1
Related: RHBZ#1891832
- Fix mapping of BUILTIN\Guests to 'nobody' group during upgrade
to not use generated Samba config at this point
- Related: rhbz#1623895
- Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
- Increase default timeout for IPA services (#1033273)
- Error while running trustdomain-find (#1054376)
- group-show lists SID instead of name for external groups (#1054391)
- Fix IPA server NetBIOS name in samba configuration (#1030517)
- dnsrecord-mod produces missing API version warning (#1054869)
- Hide trust-resolve command as internal (#1052860)
- Add Trust domain Web UI (#1054870)
- ipasam cannot delete multiple child trusted domains (#1056120)
- Require 389-ds-base-legacy-tools for setup tools
- ipatests: Update ipa-adtrust-install test
Resolves: RHEL-40894
- Conditionally restart also dirsrv and httpd when upgrading
- IPA extdom plugin fails when encountering large groups (#1193759)
- CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
(#1202998)
- Added auto* BuildRequires
- Added httpd SELinux policy so CRLs can be read
- Revert DNSResolver Fix use of nameservers with ports.
Related: RHBZ#2141316
- Fix NetBIOS name generation in CLDAP plugin (#1030517)
- ipa-kdb: Fix double free in ipadb_reinit_mspac()
Resolves: RHEL-25742
- kra: set RSA-OAEP as default wrapping algo when FIPS is enabled
Resolves: RHEL-12153
- Vault: improve vault server archival/retrieval calls error handling
Resolves: RHEL-12153
- Vault: add support for RSA-OAEP wrapping algo
Resolves: RHEL-12153
- Fix postin scriplet for F-15/F-16
- Deletion of active subdomain range should not be allowed (#1075615)
- Fallback to global policy in ipa lockout plugin (#912725)
- Migration does not add users to default group (#903232)
- ipa-kdb: Make AD-SIGNEDPATH optional with krb5 DAL 8 and older
Resolves: RHEL-12198
- Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
tracked
- cert renewal: Include KRA users in Dogtag LDAP update
- cert renewal: Automatically update KRA agent PEM file
- Resolves: #1257163 renaming certificatte profile with --rename option leads
to integrity issues
- certprofile: remove 'rename' option
- Resolves: #1257968 kinit stop working after ipa-restore
- Backup: back up the hosts file
- Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
- DNSSEC: remove "DNSSEC is experimental" warnings
- Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
- Installer: do not modify /etc/hosts before user agreement
- Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
zone
- DNSSEC: backup and restore opendnssec zone list file
- DNSSEC: remove ccache and keytab of ipa-ods-exporter
- DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
- DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
- DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
key master
- DNSSEC: Fix key metadata export
- DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
- Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
- Using LDAPI to setup CA and KRA agents.
- Resolves: #1259848 server closes connection and refuses commands after
deleting user that is still logged in
- ldap: Make ldap2 connection management thread-safe again
- Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
'ra_certprofile' while ipa-ca-install
- load RA backend plugins during standalone CA install on CA-less IPA master
- Remove dependency on nss_ldap/nss-pam-ldapd
- The official client is sssd and that's what we use by default.
- Resolves: #1461177 ipa-otptoken-import - XML file is missing PBKDF2
parameters!
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
search in cn=ad, cn=trusts,dc=example,dc=com
- Resolves: #1467887 iommu platform support for ipxe
- Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic key for
host
- Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
4.5
- Resolves: #1480102 ipa-server-upgrade failes with "This entry already
exists"
- Resolves: #1482802 Unable to set ca renewal master on replica
- Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
(ipa-server-upgrade)
- Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
thus startup of Web UI fails
- Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
to self-signed CA
- Resolves: #1469246 Replica install fails to configure IPA-specific
temporary files/directories
- Resolves: #1469480 bind package is not automatically updated during
ipa-server upgrade process
- Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
installs only)
- Resolves: #1477703 IPA upgrade fails for latest ipa package
- Prevent multilib failures in *.pyo and *.pyc files
- Update dependencies for samba, 389-ds and sssd
Resolves: RHBZ#1792848
- Remove v1-style /etc/ipa/ipa.conf, replacing with /etc/ipa/default.conf
- Removed python-asset based webui
- Improve server affinity for CA-less deployments
Resolves: RHEL-22283
- host: update system: Manage Host Keytab permission
Resolves: RHEL-22286
- adtrustinstance: make sure NetBIOS name defaults are set properly
Resolves: RHEL-21938
- ipatests: Fix healthcheck report when nsslapd accesslog logbuffering is set to off
Resolves: RHEL-19672
- Resolves: #1377973 ipa-server-install fails when the provided or resolved
IP address is not found on local interfaces
- Only warn when specified server IP addresses don't match intf
- Resolves: #1438016 gssapi errors after IPA server upgrade
- Bump version of python-gssapi
- Resolves: #1457942 certauth: use canonical principal for lookups
- ipa-kdb: use canonical principal in certauth plugin
- Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
breaking older clients
- Add code to be able to set default kinit lifetime
- Revert setting sessionMaxAge for old clients
- Add missing entry for /var/cache/ipa/kpasswd (444624)
- Added patch to fix permissions problems with the Apache NSS database.
- Added patch to fix problem with DNS querying where the query could be
returned as the answer.
- Fix spec error where patch1 was in the wrong section
- Update to upstream 3.3.3 (#991064)
- Rebuild against samba4 beta7
- [WebUI] IPA Error 3007: RequirmentError" while adding members in
"User ID overrides" tab (updated)
Resolves: RHBZ#1757045
- ipa-client-install: use the authselect backup during uninstall
Resolves: RHBZ#1810179
- Replace SSLCertVerificationError with CertificateError for py36
Resolves: RHBZ#1858318
- Fix AVC denial during ipa-adtrust-install --add-agents
Resolves: RHBZ#1859213
- ipa-server-install fails if --subject parameter is other than default
realm (#983075)
- do not allow configuring bind-dyndb-ldap without persistent search (#967876)
- Lockout plugin crashed during ipa-server-install (#912725)
- Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
- ldap: limit the retro changelog to dns subtree
- Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
of "CA:FALSE" IPA CA CSR
- Include the CA basic constraint in CSRs when renewing a CA
- Resolves: #1493145 ipa-replica-install might fail because of an already
existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
- Checks if replica-s4u2proxy.ldif should be applied
- Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
- ds: ignore time skew during initial replication step
- ipa-replica-manage: implicitly ignore initial time skew in force-sync
- Resolves: #1500218 Replica installation at domain-level 0 fails against
upgraded ipa-server
- Fix ipa-replica-conncheck when called with --principal
- Resolves: #1506188 server-del doesn't remove dns-server configuration
from ldap
- Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
- Fix an integer underflow bug in libotp
- Resolves: #1262996 ipa vault internal error on replica without KRA
- install: always export KRA agent PEM file
- vault: select a server with KRA for vault operations
- Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
- do not overwrite files with local users/groups when restoring authconfig
- Renamed patch 1011 to 0138, as it was merged upstream
- Resolves: #1469246 Replica install fails to configure IPA-specific
temporary files/directories
- replica install: drop-in IPA specific config to tmpfiles.d
- Resolves: #1469480 bind package is not automatically updated during
ipa-server upgrade process
- Bumped Required version of bind-dyndb-ldap and bind package
- Set minimum version of sssd to 1.5.1
- Update to upstream freeipa-2.0.0.rc1
- Move server-only binaries from admintools subpackage to server
- Resolves: #1455946 Provide a tooling automating the configuration
of Smart Card authentication on a FreeIPA master
- smart-card advises: configure systemwide NSS DB also on master
- smart-card advises: add steps to store smart card signing CA cert
- Allow to pass in multiple CA cert paths to the smart card advises
- add a class that tracks the indentation in the generated advises
- delegate the indentation handling in advises to dedicated class
- advise: add an infrastructure for formatting Bash compound statements
- delegate formatting of compound Bash statements to dedicated classes
- Fix indentation of statements in Smart card advises
- Use the compound statement formatting API for configuring PKINIT
- smart card advises: use a wrapper around Bash `for` loops
- smart card advise: use password when changing trust flags on HTTP cert
- smart-card-advises: ensure that krb5-pkinit is installed on client
- Resolves: #1475238 Use CommonNameToSANDefault in default profile
(new installs only)
- Add CommonNameToSANDefault to default cert profile
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s
during search in cn=ad,cn=trusts,dc=example,dc=com
- NULL LDAP context in call to ldap_search_ext_s during search
- Fixed share/ipa/wsgi.py so .pyc, .pyo files are included
- No need to create /var/log/ipa_error.log since we aren't using
TurboGears any more.
- Update to upstream 2.1.0
- Upstream pre release FreeIPA 4.9.0rc2
Related: RHBZ#1891832
- Synchronize spec file with upstream and Fedora
Related: RHBZ#1891832
- Traceback while doing ipa-backup
Resolves: RHBZ#1901068
- ipa-client-install changes system wide ssh configuration
Resolves: RRBZ#1544379
- ipa-kdb: support subordinate/superior UPN suffixes
Resolves: RHBZ#1891056
- KRA Transport and Storage Certificates do not renew
Resolves: RHBZ#1872603
- Move where the restore state is marked during IPA server upgrade
Resolves: RHBZ#1569011
- Intermittent IdM Client Registration Failures
Resolves: RHBZ#1812871
- Nightly test failure in test_acme.py::TestACME::test_third_party_certs
(updates-testing)
Resolves: RHBZ#1903025
- Add IPA RA Agent to ACME group on the CA
Resolves: RHBZ#1902727
- Resolves: #1356102 Server uninstall does not stop tracking lightweight sub-CA
with certmonger
- uninstall: untrack lightweight CA certs
- Resolves: #1351807 ipa-nis-manage config.get_dn missing
- ipa-nis-manage: Use server API to retrieve plugin status
- Resolves: #1353452 ipa-compat-manage command failed,
exception: NotImplementedError: config.get_dn()
- ipa-compat-manage: use server API to retrieve plugin status
- Resolves: #1353899 ipa-advise: object of type 'type' has no len()
- ipa-advise: correct handling of plugin namespace iteration
- Resolves: #1356134 'kinit -E' does not work for IPA user
- kdb: check for local realm in enterprise principals
- Resolves: #1353072 ipa unknown command vault-add
- Enable vault-* commands on client
- vault-add: set the default vault type on the client side if none was given
- Resolves: #1353995 Default CA can be used without a CA ACL
- caacl: expand plugin documentation
- Resolves: #1356144 host-find should not print SSH keys by default, only
SSH fingerprints
- host-find: do not show SSH key by default
- Resolves: #1353506 ipa migrate-ds command fails for IPA in RHEL 7.3
- Removed unused method parameter from migrate-ds
- Expand the token auth/sync windows (#919228)
- Access is not rejected for disabled domain (#1172598)
- krb5kdc crash in ldap_pvt_search (#1170695)
- RHEL7.1 IPA server httpd avc denials after upgrade (#1164896)
- Ensure that /etc/ipa exists before moving user-modifiable html files there
- Put html files into /etc/ipa/html instead of /etc/ipa
- Replica CA installation: ignore skew during initial replication
Resolves RHEL-80995
- Update to upstream version 1.1.0
- Patch for indexing memberof attribute
- Patch for indexing uidnumber and gidnumber
- Patch to change DNA default values for replicas
- Patch to fix uninitialized variable in ipa-getkeytab
- Fix --external-ca-profile not passed to CSR
Resolves: RHBZ#1731813
- Upgrade: fix replica agreement, fix backported patch
Related: RHBZ#2216551
- Enforce uniqueness across krbprincipalname and krbcanonicalname
ipa-kdb: enforce PAC presence on TGT for TGS-REQ
ipatests: extend test for unique krbcanonicalname
Resolves: RHEL-110061
- Resolve: #1455946 Provide a tooling automating the configuration
of Smart Card authentication on a FreeIPA master
- server certinstall: update KDC master entry
- pkinit manage: introduce ipa-pkinit-manage
- server upgrade: do not enable PKINIT by default
- Extend the advice printing code by some useful abstractions
- Prepare advise plugin for smart card auth configuration
- Resolve: #1461053 allow to modify list of UPNs of a trusted forest
- trust-mod: allow modifying list of UPNs of a trusted forest
- WebUI: add support for changing trust UPN suffixes
- Rebuilt for glibc bug#747377
- Update to upstream freeipa-2.0.0.rc2
- Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
- Set minimum version of sssd to 1.5.1
- Patch to include SuiteSpotGroup when setting up 389-ds instances
- Move a lot of BuildRequires so this will build with ONLY_CLIENT enabled
- Added support for ipa_kpasswd and ipa_pwd_extop
- Rebase to upstream release 4.8.4
- Removed upstream patches 0001 to 0008 that are part of version 4.8.3-3
Resolves: RHBZ#1782658
Resolves: RHBZ#1782169
Resolves: RHBZ#1783046
Related: RHBZ#1748987
- Update to upstream GA release
- Automatically apply updates when the package is upgraded
- Remove ipa_webgui, its functions rolled into ipa_httpd
- kdb: keeep ipadb_get_connection() from succeding with null LDAP context
Resolves: RHEL-58453
- CVE-2019-14867: Denial of service in IPA server due to wrong use of ber_scanf()
Resolves: RHBZ#1767304
- CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
Resolves: RHBZ#1776939
- Removed python-cherrypy from BuildRequires and Requires
- Added Requires python-assets, python-wehjit
- Resolves: #1609883 ipaserver/plugins/cert.py: Add reason to raise of
errors.NotFound
- Resolves: #1615765 do-not-use-RC4-in-FIPS-mode
- Move fips_enabled to a common library to share across different plugins
- ipasam: do not use RC4 in FIPS mode
- Marked with wrong license. IPA is GPLv2.
- Update to upstream 3.2.0 Prerelease 1
- Use upstream reference spec file as a base for Fedora spec file
- Change Requires from fedora-ds-base to 389-ds-base
- Set minimum level of 389-ds-base to 1.2.6 for the replication
version plugin.
- Resolves: #747612 [RFE] IPA should support and manage DNS sites
- Resolves: #826790 Disabling password expiration (--maxlife=0 and --minlife=0)
in the default global_policy in IPA sets user's password expiration
(krbPasswordExpiration) to be 90 days
- Resolves: #896699 ipa-replica-manage -H does not delete DNS SRV records
- Resolves: #1084018 [RFE] Add IdM user password change support for legacy
client compat tree
- Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
aliases)
- Fix incorrect check for principal type when evaluating CA ACLs
- Resolves: #1146860 [RFE] Offer OTP generation for host enrollment in the UI
- Resolves: #1238190 ipasam unable to lookup group in directory yet manual
search works
- Resolves: #1250110 search by users which don't have read rights for all attrs
in search_attributes fails
- Resolves: #1263764 Show Certificate displays in useless format
- Resolves: #1272491 [WebUI] Certificate action dropdown does not display all
the options after adding new certificate
- Resolves: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.4.0
- Resolves: #1294503 IPA fails to issue 3rd party certs
- Resolves: #1298242 [RFE] API compatibility - compatibility of clients
- Resolves: #1298848 [RFE] Centralized topology management
- Resolves: #1298966 [RFE] Extend Smart Card support
- Resolves: #1315146 Multiple clients cannot join domain simultaneously:
/var/run/httpd/ipa/clientcaches race condition?
- Resolves: #1318903 ipa server install failing when SUBCA signs the cert
- Resolves: #1319003 ipa-winsync-migrate: Traceback should be fixed with proper
console output
- Resolves: #1324055 IPA always qualify requests for admin
- Resolves: #1328552 [RFE] Allow users to authenticate with alternative names
- Resolves: #1334582 Inconsistent UI and CLI options for removing certificate
hold
- Resolves: #1346321 Exclude o=ipaca subtree from Retro Changelog (syncrepl)
- Resolves: #1349281 Fix `Conflicts` with ipa-python
- Resolves: #1350695 execution of copy-schema script fails
- Resolves: #1351118 upgrade failed for RHEL-7.3 from RHEL-7.2.z
- Resolves: #1351153 AVC seen on Replica during ipa-server upgrade test
execution to 7.3
- Resolves: #1351276 ipa-server-install with dns cannot resolve itself to
create ipa-ca entry
- Related: #1343422 [RFE] Add GssapiImpersonate option
- Pull upstream changelog 698
- Fix ownership of /var/log/ipa_error.log during install (435119)
- Add pwpolicy command and man page
- Fix requirement for python3-kdcproxy, add no autoreqprov for ipatests sub
package
Related: RHBZ#1891832
- ipa-csreplica-manage connect fails (#1157735)
- error message which is not understandable when IDNA2003 characters are
present in --zonemgr (#1163849)
- Fix warning message should not contain CLI commands (#1114013)
- Renewing the CA signing certificate does not extend its validity period end
(#1163498)
- RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
httpd (#1159330)
- Make sure ipa-server depends on krb5-kdb-version to pick up
right MIT Kerberos KDB ABI
Related: RHBZ#1700121
- User field separator uses '$$' within ipaSELInuxUserMapOrder
Fixes: RHBZ#1729099
- Require the Python interpreter directly instead of using the package name
- Related: rhbz#1619153
- DNS install check: Fix overlapping DNS zone from the master itself
Resolves: RHBZ#1784003
- Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
Trusts
- winsync-migrate: Convert entity names to posix friendly strings
- winsync-migrate: Properly handle collisions in the names of external groups
- Resolves: #1261074 Adjust Firefox configuration to new extension signing
policy
- webui: use manual Firefox configuration for Firefox >= 40
- Resolves: #1263337 IPA Restore failed with installed KRA
- ipa-backup: Add mechanism to store empty directory structure
- Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
and private key in world readable file [rhel-7.2]
- install: fix KRA agent PEM file permissions
- Resolves: #1265086 Mark IdM API Browser as experimental
- WebUI: add API browser is experimental warning
- Resolves: #1265277 Fix kdcproxy user creation
- install: create kdcproxy user during server install
- platform: add option to create home directory when adding user
- install: fix kdcproxy user home directory
- Resolves: #1265559 GSS failure after ipa-restore
- destroy httpd ccache after stopping the service
- Resolves: #1432630 python2-jinja2 needed for python2-ipaclient
- Remove csrgen
- Resolves: #1432903 Set GssProxy options to enable caching of ldap tickets
- Add options to allow ticket caching
- Update to upstream version 1.2.0
- Set fedora-ds-base minimum version to 1.1.3 for winsync header
- Set the minimum version for SELinux policy
- Remove references to Fedora 7
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650139
- Added support for libipa-dna-plugin
- Rebuild to samba 4.17.2.
Related: RHBZ#2132051
- Update to upstream 4.7.0 GA
- ipatests: fix TestOTPToken::test_check_otpd_after_idle_timeout
Related: RHBZ#2053024
- Resolves: #1477703 IPA upgrade fails for latest ipa package
- Restore old version of caIPAserviceCert for upgrade only
- Reinstalling ipa server hangs when configuring certificate
server (#1018804)
- Allow longer dirsrv startup with systemd:
- IPAdmin class will wait until dirsrv instance is available up to 10 seconds
- Helps with restarts during upgrade for ipa-ldap-updater
- Fix pylint warnings from F16 and Rawhide
- selinux don't audit rules deny fetching trust topology
Resolves: RHBZ#1845596
- fix iPAddress cert issuance for >1 host/service
Resolves: RHBZ#1846352
- Specify cert_paths when calling PKIConnection
Resolves: RHBZ#1849155
- Update crypto policy to allow AD-SUPPORT when installing IPA
Resolves: RHBZ#1851139
- Add version to ipa-idoverride-memberof obsoletes
Related: RHBZ#1846434
- Resolves: #1365858 ipa-ca-install fails on replica when IPA Master is
installed without CA
- Set up DS TLS on replica in CA-less topology
- Resolves: #1398600 IPA replica install fails with dirsrv errors.
- Do not configure PKI ajp redirection to use "::1"
- Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
ca-del, ca-disable and ca-enable commands
- ca: correctly authorise ca-del, ca-enable and ca-disable
- Rebuild for Python 2.6
- Allow ipa-tests to work with older version (1.7.7) of python-paramiko
- Resolves: #1477367 ipa-server-upgrade timeouts on wait_for_open ports
expecting IPA services listening on IPv6 ports
- Make sure upgrade also checks for IPv6 stack
- control logging of host_port_open from caller
- log progress of wait_for_open_ports
- Resolves: #1477243 ipa help command returns traceback when no cache
is present
- Store help in Schema before writing to disk
- Disable pylint in get_help function because of type confusion.
- Require samba packages instead of obsoleted samba4 packages
- Fixed License in specfile
- Include files from /usr/lib/python*/site-packages/ipaserver
- Set the N-V-R so rc1 is an update to beta2.
- Resolves: #1452216 Replica installation grants HTTP principal
access in WebUI
- Make sure we check ccaches in all rpcserver paths
- Mass rebuild 2013-12-27
- Drop Requires of python-krbV on ipa-client
- Resolves: #828866 [RFE] enhance --subject option for ipa-server-install
- Resolves: #1160555 ipa-server-install: Cannot handle double hyphen "--" in
hostname
- Resolves: #1286288 Insufficient 'write' privilege to the 'ipaExternalMember'
attribute
- Resolves: #1321652 ipa-server-install fails when using external certificates
that encapsulate RDN components in double quotes
- Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
revocation reasons
- Resolves: #1340880 ipa-server-install: improve prompt on interactive
installation
- Resolves: #1353841 ipa-replica-install fails to install when resolv.conf
incomplete entries
- Resolves: #1356104 cert-show command does not display Subject Alternative
Names
- Resolves: #1357511 Traceback message seen when ipa is provided with invalid
configuration file name
- Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
converted from CA-less to CA-full
- Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
- Resolves: #1367572 improve error message in ipa migrate-ds: mention ipa
config-mod --enable-migration=TRUE
- Resolves: #1367868 Add options to retrieve lightweight CA certificate/chain
- Resolves: #1371927 Implement ca-enable/disable commands.
- Resolves: #1372202 Add Users into User Group editors fails to show Full names
- Resolves: #1373091 Adding an auth indicator from the CLI creates an extra
check box in the UI
- Resolves: #1375596 Ipa-server WebUI - long user/group name show wrong error
message
- Resolves: #1375905 "Normal" group type in the UI is confusing
- Resolves: #1376040 IPA client ipv6 - invalid --ip-address shows traceback
- Resolves: #1376630 IDM admin password gets written to
/root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
- Resolves: #1376729 ipa-server-install script option --no_hbac_allow should
match other options
- Resolves: #1378461 IPA Allows Password Reuse with History value defined when
admin resets the password.
- Resolves: #1379029 conncheck failing intermittently during single step
replica installs
- Resolves: #1379858 [RFE] better debugging for ipa-replica-conncheck
- Resolves: #1384310 ipa dnsrecord-add fails with Keyerror stack trace
- Resolves: #1392778 Update man page for ipa-adtrust-install by
removing --no-msdcs option
- Resolves: #1392858 Rebase to FreeIPA 4.5+
- Rebase to 4.5.0
- Resolves: #1399133 Delete option shouldn't be available for hosts applied to
view.
- Resolves: #1399190 [RFE] Certificates issued by externally signed IdM CA
should contain full trust chain
- Resolves: #1400416 RFE: Provide option to take backup of IPA server before
uninstalling IPA server
- Resolves: #1400529 cert-request is not aware of Kerberos principal aliases
- Resolves: #1401526 IPA WebUI certificates are grayed out on overview page but
not on details page
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- Resolves: #1404750 ipa-client-install fails to get CA cert via LDAP when
non-FQDN name of IPA server is first in /etc/hosts
- Resolves: #1409628 [RFE] Semi-automatic integration with external DNS using
nsupdate
- Resolves: #1413742 Backport request for bug/issue Change IP address
validation errors to warnings
- Resolves: #1415652 IPA replica install log shows password in plain text
- Resolves: #1427897 different behavior regarding system wide certs in master
and replica.
- Resolves: #1430314 The ipa-managed-entries command failed, exception:
AttributeError: ldap2
- Throw zonemgr error message before installation proceeds (#1163849)
- Winsync: Setup is broken due to incorrect import of certificate (#1169867)
- Enable last token deletion when password auth type is configured (#919228)
- ipa-otp-lasttoken loads all user's tokens on every mod/del (#1166641)
- add --hosts and --hostgroup options to allow/retrieve keytab methods
(#1007367)
- Extend host-show to add the view attribute in set of default attributes
(#1168916)
- Prefer TCP connections to UDP in krb5 clients (#919228)
- [WebUI] Not able to unprovisioning service in IPA 4.1 (#1168214)
- webui: increase notification duration (#1171089)
- RHEL7.1 ipa automatic CA cert renewal stuck in submitting state (#1166931)
- RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
(#1170003)
- Improve validation of --instance and --backend options in ipa-restore
(#951581)
- RHEL7.1 ipa replica unable to replicate to rhel6 master (#1167964)
- Disable TLS 1.2 in nss.conf until mod_nss supports it (#1156466)
- Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
error observed during ipa upgrade with latest package.
- ipa-server-install: fix uninstall
- Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
replica
- ca install: merge duplicated code for DM password
- installutils: add DM password validator
- ca, kra install: validate DM password
- Rebase to upstream release 4.8.2
- Removed upstream patches 0001 to 0010 that are part of version 4.8.2
- Updated branding patch
Resolves: RHBZ#1748987
- Update dependency for bind-dndb-ldap to 11.2-2
Related: RHBZ#1762813
- Upstream release FreeIPA 4.9.5
Related: RHBZ#1945038
- IPA to allow setting a new range type
Resolves: RHBZ#1688267
- ipa-server-install displays debug output when --debug output is not
specified.
Resolves: RHBZ#1943151
- ACME fails to generate a cert on migrated RHEL8.4 server
Resolves: RHBZ#1934991
- Switch ipa-client to use the JSON API
Resolves: RHBZ#1937856
- IDM - Allow specifying permanent logging settings for BIND
Resolves: RHBZ#1951511
- Cache LDAP data within a request
Resolves: RHBZ#1953656
- ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4
Resolves: RHBZ#1957768
- Rebuild for broken deps
- Fix 389-ds-base strict dep to be 1.3.0.5 and krb5-server 1.11.1
- Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
- Re-adding existing trust fails (#1033216)
- IPA uninstall exits with a samba error (#1033075)
- Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
- Fixed ownership of /usr/share/ipa/ui/js (#1026260)
- ipa-tests: support external names for hosts (#1032668)
- ipa-client-install fail due fail to obtain host TGT (#1029354)
- Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
by abusing password policy
- ipa-kdb: search for password policies globally
- Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream
- [ipa-python] ipalib.errors.LDAPError: failed to decode certificate:
(SEC_ERROR_INVALID_ARGS) security library: invalid arguments. (#1194312)
- Set krb5 DAL version to 7.0 (#1580711)
- Rebuild aclocal and configure during build
- hbactest does not work for external users (#848531)
- Resolves: #1443869 Command "openssl pkcs12 ..." failed during IPA upgrade
- Fix CAInstance.import_ra_cert for empty passwords
- New upstream release 4.8.0
- New subpackage: freeipa-client-samba
- Added command ipa-cert-fix with man page
- New sysconfdir sysconfig/certmonger
- Updated pki_version, certmonger_version, sssd_version and kdcproxy_version
Related: RHBZ#1684528
- Update to upstream 2.2.0 beta 1 (2.1.90.rc1)
- Set minimum n-v-r for pki-ca and pki-silent to 9.0.18.
- Add Conflicts on mod_ssl
- Update minimum n-v-r of 389-ds-base to 1.2.10.4
- Update minimum n-v-r of sssd to 1.8.0
- Update minimum n-v-r of slapi-nis to 0.38
- Update minimum n-v-r of pki-* to 9.0.18
- Update conflicts on bind-dyndb-ldap to < 1.1.0-0.9.b1
- Update conflicts on bind to < 9.9.0-1
- Drop requires on krb5-server-ldap
- Add patch to remove escaping arguments to pkisilent
- Re-add accidentally removed patches for #1170695 and #1164896
- Fix wrong path in packaging freeipa-systemd-upgrade
- Create systemd-user HBAC service and rule
Resolves: RHBZ#1664974
- ipaserver/dcerpc: fix exclusion entry with a forest trust domain info returned
Resolves: RHBZ#1664023
- trustdomain-find with pkey-only fails (#1068611)
- Invalid credential cache in trust-add (#1069182)
- ipa-replica-install prints unexpected error (#1069722)
- Too big font in input fields in details facet in Firefox (#1069720)
- trust-add for POSIX AD does not fetch trustdomains (#1070925)
- Misleading trust-add error message in some cases (#1070926)
- Access is not rejected for disabled domain (#1070924)
- Set minimum level of sssd to 1.1.1 to pull in required hbac fixes.
- Add OTP patches
- Add patch to set KRB5CCNAME for 389-ds-base
- Resolves: #1431520 ipa cert-find runs a large number of searches, so IPA
WebUI is slow to display user details page
- cert: defer cert-find result post-processing
- Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
helper when installing replica
- server-install: No double Kerberos install
- Resolves: #1437502 ipa-replica-install fails with requirement to
use --force-join that is a client install option.
- Add the force-join option to replica install
- replicainstall: better client install exception handling
- Resolves: #1437953 Server CA-less impossible option check
- server-install: remove broken no-pkinit check
- Resolves: #1441160 FreeIPA client <= 4.4 fail to parse 4.5 cookies
- Add debug log in case cookie retrieval went wrong
- Resolves: #1441548 ipa server install fails with --external-ca option
- ext. CA: correctly write the cert chain
- Resolves: #1441718 Conversion of CA-less server to CA fails on CA instance
spawn
- Fix CA-less to CA-full upgrade
- Resolves: #1442133 Do not link libkrad, liblber, libldap_r and
libsss_nss_idmap to every binary in IPA
- configure: fix AC_CHECK_LIB usage
- Resolves: #1442815 Replica install fails during migration from older IPA
master
- Fix RA cert import during DL0 replication
- Related: #1442004 Building IdM/FreeIPA internally on all architectures -
filtering unsupported packages
- Build all subpackages on all architectures
- Hardening for CVE-2020-25717
- Harden processing of trusted domains' users in S4U operations
- Resolves: RHBZ#2021443
- Updated to upstream 2.2.0 GA
- Update minimum n-v-r of certmonger to 0.53
- Update minimum n-v-r of slapi-nis to 0.40
- Add Requires in client to oddjob-mkhomedir and python-krbV
- Update minimum selinux-policy to 3.10.0-110
- 4.7.1
- Fixes: rhbz#1633105 - rebase to 4.7.1
- Fix otptoken_sync plugin
Resolves: RHBZ#1777811
- Fix automount behavior with authselect
Resolves: RHBZ#1740167
- Require mod_nss-1.0.7-2 for mod_proxy fixes
- Pull upstream changelog 678
- Add new subpackage, ipa-server-selinux
- Add Requires: authconfig to ipa-python (bz #433747)
- Package i18n files
- Fix breakage caused by python-kerberos update to 1.1
- Fix Requires for krb5-server that was missing for Fedora versions > 9
- Remove quotes around test for fedora version to package egg-info
- Load ipa_dogtag.pp in post install
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- user-undel: Fix error messages.
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Prohibit deletion of predefined profiles
- Resolves: #1232819 testing ipa-restore on fresh system install fails
- Backup/resore authentication control configuration
- Resolves: #1243331 pkispawn fails when migrating to 4.2 server from 3.0
server
- Require Dogtag PKI >= 10.2.6
- Resolves: #1245225 Asymmetric vault drops traceback when the key is not
proper
- Asymmetric vault: validate public key in client
- Resolves: #1248399 Missing DNSSEC related files in backup
- fix typo in BasePathNamespace member pointing to ods exporter config
- ipa-backup: archive DNSSEC zone file and kasp.db
- Resolves: #1248405 PassSync should be disabled after ipa-winsync-migrate is
finished
- winsync-migrate: Add warning about passsync
- winsync-migrate: Expand the man page
- Resolves: #1248524 User can't find any hosts using "ipa host-find $HOSTNAME"
- adjust search so that it works for non-admin users
- Resolves: #1250093 ipa certprofile-import accepts invalid config
- Require Dogtag PKI >= 10.2.6
- Resolves: #1250107 IPA framework should not allow modifying trust on AD trust
agents
- trusts: Detect missing Samba instance
- Resolves: #1250111 User lifecycle - preserved users can be assigned
membership
- ULC: Prevent preserved users from being assigned membership
- Resolves: #1250145 Add permission for user to bypass caacl enforcement
- Add permission for bypassing CA ACL enforcement
- Resolves: #1250190 idrange is not added for sub domain
- idranges: raise an error when local IPA ID range is being modified
- trusts: harden trust-fetch-domains oddjobd-based script
- Resolves: #1250928 Man page for ipa-server-install is out of sync
- install: Fix server and replica install options
- Resolves: #1251225 IPA default CAACL does not allow cert-request for services
after upgrade
- Fix default CA ACL added during upgrade
- Resolves: #1251561 ipa vault-add Unknown option: ipavaultpublickey
- validate mutually exclusive options in vault-add
- Resolves: #1251579 ipa vault-add --user should set container owner equal to
user on first run
- Fixed vault container ownership.
- Resolves: #1252517 cert-request rejects request with correct
krb5PrincipalName SAN
- Fix KRB5PrincipalName / UPN SAN comparison
- Resolves: #1252555 ipa vault-find doesn't work for services
- vault: Add container information to vault command results
- Add flag to list all service and user vaults
- Resolves: #1252556 Missing CLI param and ACL for vault service operations
- Added CLI param and ACL for vault service operations.
- Resolves: #1252557 certprofile: improve profile format documentation
- certprofile-import: improve profile format documentation
- certprofile: add profile format explanation
- Resolves: #1253443 ipa vault-add creates vault with invalid type
- vault: validate vault type
- Resolves: #1253480 ipa vault-add-owner does not fail when adding an existing
owner
- baseldap: Allow overriding member param label in LDAPModMember
- vault: Fix param labels in output of vault owner commands
- Resolves: #1253511 ipa vault-find does not use criteria
- vault: Fix vault-find with criteria
- Resolves: #1254038 ipa-replica-install pk12util error returns exit status 10
- install: Fix replica install with custom certificates
- Resolves: #1254262 ipa-dnskeysync-replica crash cannot contact kdc
- improve the handling of krb5-related errors in dnssec daemons
- Resolves: #1254412 when dirsrv is off ,upgrade from 7.1 to 7.2 fails with
starting CA and named-pkcs11.service
- Server Upgrade: Start DS before CA is started.
- Resolves: #1254637 Add ACI and permission for managing user userCertificate
attribute
- add permission: System: Manage User Certificates
- Resolves: #1254641 Remove CSR allowed-extensions restriction
- cert-request: remove allowed extensions check
- Resolves: #1254693 vault --service does not normalize service principal
- vault: normalize service principal in service vault operations
- Resolves: #1254785 ipa-client-install does not properly handle dual stacked
hosts
- client: Add support for multiple IP addresses during installation.
- Add dependency to SSSD 1.13.1
- client: Add description of --ip-address and --all-ip-addresses to man page
- Remove dependency on python-paramiko (#1002884)
- Broken redirection when deleting last entry of DNS resource
record (#1006360)
- "an internal error has occurred" during ipa host-del --updatedns (#1198431)
- Renamed patch 1013 to 0114, as it was merged upstream
- Fax number not displayed for user-show when kinit'ed as normal user.
(#1198430)
- Replication agreement with replica not disabled when ipa-restore done without
IPA installed (#1199060)
- Limit deadlocks between DS plugin DNA and slapi-nis (#1199128)
- Build radius separately
- Fix a few minor issues
- Broke invididual Requires and BuildRequires onto separate lines and
reordered them
- Added python-tgexpandingformwidget as a dependency
- Require at least fedora-ds-base 1.1
- Server install failure during client enrollment shouldn't
roll back (#1023086)
- nsds5ReplicaStripAttrs are not set on agreements (#1023085)
- ipa-server conflicts with mod_ssl (#1018172)
- Update to upstream 3.3.2 (#991064)
- Add delegation info to MS-PAC (#915799)
- Warn about incompatibility with AD when IPA realm and domain
differs (#1009044)
- Allow PKCS#12 files with empty password in install tools (#1002639)
- Privilege "SELinux User Map Administrators" did not list
permissions (#997085)
- SSH key upload broken when client joins an older server (#1009024)
- Set minimum pki-ca and pki-silent versions to 9.0.0
- Set krbCanonicalName admin@REALM on the admin user
Resolves: RHEL-89895
- Rebuild against samba4 beta4
- Resolves: #1361119 UPN-based search for AD users does not match an entry in
slapi-nis map cache
- support multiple uid values in schema compatibility tree
- Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
version to 1.0.7-4 so we pick up the NSS fixes.
- Add selinux-policy-base(post) to Requires (446496)
- Resolves: #1296140 Remove redhat-access-plugin-ipa support
- Obsolete and conflict redhat-access-plugin-ipa
- Resolves: #1351119 Multiple issues while uninstalling ipa-server
- server uninstall fails to remove krb principals
- Resolves: #1351758 ipa commands not showing expected error messages
- frontend: copy command arguments to output params on client
- Show full error message for selinuxusermap-add-hostgroup
- Resolves: #1352883 Traceback on adding default automember group and hostgroup
set
- allow 'value' output param in commands without primary key
- Resolves: #1353888 Fix the help for ipa otp and other topics
- schema: Fix subtopic -> topic mapping
- Resolves: #1354348 ipa trustconfig-show throws internal error.
- allow 'value' output param in commands without primary key
- Resolves: #1354381 ipa trust-add with raw option gives internal error.
- trust-add: handle `--all/--raw` options properly
- Resolves: #1354493 Replica install fails with old IPA master
- DNS install: Ensure that DNS servers container exists
- Resolves: #1354628 ipa hostgroup-add-member does not return error message
when adding itself as member
- frontend: copy command arguments to output params on client
- Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
- messages: specify message type for ResultFormattingError
- Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
secret key
- expose `--secret` option in radiusproxy-* commands
- prevent search for RADIUS proxy servers by secret
- Resolves: #1356099 Bug in the ipapwd plugin
- Heap corruption in ipapwd plugin
- Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
client changes
- Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
- Resolves: #1356964 Renaming a user removes all of his principal aliases
- Preserve user principal aliases during rename operation
- Require slapi-nis 0.47.7 delivering a core feature of 3.3.0 release
- ipa man page format the EXAMPLES section
Resolves: RHBZ#2129895
- Fix canonicalization issue in Web UI
Resolves: RHBZ#2127035
- Remove idnssoaserial argument from dns zone API.
Resolves: RHBZ#2108630
- Warn for permissions with read/write/search/compare and no attrs
Resolves: RHBZ#2098187
- Add PKINIT support to ipa-client-install
Resolves: RHBZ#2075452
- Generate CNAMEs for TXT+URI location krb records
Resolves: RHBZ#2104185
- Vault: fix interoperability issues with older RHEL systems
Resolves: RHBZ#2144737
- Fix typo on ipaupgrade.log chmod during RPM %post snipppet
Resolves: RHBZ#2140994
- Set minimum of python-pyasn1 to 0.0.9a so we have support for the ASN.1
Any type
- Remove ipa-server dependency from ipa-selinux subpackage
- Related: RHBZ#1891832
- clean up spec
- Depend on sssd >= 1.6.2 for better user experience
- webui: Do not allow empty pagination size
Resolves: RHBZ#2094672
- [WebUI] IPA Error 3007: RequirmentError" while adding members in
"User ID overrides" tab
Resolves: RHBZ#1757045
- EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in
freeipa-client-epn
Resolves: RHBZ#1847999
- FreeIPA - Utilize 256-bit AJP connector passwords
Resolves: RHBZ#1849914
- ipa: typo issue in ipanthomedirectoryrive deffinition
Resolves: RHBZ#1851411
- FreeIPA 4.8.0 tarball lacks two update files that are in git
Resolves: RHBZ#1741170
- Proxy PKI URI /ca/ee/ca/profileSubmit to enable replication with future
PKI versions (#1080865)
- kdb: apply combinatorial logic for ticket flags (CVE-2024-3183)
Resolves: RHEL-29927
- kdb: fix vulnerability in GCD rules handling (CVE-2024-2698)
Resolves: RHEL-29692
- Drop workaround for building on AArch64 (#1482244)
- Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)
- schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
build fails (#1167196)
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
- "ipa trust-add ... " cmd says : (Trust status: Established and verified)
while in the logs we see "WERR_ACCESS_DENIED" during verification step.
(#1144121)
- POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
(#1156466)
- Add support/hooks for a one-time password system like SecureID in IPA
(#919228)
- Tracebacks with latest build for --zonemgr cli option (#1167270)
- ID Views: Support migration from the sync solution to the trust solution
(#891984)
- Remove posixAccount from service_find search filter
Resolves: RHBZ#1731437
- Fix repeated uninstallation of ipa-client-samba crashes
Resolves: RHBZ#1732529
- WebUI: Add PKINIT status field to 'Configuration' page
Resolves: RHBZ#1518153
- Resolve user/group names in idoverride*-find
Resolves: RHBZ#1657745
- Configure CA replication to use TLS instead of SSL
- New command automember-find-orphans to find and remove orphan automemeber
rules has been added
Resolves: RHBZ#1638373
- Moved ipa/idm logos and background to redhat-logos-ipa-80.4:
header-logo.png, login-screen-background.jpg, login-screen-logo.png,
product-name.png
New requirement to redhat-logos-ipa >= 80.4 in ipa-server-common
Resolves: RHBZ#1626507
- Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
users in IdM
- store certificates issued for user entries as
- user-show: add --out option to save certificates to file
- Resolves: #1145748 [RFE] IPA running with One Way Trust
- Fix upgrade of sidgen and extdom plugins
- Resolves: #1195339 ipa-client-install changes the label on various files
which causes SELinux denials
- Use 'mv -Z' in specfile to restore SELinux context
- Resolves: #1198796 Text in UI should describe differing LDAP vs Krb behavior
for combinations of "User authentication types"
- webui: add LDAP vs Kerberos behavior description to user auth
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- ULC: Fix stageused-add --from-delete command
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- certprofile-import: do not require profileId in profile data
- Give more info on virtual command access denial
- Allow SAN extension for cert-request self-service
- Add profile for DNP3 / IEC 62351-8 certificates
- Work around python-nss bug on unrecognised OIDs
- Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
- Validate vault's file parameters
- Fixed missing KRA agent cert on replica.
- Resolves: #1225866 display browser config options that apply to the browser.
- webui: add Kerberos configuration instructions for Chrome
- Remove ico files from Makefile
- Resolves: #1246342 Unapply idview raises internal error
- idviews: Check for the Default Trust View only if applying the view
- Resolves: #1248102 [webui] regression - incorrect/no failed auth messages
- webui: fix regressions failed auth messages
- Resolves: #1248396 Internal error in DomainValidator.__search_in_dc
- dcerpc: Fix UnboundLocalError for ccache_name
- Resolves: #1249455 ipa trust-add failed CIFS server configuration does not
allow access to \\pipe\lsarpc
- Fix selector of protocol for LSA RPC binding string
- dcerpc: Simplify generation of LSA-RPC binding strings
- Resolves: #1250192 Error in ipa trust-fecth-domains
- Fix incorrect type comparison in trust-fetch-domains
- Resolves: #1251553 Winsync setup fails with unexpected error
- replication: Fix incorrect exception invocation
- Resolves: #1251854 ipa aci plugin is not parsing aci's correctly.
- ACI plugin: correctly parse bind rules enclosed in
- Resolves: #1252414 Trust agent install does not detect available replicas to
add to master
- adtrust-install: Correctly determine 4.2 FreeIPA servers
- Introduce upgrade script to recover existing configuration after systemd migration
as user has no means to recover FreeIPA from systemd migration
- Upgrade script:
- recovers symlinks in Dogtag instance install
- recovers systemd configuration for FreeIPA's directory server instances
- recovers freeipa.service
- migrates directory server and KDC configs to use proper keytabs for systemd services
- Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
- Remove references to admin server in ipa-server-setupssl
- Generate a client certificate for the XML-RPC server to connect to LDAP with
- Create a keytab for Apache
- Create an ldif with a test user
- Provide a certmap.conf for doing SSL client authentication
- Update to 4.7.90-pre1
Related: RHBZ#1684528
- Removed patches 0002 to 0031 as these are upsteram and part of 4.7.90-pre1
- Added new patches 0001-revert-minssf-defaults.patch and
0001-Correct-default-fontawesome-path-broken-by-da2cf1c5.patch
- Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
- Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
- Resolves: #1341249 Subsequent external CA installation fails
- install: fix external CA cert validation
- Resolves: #1353831 ipa-server-install fails in container because of
hostnamectl set-hostname
- server-install: Fix --hostname option to always override api.env values
- install: Call hostnamectl set-hostname only if --hostname option is used
- Resolves: #1356091 ipa-cacert-manage --help and man differ
- Improvements for the ipa-cacert-manage man and help
- Resolves: #1360631 ipa-backup is not keeping the
/etc/tmpfiles.d/dirsrv-.conf
- ipa-backup: backup /etc/tmpfiles.d/dirsrv-.conf
- Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
file is needed
- Update ipa-replica-install documentation
- Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
not rpm-require it
- client: RPM require initscripts to get *-domainname.service
- Resolves: #1364197 caacl: error when instantiating rules with service
principals
- caacl: fix regression in rule instantiation
- Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
- parameters: move the `confirm` kwarg to Param
- Resolves: #1364464 Topology graph: ca and domain adders shows question marks
instead of plus icon
- Fix unicode characters in ca and domain adders
- Resolves: #1365083 Incomplete output returned for command ipa vault-add
- client: add missing output params to client-side commands
- Resolves: #1365526 build fails during "make check"
- ipa-kdb: Fix unit test after packaging changes in krb5
- Rebase to security release 4.8.3 (CVE-2019-14867, CVE-2019-10195)
Resolves: RHBZ#1767304
Resolves: RHBZ#1776939
- Support KDC ticket policies for authentication indicators
Resolves: RHBZ#1777564
- Fix misleading errors during client install rollback
Resolves: RHBZ#1658283
- ipa-advise: update url of cacerdir_rehash tool
Resolves: RHBZ#1658287
- Handle NTP configuration in a replica server installation
Resolves: RHBZ#1651679
- Fix defects found by static analysis
Resolves: RHBZ#1658182
- ipa-replica-install --setup-adtrust: check for package ipa-server-trust-ad
Resolves: RHBZ#1658294
- ipaldap: invalid modlist when attribute encoding can vary
Resolves: RHBZ#1658302
- Allow ipaapi and Apache user to access SSSD IFP
Resolves: RHBZ#1639910
- Add sysadm_r to default SELinux user map order
Resolves: RHBZ#1658303
- certdb: ensure non-empty Subject Key Identifier and validate server cert sig
Resolves: RHBZ#1641988
- ipa-replica-install: password and admin-password options mutually exclusive
Resolves: RHBZ#1658309
- ipa upgrade: handle double-encoded certificates
Resolves: RHBZ#1658310
- PKINIT: fix ipa-pkinit-manage enable|disable
Resolves: RHBZ#1658313
- Enable LDAP debug output in client to display TLS errors in join
Resolves: RHBZ#1658316
- rpc: always read response
Resolves: RHBZ#1639890
- ipa vault-retrieve: fix internal error
Resolves: RHBZ#1658485
- Move ipa's systemd tmpfiles from /var/run to /run
Resolves: RHBZ#1658487
- Fix authselect invocations to work with 1.0.2
Resolves: RHBZ#1654291
- ipa-client-automount and NFS unit name changes
Resolves: RHBZ#1645501
- Fix compile issue with new 389-ds
Resolves: RHBZ#1659448
- ipatests: fix test_topology
Resolves: RHBZ#2232351
- Installer: activate nss and pam services in sssd.conf
Resolves: RHBZ#2216532
- Update to upstream 4.1.0 (#1109726)
- Re-enable otptoken_yubikey plugin
- Convert to autotools-based build
- Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
because of missing dependencies
- Rebuild with krb5-1.14.1
- Update to upstream 3.3.0 (#991064)
- Set 0.14 as minimum version for slapi-nis
- ipa-client-automount fails with incompatibility error when installed against
older IPA server (#1083108)
- Server installation fails using external signed certificates with
"IndexError: list index out of range" (#1111320)
- Add rhino to BuildRequires to fix Web UI build error
- Abstracted client class to work directly or over RPC
- Fix S4U2Self regression for cross-realm requester SID buffer
- Related: RHBZ#2021443
- Add dep for freeipa-admintools and acl
- Add Requires: python-nss to ipa-python sub-package
- Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
- python2-ipalib: add missing python dependency
- installer service: fix typo in service entry
- upgrade: add missing suffix to http instance
- Resolves: #1444791 Update man page of ipa-kra-install
- ipa-kra-install manpage: document domain-level 1
- Resolves: #1441493 ipa cert-show raises stack traces when
--certificate-out=/tmp
- cert-show: writable files does not mean dirs
- Resolves: #1441192 Add the name of URL parameter which will be check for
username during cert login
- Bump version of ipa.conf file
- Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
- Turn on NSSOCSP check in mod_nss conf
- Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
template on
- renew agent: respect CA renewal master setting
- server upgrade: always fix certmonger tracking request
- cainstance: use correct profile for lightweight CA certificates
- renew agent: allow reusing existing certs
- renew agent: always export CSR on IPA CA certificate renewal
- renew agent: get rid of virtual profiles
- ipa-cacert-manage: add --external-ca-type
- Resolves: #1441593 error adding authenticator indicators to host
- Fixing adding authenticator indicators to host
- Resolves: #1449525 Set directory ownership in spec file
- Added plugins directory to ipaclient subpackages
- ipaclient: fix missing RPM ownership
- Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
- otptoken-add-yubikey: When --digits not provided use default value
- Upstream release FreeIPA 4.9.2
Related: RHBZ#1891832
- Rebuild for broken deps in rawhide
- Fix 389-ds-base strict dep to be 1.3.0.3
- Move ipa-tests package to separate srpm (#1032668)
- Don't always override the port in import_included_profiles
Fixes: RHBZ#2022483
- Remove ipa-join errors from behind the debug option
Fixes: RHBZ#2048558
- Enable the ccache sweep timer during installation
Fixes: RHBZ#2051575
- ipa-replica-install never checks for 7389 port (#1075165)
- Non-terminated string may be passed to LDAP search (#1075091)
- ipa-sam may fail to translate group SID into GID (#1073829)
- Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
- Update to upstream version 1.0.0
- rpcserver: validate Kerberos principal name before running kinit
Resolves: RHEL-26153
- Vault: add additional fallback to RSA-OAEP wrapping algo
Resolves: RHEL-28259
- Set min version of 389-ds-base to 1.2.8
- Set min version of mod_nss 1.0.8-10
- Set min version of selinux-policy to 3.9.7-27
- Add dogtag themes to Requires
- Update to upstream freeipa-2.0.0.pre2
- Resolves: #1339483 ipa-server-install fails with ERROR pkinit_cert_files
- Fix incorrect rebase of patch 1001
- Fixed weekday in 4.8.4-2 changelog date
Related: RHBZ#1784003
- adtrust: print DNS records for external DNS case after role is enabled
Resolves: RHBZ#1665051
- AD user without override receive InternalServerError with API
Resolves: RHBZ#1782572
- ipa-client-automount fails after repeated installation/uninstallation
Resolves: RHBZ#1790886
- install/updates: move external members past schema compat update
Resolves: RHBZ#1803165
- kdb: make sure audit_as_req callback signature change is preserved
Resolves: RHBZ#1803786
- Resolves: #1449189 ipa-kra-install timeouts on replica
- kra: promote: Get ticket before calling custodia
- Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
- Fix ipa-server-install in pure IPv6 environment
- Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
reachable via the forest root
- trust: make sure ID range is created for the child domain even if it exists
- ipa-kdb: simplify trusted domain parent search
- Resolves: #1335567 Update Warning in IdM Web UI API browser
- WebUI: add API browser is tech preview warning
- Resolves: #1348560 Mulitple domain Active Directory Trust conflict
- ipaserver/dcerpc: reformat to make the code closer to pep8
- trust: automatically resolve DNS trust conflicts for triangle trusts
- Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
certificate revocation
- cert-revoke: fix permission check bypass (CVE-2016-5404)
- Resolves: #1353936 custodia.conf and server.keys file is world-readable.
- Remove Custodia server keys from LDAP
- Secure permissions of Custodia server.keys
- Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
converted from CA-less to CA-full
- custodia: include known CA certs in the PKCS#12 file for Dogtag
- custodia: force reconnect before retrieving CA certs from LDAP
- Resolves: #1362333 ipa vault container owner cannot add vault
- Fix: container owner should be able to add vault
- Resolves: #1365546 External trust with root domain is transitive
- trust: make sure external trust topology is correctly rendered
- Resolves: #1365572 IPA server broken after upgrade
- Require pki-core-10.3.3-7
- Resolves: #1367864 Server assumes latest version of command instead of
version 1 for old / 3rd party clients
- rpcserver: assume version 1 for unversioned command calls
- rpcserver: fix crash in XML-RPC system commands
- Resolves: #1367773 thin client ignores locale change
- schema cache: Fallback to 'en_us' when locale is not available
- Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
- Fail on topology disconnect/last role removal
- Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
- otptoken, permission: Convert custom type parameters on server
- Resolves: #1369414 ipa server-del fails with Python stack trace
- Handled empty hostname in server-del command
- Resolves: #1369761 ipa-server must depend on a version of httpd that support
mod_proxy with UDS
- Require httpd 2.4.6-31 with mod_proxy Unix socket support
- Resolves: #1370512 Received ACIError instead of DuplicatedError in
stageuser_tests
- Raise DuplicatedEnrty error when user exists in delete_container
- Resolves: #1371479 cert-find --all does not show information about revocation
- cert: add missing param values to cert-find output
- Renamed patch 1011 to 0100, as it was merged upstream
- Add BuildRequires for authconfig
- Add explicit dependency for libvert-libev
Resolves: RHBZ#2104929
- ipatests: Backport test fixes in python3-ipatests.
Resolves: RHBZ#2057505
- Rely on sssd-krb5 to include SSSD-generated krb5 configuration
Resolves: RHBZ#2214563
- Refactor ipatests for unique krbcanonicalname
Resolves: RHEL-110061
- Move ipalib to ipa-python subpackage
- Bump minimum version of slapi-nis to 0.15
- Remove client-epn left over files for ONLY_CLIENT
Related: RHBZ#1847999
- Resolves: #1252556 Missing CLI param and ACL for vault service operations
- vault: fix private service vault creation
- Update to upstream 2.1.4 (CVE-2011-3636)
- Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
by abusing password policy
- password policy: Add explicit default password policy for hosts and
services
- Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
certprofile-mod
- certprofile-mod: correctly authorise config update
- Update to upstream 4.1.0 Alpha 1 (#1109726)
- PKI service restart after CA renewal failed (#1040018)
- Preverse mode on ipa-keytab-util
- Version bump for relase and rpm name change
- Resolves: #1318186 Misleading error message during external-ca IPA master
install
- httpinstance: make sure NSS database is backed up
- Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
CA certificate chain in ... incomplete"
- httpinstance: make sure NSS database is backed up
- Resolves: #1393726 Enumerate all available request type options in ipa
cert-request help
- Hide request_type doc string in cert-request help
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- spec file: bump libsss_nss_idmap-devel BuildRequires
- server: make sure we test for sss_nss_getlistbycert
- Resolves: #1437378 ipa-adtrust-install produced an error and failed on
starting smb when hostname is not FQDN
- adtrust: make sure that runtime hostname result is consistent with the
configuration
- Resolves: #1437555 ipa-replica-install with DL0 fails to get annonymous
keytab
- Always check and create anonymous principal during KDC install
- Remove duplicate functionality in upgrade
- Resolves: #1437946 Upgrade to FreeIPA 4.5.0 does not configure anonymous
principal for PKINIT
- Upgrade: configure PKINIT after adding anonymous principal
- Remove unused variable from failed anonymous PKINIT handling
- Split out anonymous PKINIT test to a separate method
- Ensure KDC is propery configured after upgrade
- Resolves: #1437951 Remove pkinit-related options from server/replica-install
on DL0
- Fix the order of cert-files check
- Don't allow setting pkinit-related options on DL0
- replica-prepare man: remove pkinit option refs
- Remove redundant option check for cert files
- Resolves: #1438490 CA-less installation fails on publishing CA certificate
- Get correct CA cert nickname in CA-less
- Remove publish_ca_cert() method from NSSDatabase
- Resolves: #1438838 Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
- IPA-KDB: use relative path in ipa-certmap config snippet
- Resolves: #1439038 Allow erasing ipaDomainResolutionOrder attribute
- Allow erasing ipaDomainResolutionOrder attribute
- Upstream release FreeIPA 4.8.6
- New SELinux sub package to provide own module
- Depend on selinux-policy-devel 3.14.3-43 for build due to a makefile issue in
SELinux external policy support
Related: RHBZ#1818765
- CAless installation: set the perms on KDC cert file
Resolves: RHBZ#1863616
- EPN: handle empty attributes
Resolves: RHBZ#1866938
- IPA-EPN: enhance input validation
Resolves: RHBZ#1866291
- EPN: enhance input validation
Resolves: RHBZ#1863079
- Require new samba build 4.12.3-52
Related: RHBZ#1868558
- Require new selinux-policy build 3.14.3-52
Related: RHBZ#1869311
- Resolves: #1398670 Check IdM Topology for broken record caused by replication
conflict before upgrading it
- Check for conflict entries before raising domain level
- package the sessions dir /var/cache/ipa/sessions
- Pull upstream changelog 597
- Add call to /usr/sbin/upgradeconfig to post install
- Resolves: #1262996 ipa vault internal error on replica without KRA
- upgrade: make sure ldap2 is connected in export_kra_agent_pem
- Resolves: #1270608 IPA upgrade fails for server with CA cert signed by
external CA
- schema: do not derive ipaVaultPublicKey from ipaPublicKey
- dcerpc: invalidate forest trust intfo cache when filtering out realm domains
Resolves: RHEL-28559
- Backport latests test fixes in python3-tests
ipatests: add xfail for autoprivate group test with override
ipatests: remove xfail thanks to sssd 2.9.4
ipatests: adapt for new automembership fixup behavior
ipatests: Fixes for test_ipahealthcheck_ipansschainvalidation testcases
test_xmlrpc: adopt to automember plugin message changes in 389-ds
Resolves: RHEL-29908
- Config plugin: return EmptyModlist when no change is applied.
Resolves: RHBZ#2031825
- Custodia: use a stronger encryption algo when exporting keys.
Resolves: RHBZ#2032806
- ipa-kdb: do not remove keys for hardened auth-enabled users.
Resolves: RHBZ#2033342
- ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus
Resolves: RHBZ#2049167
- Backport latest test fxes in python3 ipatests.
Resolves: RHBZ#2048509
- Removed unused patch files that were part of 4.9.8 rebase.
- Upstream final release FreeIPA 4.9.0
Related: RHBZ#1891832
- Add end to end integration tests for external IdP
Resolves: RHBZ#2106346
- Upstream release FreeIPA 4.9.8
Related: RHBZ#2015607
- Hardening for CVE-2020-25717
- Resolves: #1419735 ipa-replica-install fails promotecustodia.create_replica
with cert errors (untrusted)
- added ssl verification using IPA trust anchor
- Resolves: #1428472 batch param compatibility is incorrect
- compat: fix `Any` params in `batch` and `dnsrecord`
- Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream
- rebuild with new openssl
- Rebase ipa to 4.9.13
Resolves: RHEL-16936
- Remove the IPA DNA plugin, use the DS one
- Drop requires on python-configobj (not used any more)
- Drop ipa-ldap-updater message, upgrades are done differently now
- Update minimum selinux-policy to 3.9.16-18
- Update minimum pki-ca and pki-selinux to 9.0.7
- Update minimum 389-ds-base to 1.2.8.0-1
- Update to upstream 2.0.1
- Remove radius subpackages
- Pull upstream changelog 641
- Require minimum version of krb5-server on F-7 and F-8
- Package some new files
- Add ipa init script
- Update to upstream 4.0.3 (#1109726)
- Update Requires on selinux-policy to 3.13.1-4
- Add missing part of backported CVE-2024-3183 fix
Resolves: RHEL-29927
- Drop BuildRequires on mozldap-devel
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
- Updated upstream pull (596) to fix bug in ipa_webgui that was causing the
UI to not start.
- Remove duplicate %files entries on share/ipa/static
- Add python default encoding shared library
- Winsync agreement cannot be created (#1023085)
- Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
aliases)
- harden the check for trust namespace overlap in new principals
- Resolves: #1351142 CLI is not using session cookies for communication with
IPA API
- Fix session cookies
- Resolves: #1353888 Fix the help for ipa otp and other topics
- help: Add dnsserver commands to help topic 'dns'
- Resolves: #1354406 host-del updatedns options complains about missing ptr
record for host
- Host-del: fix behavior of --updatedns and PTR records
- Resolves: #1355718 ipa-replica-manage man page example output differs actual
command output
- Minor fix in ipa-replica-manage MAN page
- Resolves: #1358229 Traceback message should be fixed, seen while editing
winsync migrated user information in Default trust view.
- baseldap: Fix MidairCollision instantiation during entry modification
- Resolves: #1358849 CA replica install logs to wrong log file
- unite log file name of ipa-ca-install
- Resolves: #1359130 ipa-server-install command fails to install IPA server.
- DNS Locations: fix update-system-records unpacking error
- Resolves: #1359237 AVC on dirsrv config caused by IPA installer
- Use copy when replacing files to keep SELinux context
- Resolves: #1359692 ipa-client-install join fail with traceback against
RHEL-6.8 ipa-server
- compat: fix ping call
- Resolves: #1359738 ipa-replica-install --domain= option
does not work
- replica-install: Fix --domain
- Resolves: #1360778 Vault commands are available in CLI even when the server
does not support them
- Revert "Enable vault-* commands on client"
- client: fix hiding of commands which lack server support
- Related: #1281704 Rebase to softhsm 2.1.0
- Remove the workaround for softhsm bug #1293340
- Related: #1298288 [RFE] Improve performance in large environments.
- Create indexes for krbCanonicalName attribute
- Use OpenJDK 8 to bootstrap on AArch64 until RH1482244 is resolved in
buildroot
- Resolves: #1470177 - Rebase IPA to latest 4.5.x version
- Resolves: #1398594 ipa topologysuffix-verify should only warn about
maximum number of replication agreements.
- Resolves: #1404236 Web UI: Change "Host Based" and "Role Based"
to "Host-Based" and "Role-Based"
- Resolves: #1409786 Second phase of --external-ca ipa-server-install
setup fails when dirsrv is not running
- Resolves: #1451576 ipa cert-request failed to generate certificate from csr
- Resolves: #1452086 Pagination Size under Customization in IPA WebUI
accepts negative values
- Resolves: #1458169 --force-join option is not mentioned in
ipa-replica-install man page
- Resolves: #1463186 IPA shouldn't allow objectclass if not all in lower case
- Resolves: #1478322 user-show command fails when sizelimit is configured
to number <= number of entity which is user member of
- Resolves: #1496775 Enterprise principals should be able to trigger
a refresh of the trusted domain data in the KDC
- Resolves: #1502533 Changing cert-find to go through the proxy
instead of using the port 8080
- Resolves: #1502663 pkinit-status command fails after an upgrade from
a pre-4.5 IPA
- Resolves: #1498168 Error when trying to modify a PTR record
- Resolves: #1457876 ipa-backup fails silently
- Resolves: #1493531 In case full PKINIT configuration is failing during
server/replica install the error message should be more meaningful.
- Resolves: #1449985 Suggest CA installation command in KRA installation
warning
- Display server name in ipa command's verbose mode (#1061703)
- Remove sourcehostcategory from default HBAC rule (#1061187)
- dnszone-add cannot add classless PTR zones (#1058688)
- Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)
- Add ipa-rmkeytab tool
- ipaclient-install: chmod needs octal permissions (#1609880)
- Added Require mod_wsgi, added share/ipa/wsgi.py
- Improve otptoken help messages (#919228)
- Ensure users exist when assigning tokens to them (#919228)
- Enable QR code display by default in otptoken-add (#919228)
- Show warning instead of error if CA did not start (#1158410)
- CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
- Traceback when adding zone with long name (#1164859)
- Backup & Restore mechanism (#951581)
- ignoring user attributes in migrate-ds does not work if uppercase characters
are returned by ldap (#1159816)
- Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
- Failure when installing on dual stacked system with external ca (#1128380)
- ipa-server should keep backup of CS.cfg (#1059135)
- Tracebacks with latest build for --zonemgr cli option (#1167270)
- webui: use domain name instead of domain SID in idrange adder dialog
(#891984)
- webui: normalize idview tab labels (#891984)
- Unable to add trust successfully with --trust-secret (#1075704)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Resolves: #1258965 ipa vault: set owner of vault container
- baseldap: make subtree deletion optional in LDAPDelete
- vault: add vault container commands
- vault: set owner to current user on container creation
- vault: update access control
- vault: add permissions and administrator privilege
- install: support KRA update
- Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
- config: allow user/host attributes with tagging options
- Resolves: #1262315 Unable to establish winsync replication
- winsync: Add inetUser objectclass to the passsync sysaccount
- Update SELinux policy to allow ipa_kpasswd to connect ldap and
read /dev/urandom. (#759679)
- Adopt to samba4 beta6 (libsecurity -> libsamba-security)
- Add dependency to samba4-winbind
- Resolves: #1298288 [RFE] Improve performance in large environments.
- cert: speed up cert-find
- Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
authentication
- service: add flag to allow S4U2Self
- Add 'trusted to auth as user' checkbox
- Added new authentication method
- Resolves: #1353881 ipa-replica-install suggests about
non-existent --force-ntpd option
- Don't show --force-ntpd option in replica install
- Resolves: #1354441 DNS forwarder check is too strict: unable to add
sub-domain to already-broken domain
- DNS: allow to add forward zone to already broken sub-domain
- Resolves: #1356146 performance regression in CLI help
- schema: Speed up schema cache
- frontend: Change doc, summary, topic and NO_CLI to class properties
- schema: Introduce schema cache format
- schema: Generate bits for help load them on request
- help: Do not create instances to get information about commands and topics
- schema cache: Do not reset ServerInfo dirty flag
- schema cache: Do not read fingerprint and format from cache
- Access data for help separately
- frontent: Add summary class property to CommandOverride
- schema cache: Read server info only once
- schema cache: Store API schema cache in memory
- client: Do not create instance just to check isinstance
- schema cache: Read schema instead of rewriting it when SchemaUpToDate
- Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
- server install: do not prompt for cert file PIN repeatedly
- Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
cache directory: [Errno 13] Permission denied: '/home/test_user'
- schema: Speed up schema cache
- Resolves: #1366604 `cert-find` crashes on invalid certificate data
- cert: do not crash on invalid data in cert-find
- Resolves: #1366612 Middle replica uninstallation in line topology works
without '--ignore-topology-disconnect'
- Fail on topology disconnect/last role removal
- Resolves: #1366626 caacl-add-service: incorrect error message when service
does not exists
- Fix ipa-caalc-add-service error message
- Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
does not happen to run during dnf upgrade
- DNS server upgrade: do not fail when DNS server did not respond
- Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
with CA
- Add warning about only one existing CA server
- Set servers list as default facet in topology facet group
- Resolves: #1367773 thin client ignores locale change
- schema check: Check current client language against cached one
- Resolves: #1434032 Run ipa-custodia with custom SELinux context
- Require correct custodia version
- Fix: DNS installer adds invalid zonemgr email (#1056202)
- ipaplatform: Use the dirsrv service, not target (#951581)
- Fix: DNS policy upgrade raises asertion error (#1161128)
- Fix upgrade referint plugin (#1161128)
- Upgrade: fix trusts objectclass violationi (#1161128)
- group-add doesn't accept gid parameter (#1149124)
- Remove redundat Requires versions that are already in Fedora 17
- Replace python-crypto Requires with m2crypto
- Add missing Requires(post) for client and server-trust-ad subpackages
- Restart httpd service when server-trust-ad subpackage is installed
- Bump selinux-policy Requires to pick up PKI/LDAP port labeling fixes
- Fix SELinux code
- Resolves: #1378353 Replica install fails with old IPA master sometimes during
replication process
- spec file: bump minimal required version of 389-ds-base
- Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
- Fix missing file that fails DL1 replica installation
- Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
- WebUI: services without canonical name are shown correctly
- Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
- trustdomain-del: fix the way how subdomain is searched
- kdb: PAC generator: do not fail if canonical principal is missing
Resolves: RHEL-23630
- ipa-kdb: Fix memory leak during PAC verification
Resolves: RHEL-22644
- Fix session cookie access
Resolves: RHEL-23622
- Do not ignore staged users in sidgen plugin
Resovlves: RHEL-23626
- ipa-kdb: Disable Bronze-Bit check if PAC not available
Resolves: RHEL-22313
- krb5kdc: Fix start when pkinit and otp auth type are enabled
Resolves: RHEL-4874
- hbactest was not collecting or returning messages
Resolves: RHEL-12780
- Resolves: #712109 "krbExtraData not allowed" is logged in DS error log while
setting password for default sudo binddn.
- Resolves: #747612 [RFE] IPA should support and manage DNS sites
- Resolves: #768316 [RFE] ipa-getkeytab should auto-detect the ipa server name
- Resolves: #825391 [RFE] Replica installation should provide a means for
inheriting nssldap security access settings
- Resolves: #921497 Incorrect *.py[co] files placement
- Resolves: #1029640 RHEL7 IPA to add DNA Plugin config for dnaRemote support
- Resolves: #1029905 389 DS cache sizes not replicated to IPA replicas
- Resolves: #1196958 IPA replica installation failing with high number of users
(160000).
- Resolves: #1219402 IPA suggests to uninstall a client when the user needs to
uninstall a replica
- Resolves: #1224057 [RFE] TGS authorization decisions in KDC based on
Authentication Indicator
- Resolves: #1234222 [WebUI] UI error message is not appropriate for "Kerberos
principal expiration"
- Resolves: #1234223 [WebUI] General invalid password error message appearing
for "Locked user"
- Resolves: #1254267 ipa-server-install failure applying ldap updates with
limits exceeded
- Resolves: #1258626 realmdomains-mod --add-domain command throwing error when
doamin already is in forwardzone.
- Resolves: #1259020 ipa-server-adtrust-install doesn't allow
NetBIOS-name=EXAMPLE-TEST.COM (dash character)
- Resolves: #1260993 DNSSEC signing enablement on dnszone should throw error
message when DNSSEC master not installed
- Resolves: #1262747 dnssec options missing in ipa-dns-install man page
- Resolves: #1265900 Fail installation immediately after dirsrv fails to
install using ipa-server-install
- Resolves: #1265915 idoverrideuser-find fails if any SID anchor is not
resolvable anymore
- Resolves: #1268027 ipa-dnskeysync-replica crash with backtrace -
LimitsExceeded: limits exceeded for this query
- Resolves: #1269089 Certificate of managed-by host/service fails to resubmit
- Resolves: #1269200 ipa-server crashing while trying to preserve admin user
- Resolves: #1271321 Reduce ioblocktimeout and idletimeout defaults
- Resolves: #1271579 Automember rule expressions disappear from tables on
single expression delete
- Resolves: #1275816 Incomplete ports for IPA ad-trust
- Resolves: #1276351 [RFE] Remove
/usr/share/ipa/updates/50-lockout-policy.update file from IPA releases
- Resolves: #1277109 Add tool tips for Revert, Refresh, Undo, and Undo All in
the IPA UI
- Resolves: #1278426 Better error message needed for invalid ca-signing-algo
option
- Resolves: #1279932 ipa-client-install --request-cert needs workaround in
anaconda chroot
- Resolves: #1282521 Creating a user w/o private group fails when doing so in
WebUI
- Resolves: #1283879 ipa-winsync-migrate: Traceback message should be replaced
by "IPA is not configured on this system"
- Resolves: #1285071 ipa-kra-install fails on replica looking for admin cert
file
- Resolves: #1287194 [RFE] Support of UPN for trusted domains
- Resolves: #1288967 Normalize Manager entry in ipa user-add
- Resolves: #1289487 Priority field missing in Password Policy detail tab
- Resolves: #1291140 ipa client should configure kpasswd_server directive in
krb5.conf
- Resolves: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.4.0.alpha1
- Resolves: #1298848 [RFE] Centralized topology management
- Resolves: #1300576 Browser setup page includes instructions for Internet
Explorer
- Resolves: #1301586 ipa host-del --updatedns should remove related dns
entries.
- Resolves: #1304618 Residual Files After IPA Server Uninstall
- Resolves: #1305144 ipa-python does not require its dependencies
- Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
- Resolves: #1313798 Console output post ipa-winsync-migrate command should be
corrected.
- Resolves: #1314786 [RFE] External Trust with Active Directory domain
- Resolves: #1319023 Include description for 'status' option in man page for
ipactl command.
- Resolves: #1319912 ipa-server-install does not completely change hostname and
named-pkcs11 fails
- Resolves: #1320891 IPA Error 3009: Validation error: Invalid 'ptrrecord':
Reverse zone in-addr.arpa. requires exactly 4 IP address compnents, 5 given
- Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
revocation reasons
- Resolves: #1328549 "ipa-kra-install" command reports incorrect message when
it is executed on server already installed with KRA.
- Resolves: #1329209 ipa-nis-manage enable: change service name from 'portmap'
to 'rpcbind'
- Resolves: #1329275 ipa-nis-manage command should include status option
- Resolves: #1330843 'man ipa' should be updated with latest commands
- Resolves: #1333755 ipa cert-request causes internal server error while
requesting certificate
- Resolves: #1337484 EOF is not handled for ipa-client-install command
- Resolves: #1338031 Insufficient 'write' privilege on some attributes for the
members of the role which has "User Administrators" privilege.
- Resolves: #1343142 IPA DNS should do better verification of DNS zones
- Resolves: #1347928 Frontpage exposes runtime error with no cookies enabled in
browser
- Use NSS protocol range API to set available TLS protocols (#1156466)
- Updated to upstream 3.0.0 rc 2
- Include new FF configuration extension
- Set minimum Requires of selinux-policy to 3.11.1-33
- Set minimum Requires dogtag to 10.0.0-0.43.b1
- Add new optional strict sub-package to allow users to limit other
package upgrades.
- Add ipa-idrange-fix
Resolves: RHEL-56920
- Unconditionally add MS-PAC to global config on update
Resolves: RHEL-49437
- ipatests: Update ipa-adtrust-install test
Resolves: RHEL-40894
- Require python-qrcode version 5.3 or later
Related: RHEL-15090
- ipa-kdb: Rework ipadb_reinit_mspac()
Resolves: RHEL-25742
- ipatests: wait for replica update in test_dns_locations
Resolves: RHEL-22373
- ipatests: fix tasks.wait_for_replication() method
Resolves: RHEL-25708
- Resolves: #805188 [RFE] "ipa migrate-ds" ldapsearches with scope=1
- Resolves: #1019272 With 20000+ users, adding a user to a group intermittently
throws Internal server error
- Resolves: #1035494 Unable to add Kerberos principal via kadmin.local
- Resolves: #1045153 ipa-managed-entries --list -p still requires
DM password
- Resolves: #1125950 ipa-server-install --uinstall doesn't remove port 7389
from ldap_port_t
- Resolves: #1132540 [RFE] Expose service delegation rules in UI and CLI
- Resolves: #1145584 ipaserver/install/cainstance.py creates pkiuser not
matching uidgid
- Resolves: #1176036 IDM client registration failure in a high load environment
- Resolves: #1183116 Remove Requires: subscription-manager
- Resolves: #1186054 permission-add does not prompt to enter --right option in
interactive mode
- Resolves: #1187524 Replication agreement with replica not disabled when
ipa-restore done without IPA installed
- Resolves: #1188195 Fax number not displayed for user-show when kinit'ed as
normal user.
- Resolves: #1189034 "an internal error has occurred" during ipa host-del
--updatedns
- Resolves: #1193554 ipa-client-automount: failing with error LDAP server
returned UNWILLING_TO_PERFORM. This likely means that minssf is enabled.
- Resolves: #1193759 IPA extdom plugin fails when encountering large groups
- Resolves: #1194312 [ipa-python] ipalib.errors.LDAPError: failed to decode
certificate: (SEC_ERROR_INVALID_ARGS) security library: invalid arguments.
- Resolves: #1194633 Default trust view can be deleted in lower case
- Resolves: #1196455 ipa-server-install step [8/27]: starting certificate
server instance - confusing CA staus message on TLS error
- Resolves: #1198263 Limit deadlocks between DS plugin DNA and slapi-nis
- Resolves: #1199527 [RFE] Use datepicker component for datetime fields
- Resolves: #1200867 [RFE] Make OTP validation window configurable
- Resolves: #1200883 [RFE] Switch apache to use mod_auth_gssapi
- Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using
get_user_grouplist() [rhel-7.2]
- Resolves: #1204637 slow group operations
- Resolves: #1204642 migrate-ds: slow add o users to default group
- Resolves: #1208461 IPA CA master server update stuck on checking getStatus
via https
- Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
- Resolves: #1211708 ipa-client-install gets stuck during NTP sync
- Resolves: #1215197 ipa-client-install ignores --ntp-server option during time
sync
- Resolves: #1215200 ipa-client-install configures IPA server as NTP source
even if IPA server has not ntpd configured
- Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
- Related: #1204809 Rebase ipa to 4.2
- Update to upstream 4.2.0.alpha1
- ipatests: NAMED_CRYPTO_POLICY_FILE not defined for RHEL
Resolves: RHBZ#1982956
- Add sssd and certmonger as a Requires on ipa-client
- Rebase to upstream release 4.9.10
Remove upstream patches 0002 to 0016 that are part of version 4.9.10
Remove patches 1101 that is part of version 4.9.10
Rename patch 0001 to 1002 as it will be used in future RHEL 8 releases
Add patches 0001 and 0002 to fix build on RHEL 8.7
Resolves: RHBZ#2079466
Resolves: RHBZ#2063155
Resolves: RHBZ#1958777
Resolves: RHBZ#2068088
Resolves: RHBZ#2004646
Resolves: RHBZ#782917
Resolves: RHBZ#2059396
Resolves: RHBZ#2092015
- Handle new samba exception types.
Resolves: RHEL-17623
- Deprecate --serial-autoincrement option (#1016645)
- CA installation always failed on replica (#1005446)
- Re-initializing a winsync connection exited with error (#994980)
- Update to upstream 3.2.0 Beta 1
- Add a Requires for java-atk-wrapper until we can determine which package
should be pulling it in, dogtag or tomcat.
- Add redhat-access-plugin-ipa dependency
- extdom: unify error code handling especially LDAP_NO_SUCH_OBJECT
Resolves: RHBZ#1741530
- Resolves: #800545 [RFE] Support SUDO command rename
- Reworked the renaming mechanism
- Allow renaming of the sudorule objects
- Resolves: #872671 IPA WebUI login for AD Trusted User fails
- WebUI: check principals in lowercase
- WebUI: add method for disabling item in user dropdown menu
- WebUI: Add support for login for AD users
- Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
certificates on smart cards (pkinit)
- ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
- IPA certauth plugin
- ipa-kdb: do not depend on certauth_plugin.h
- spec file: bump krb5-devel BuildRequires for certauth
- Resolves: #1264370 RFE: disable last successful authentication by default in
ipa.
- Set "KDC:Disable Last Success" by default
- Resolves: #1318186 Misleading error message during external-ca IPA master
install
- certs: do not implicitly create DS pin.txt
- httpinstance: clean up /etc/httpd/alias on uninstall
- Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
CA certificate chain in ... incomplete"
- certs: do not implicitly create DS pin.txt
- httpinstance: clean up /etc/httpd/alias on uninstall
- Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
- configure: fix --disable-server with certauth plugin
- rpcserver.login_x509: Actually return reply from __call__ method
- spec file: Bump requires to make Certificate Login in WebUI work
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- extdom: do reverse search for domain separator
- extdom: improve cert request
- Resolves: #1430363 [RFE] HBAC rule names command rename
- Reworked the renaming mechanism
- Allow renaming of the HBAC rule objects
- Resolves: #1433082 systemctl daemon-reload needs to be called after
httpd.service.d/ipa.conf is manipulated
- tasks: run `systemctl daemon-reload` after httpd.service.d updates
- Resolves: #1434032 Run ipa-custodia with custom SELinux context
- Use Custodia 0.3.1 features
- Resolves: #1434384 RPC client should use HTTP persistent connection
- Use connection keep-alive
- Add debug logging for keep-alive
- Increase Apache HTTPD's default keep alive timeout
- Resolves: #1434729 man ipa-cacert-manage install needs clarification
- man ipa-cacert-manage install needs clarification
- Resolves: #1434910 replica install against IPA v3 master fails with ACIError
- Fixing replica install: fix ldap connection in domlvl 0
- Resolves: #1435394 Ipa-kra-install fails with weird output when backspace is
used during typing Directory Manager password
- ipapython.ipautil.nolog_replace: Do not replace empty value
- Resolves: #1435397 ipa-replica-install can't install replica file produced by
ipa-replica-prepare on 4.5
- replica prepare: fix wrong IPA CA nickname in replica file
- Resolves: #1435599 WebUI: in self-service Vault menu item is shown even if
KRA is not installed
- WebUI: Fix showing vault in selfservice view
- Resolves: #1435718 As a ID user I cannot call a command with --rights option
- ldap2: use LDAP whoami operation to retrieve bind DN for current connection
- Resolves: #1436319 "Truncated search results" pop-up appears in user details
in WebUI
- WebUI: Add support for suppressing warnings
- WebUI: suppress truncation warning in select widget
- Resolves: #1436333 Uninstall fails with No such file or directory:
'/var/run/ipa/services.list'
- Create temporaty directories at the begining of uninstall
- Resolves: #1436334 WebUI: Adding certificate mapping data using certificate
fails
- WebUI: Allow to add certs to certmapping with CERT LINES around
- Resolves: #1436338 CLI doesn't work after ipa-restore
- Backup ipa-specific httpd unit-file
- Backup CA cert from kerberos folder
- Resolves: #1436342 Bump samba version, required for FIPS mode and privilege
separation
- Bump samba version for FIPS and priv. separation
- Resolves: #1436642 [ipalib/rpc.py] - "maximum recursion depth exceeded" with
ipa vault commands
- Avoid growing FILE ccaches unnecessarily
- Handle failed authentication via cookie
- Work around issues fetching session data
- Prevent churn on ccaches
- Resolves: #1436657 Add workaround for pki_pin for FIPS
- Generate PIN for PKI to help Dogtag in FIPS
- Resolves: #1436714 [vault] cache KRA transport cert
- Simplify KRA transport cert cache
- Resolves: #1436723 cert-find does not find all certificates without
sizelimit=0
- cert: do not limit internal searches in cert-find
- Resolves: #1436724 Renewal of IPA RA fails on replica
- dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
- Resolves: #1436753 Master tree fails to install
- httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not
available
- webui IdP: Remove arrow notation due to uglify-js limitation
Related: RHBZ#2141316
- Use java-1.8.0-openjdk-devel
- Update to upstream 2.2.0 alpha 1 (2.1.90.pre1)
- Support krb5 1.18
Resolves: RHBZ#1817579
- Fix ipa-replica-install crashes
- Fix ipa-server-install and ipa-dns-install logging
- Set minimum version of pki-ca to 9.0.17 to fix sslget problem
caused by FEDORA-2011-17400 update (#771357)
- Set minimum version of certmonger to 0.26 (to pck up #621670)
- Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
- Set minimum version of pki-ca to 1.3.6
- Set minimum version of sssd to 1.2.1
- diffstat was missing as a build dependency causing multilib problems
- Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
Resolves: RHBZ#1790663
- Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
certificates on smart cards (pkinit)
- spec file: bump krb5 Requires for certauth fixes
- Resolves: #1438729 Configure local PKINIT on DL0 or when '--no-pkinit' option
is used
- separate function to set ipaConfigString values on service entry
- Allow for configuration of all three PKINIT variants when deploying KDC
- API for retrieval of master's PKINIT status and publishing it in LDAP
- Use only anonymous PKINIT to fetch armor ccache
- Stop requesting anonymous keytab and purge all references of it
- Use local anchor when armoring password requests
- Upgrade: configure local/full PKINIT depending on the master status
- Do not test anonymous PKINIT after install/upgrade
- Resolves: #1442427 ipa.ipaserver.install.plugins.adtrust.
update_tdo_gidnumber: ERROR Default SMB Group not found
- upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
installed
- Resolves: #1442932 ipa restore fails to restore IPA user
- restore: restart/reload gssproxy after restore
- Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
- Fix CA/server cert validation in FIPS
- Resolves: #1444947 Deadlock between topology and schema-compat plugins
- compat-manage: behave the same for all users
- Move the compat plugin setup at the end of install
- compat: ignore cn=topology,cn=ipa,cn=etc subtree
- Resolves: #1445358 ipa vault-add raises TypeError
- vault: piped input for ipa vault-add fails
- Resolves: #1445382 ipa vault-retrieve fails to retrieve data from vault
- Vault: Explicitly default to 3DES CBC
- Resolves: #1445432 uninstall ipa client automount failed with RuntimeWarning
- automount install: fix checking of SSSD functionality on uninstall
- Resolves: #1446137 pki_client_database_password is shown in
ipaserver-install.log
- Hide PKI Client database password in log file
- Prepare spec file for release
- Using git snapshot 80e87e75bd6ab56e3e20c49ece55bd4d52f1a503
- Version bump for release
- Add missing ipa-selinux package
Resolves: RHBZ#1853263
- Remove unnecessary moving of v1 CA serial number file in post script
- Add Obsoletes for server-selinxu subpackage
- Using git snapshot 442d6ad30ce1156914e6245aa7502499e50ec0da
- PassSync does not sync passwords due to missing ACIs (#1181093)
- ipa-replica-manage list does not list synced domain (#1181010)
- Do not assume certmonger is running in httpinstance (#1181767)
- ipa-replica-manage disconnect fails without password (#1183279)
- Put LDIF files to their original location in ipa-restore (#1175277)
- DUA profile not available anonymously (#1184149)
- IPA replica missing data after master upgraded (#1176995)
- Included LICENSE and README in all packages for documentation
- Move user-modifiable content to /etc/ipa and linked back to
/usr/share/ipa/html
- Changed some references to /usr to the {_usr} macro and /etc
to {_sysconfdir}
- Added popt-devel to BuildRequires for Fedora 8 and higher and
popt for Fedora 7
- Package the egg-info for Fedora 9 and higher for ipa-python
- Updated to upstream 3.0.0 beta 2
- 2.1.3
- Force to use 389-ds 1.2.10-0.8.a7 or above
- Improve upgrade script to handle systemd 389-ds change
- Fix freeipa to work with python-ldap 2.4.6
- Fix bug #702633
- Resolves: #1256840 [webui] majority of required fields is no longer marked as
required
- fix missing information in object metadata
- Resolves: #1256842 [webui] no option to choose trust type when creating a
trust
- webui: add option to establish bidirectional trust
- Resolves: #1256853 Clear text passwords in KRA install log
- Removed clear text passwords from KRA install log.
- Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
discouraged
- vault: change default vault type to symmetric
- Resolves: #1257163 renaming certificatte profile with --rename option leads
to integrity issues
- certprofile: prevent rename (modrdn)
- Allow the admin user to be disabled
Resolves: RHEL-34756
- ipa-otptoken-import: open the key file in binary mode
Resolves: RHEL-39616
- ipa-crlgen-manage: manage the cert status task execution time
Resolves: RHEL-30280
- idrange-add: add a warning because 389ds restart is required
Resolves: RHEL-28996
- PKINIT certificate: fix renewal on hidden replica
Resolves: RHEL-4913, RHEL-45908
- Mass rebuild 2014-01-24
- Require certmonger 0.79.7-1
Related: RHBZ#1708095
- Do not check if port 8443 is available in step 2 of external CA install
(#1129481)
- Resolves: #1249226 IPA dnssec-validation not working for AD dnsforwardzone
- DNSSEC: fix forward zone forwarders checks
- Resolves: #1250190 idrange is not added for sub domain
- trusts: format Kerberos principal properly when fetching trust topology
- Resolves: #1252334 User life cycle: missing ability to provision a stage user
from a preserved user
- Add user-stage command
- Resolves: #1252863 After applying RHBA-2015-1554 errata, IPA service fails to
start.
- spec file: Add Requires(post) on selinux-policy
- Resolves: #1254304 Changing vault encryption attributes
- Change internal rsa_(public|private)_key variable names
- Added support for changing vault encryption.
- Resolves: #1256715 Executing user-del --preserve twice removes the user
pernamently
- improve the usability of `ipa user-del --preserve` command
- Pull upstream changelog 608 which renamed several files
- Fix for CVE-2008-3274
- Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
- Add fix for bug #453185
- Rebuild against openldap libraries, mozldap ones do not work properly
- TurboGears is currently broken in rawhide. Added patch to not build
the UI locales and removed them from the ipa-server files section.
- Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
- Fix regression introduced in ipa-certupdate
- Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
- Do not initialize API in ipa-client-automount uninstall
- Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
client changes
- idrange: fix unassigned global variable
- Resolves: #1360792 Migrating users doesn't update krbCanonicalName
- re-set canonical principal name on migrated users
- Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
and 'bool' objects
- Fix ipa hbactest output
- Resolves: #1362260 ipa vault-mod no longer allows defining salt
- vault: add missing salt option to vault_mod
- Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
public key
- vault: Catch correct exception in decrypt
- Resolves: #1362537 ipa-server-install fails to create symlink from
/etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
- Correct path to HTTPD's systemd service directory
- Resolves: #1363756 Increase length of passwords generated by installer
- Increase default length of auto generated passwords
- Update to upstream 3.3.0 Beta 2 (#991064)
- Update Requires on pki-ca to 10.1.2-4 (#1129558)
- build: increase java stack size for all arches
- Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
- Fix dns zonemgr validation regression (#1056202)
- Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
- Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
(#886645)
- Add bind-dyndb-ldap working dir to IPA specfile
- Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
(#886645)
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
- Deadlock in schema compat plugin (#1161131)
- ipactl stop should stop dirsrv last (#1161129)
- Upgrade 3.3.5 to 4.1 failed (#1161128)
- CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)
- Fix status trust-add command status message (#910453)
- NetBIOS was not trimmed at 15 characters (#1030517)
- Harden CA subsystem certificate renewal on CA clones (#1040018)
- remove ipa-fix-CVE-2008-3274
- Resolves: #1382812 Creation of replica for disconnected environment is
failing with CA issuance errors; Need good steps.
- gracefully handle setting replica bind dn group on old masters
- Resolves: #1397439 ipa-ca-install on promoted replica hangs on creating a
temporary CA admin
- replication: ensure bind DN group check interval is set on replica config
- add missing attribute to ipaca replica during CA topology update
- Resolves: #1401088 IPA upgrade of replica without DNS fails during restart of
named-pkcs11
- bindinstance: use data in named.conf to determine configuration status
- Resolves: #1348948 IPA server install fails with build
ipa-server-4.4.0-0.el7.1.alpha1
- Revert "Increased mod_wsgi socket-timeout"
- Resolves: #1449189 ipa-kra-install timeouts on replica
- ipa-kra-install: fix check_host_keys
- Require python-wehjit >= 0.2.0
- Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
- Resolves: #1375269 ipa trust-fetch-domains throws internal error
- Set minimum level of 389-ds-base to 1.2.7 for enhanced memberof plugin
- Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
- ipa-sam: replace encode_nt_key() with E_md4hash()
- ipa_pwd_extop: do not generate NT hashes in FIPS mode
- Resolves: #1377973 ipa-server-install fails when the provided or resolved
IP address is not found on local interfaces
- Fix local IP address validation
- ipa-dns-install: remove check for local ip address
- refactor CheckedIPAddress class
- CheckedIPAddress: remove match_local param
- Remove ip_netmask from option parser
- replica install: add missing check for non-local IP address
- Remove network and broadcast address warnings
- Resolves: #1477178 - [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic
key for host
- Always check peer has keys before connecting
- Resolves: #1482802 - Unable to set ca renewal master on replica
- Fix ipa config-mod --ca-renewal-master
- Resolves: #1486283 - TypeError in renew_ca_cert prevents from swiching
back to self-signed CA
- Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
- Resolves: #1480102 - ipa-server-upgrade failes with "This entry already exists"
- Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
- Resolves: #1484826 - FreeIPA/IdM installations which were upgraded from
versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
thus startup of Web UI fails
- Adds whoami DS plugin in case that plugin is missing
- Resolves: #1478251 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
- Fixing how sssd.conf is updated when promoting a client to replica
- Resolves: #1461177 - ipa-otptoken-import - XML file is missing PBKDF2
parameters!
- ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
- Resolves: #1484428 - Updating from RHEL 7.3 fails with Server-Cert not found
(ipa-server-upgrade)
- Backport 4-5: Fix ipa-server-upgrade with server cert tracking
- kdb: Use-krb5_pac_full_sign_compat() when available
Resolves: RHBZ#2176406
- OTP: fix-data-type-to-avoid-endianness-issue
Resolves: RHBZ#2218293
- Upgrade: fix replica agreement
Resolves: RHBZ#2216551
- Upgrade: add PKI drop-in file if missing
Resolves: RHBZ#2215336
- Use the python-cryptography parser directly in cert-find
Resolves: RHBZ#2164349
- Backport test updates
Resolves: RHBZ#221884
- Initial rpm version
- SELinux Policy: let custodia replicate keys
Resolves: RHBZ#1868432
- Update slapi-nis dependency to pull 0.54-2 (#891984)
- ipa-restore: Don't crash if AD trust is not installed (#951581)
- Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
- Trust setting not restored for CA cert with ipa-restore command (#1159011)
- ipa-server-install fails when restarting named (#1162340)
- Rebuild against samba4 beta8
- Resolves: #1170770 [AD TRUST]IPA should detect inconsistent realm domains
that conflicts with AD DC
- trusts: Check for AD root domain among our trusted domains
- Resolves: #1195339 ipa-client-install changes the label on various files
which causes SELinux denials
- sysrestore: copy files instead of moving them to avoind SELinux issues
- Resolves: #1196656 [ipa-client][rhel71] enable debugging for spawned
commands / ntpd -qgc $tmpfile hangs
- enable debugging of ntpd during client installation
- Resolves: #1205264 Migration UI Does Not Work When Anonymous Bind is Disabled
- migration: Use api.env variables.
- Resolves: #1212719 abort-clean-ruv subcommand should allow
replica-certifyall: no
- Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand
- Resolves: #1216935 ipa trust-add shows ipa: ERROR: an internal error has
occurred
- dcerpc: Expand explanation for WERR_ACCESS_DENIED
- dcerpc: Fix UnboundLocalError for ccache_name
- Resolves: #1222778 idoverride group-del can delete user and user-del can
delete group
- dcerpc: Add get_trusted_domain_object_type method
- idviews: Restrict anchor to name and name to anchor conversions
- idviews: Enforce objectclass check in idoverride*-del
- Resolves: #1234919 Be able to request certificates without certmonger service
running
- cermonger: Use private unix socket when DBus SystemBus is not available.
- ipa-client-install: Do not (re)start certmonger and DBus daemons.
- Resolves: #1240939 Please add dependency on bind-pkcs11
- Create server-dns sub-package.
- ipaplatform: Add constants submodule
- DNS: check if DNS package is installed
- Resolves: #1242914 Bump minimal selinux-policy and add booleans to allow
calling out oddjobd-activated services
- selinux: enable httpd_run_ipa to allow communicating with oddjobd services
- Resolves: #1243261 non-admin users cannot search hbac rules
- fix hbac rule search for non-admin users
- fix selinuxusermap search for non-admin users
- Resolves: #1243652 Client has missing dependency on memcache
- do not import memcache on client
- Resolves: #1243835 [webui] user change password dialog does not work
- webui: fix user reset password dialog
- Resolves: #1244802 spec: selinux denial during kdcproxy user creation
- Fix selinux denial during kdcproxy user creation
- Resolves: #1246132 trust-fetch-domains: Do not chown keytab to the sssd user
- oddjob: avoid chown keytab to sssd if sssd user does not exist
- Resolves: #1246136 Adding a privilege to a permission avoids validation
- Validate adding privilege to a permission
- Resolves: #1246141 DNS Administrators cannot search in zones
- DNS: Consolidate DNS RR types in API and schema
- Resolves: #1246143 User plugin - user-find doesn't work properly with manager
option
- fix broken search for users by their manager
- ipa-kdb: Detect and block Bronze-Bit attacks
Resolves: RHEL-9984
- Fix for CVE-2023-5455
Resolves: RHEL-12578
- Temporarily move ipa-backup and ipa-restore functionality
back to make them available in public Beta (#1003933)
- Added patch to fix problem reported by ldapmodify
- Add dependency for python-krbV
- Resolves: #1438833 [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic key for
host
- Make sure remote hosts have our keys
- Resolves: #1442815 Replica install fails during migration from older IPA
master
- Refresh Dogtag RestClient.ca_host property
- Remove the cachedproperty class
- Resolves: #1444787 Update warning message when KRA installation fails
- kra install: update installation failure message
- Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
- ipa-server-install with external CA: fix pkinit cert issuance
- Resolves: #1445397 GET in KerberosSession.finalize_kerberos_acquisition()
must use FreeIPA CA
- kerberos session: use CA cert with full cert chain for obtaining cookie
- Resolves: #1447375 ipa-client-install: extra space in pkinit_anchors
definition
- ipa-client-install: remove extra space in pkinit_anchors definition
- Resolves: #1447703 Fix SELinux contex of http.keytab during upgrade
- Use proper SELinux context with http.keytab
- Fix upgrade issue with AD trust when no trust yet established
Fixes: RHBZ#1708874
Related: RHBZ#1684528
- Resolves: #1131907 [ipa-client-install] cannot write certificate file
'/etc/ipa/ca.crt.new': must be string or buffer, not None
- Resolves: #1195775 unsaved changes dialog internally inconsistent
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- Stageusedr-activate: show username instead of DN
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Prevent to rename certprofile profile id
- Resolves: #1222047 IPA to AD Trust: IPA ERROR 4016: Remote Retrieve Error
- Resolves: #1224769 copy-schema-to-ca.py does not overwrites schema files
- copy-schema-to-ca: allow to overwrite schema files
- Resolves: #1241941 kdc component installation of IPA failed
- spec file: Update minimum required version of krb5
- Resolves: #1242036 Replica install fails to update DNS records
- Fix DNS records installation for replicas
- Resolves: #1242884 Upgrade to 4.2.0 fails when enabling kdc proxy
- Start dirsrv for kdcproxy upgrade
- ipa-kdb: fix error handling of is_master_host()
Resolves: RHBZ#2214638
- ipatests: enable firewall rule for http service on acme client
Resolves: RHBZ#2230256
- User plugin: improve error related to non existing idp
Resolves: RHBZ#2224572
- Prevent admin user from being deleted
Resolves: RHBZ#1821181
- Fix memory leak in the OTP last token plugin
Resolves: RHBZ#2227783
- Fix Fedora package changelog after merging systemd changes
- Backport latest test fixes in python3-ipatests
Resolves: RHBZ#2060841
- extdom: user getorigby{user|group}name if available
Resolves: RHBZ#2062379
- Set the mode on ipaupgrade.log during RPM post snipppet
Resolves: RHBZ#2061957
- test_krbtpolicy: skip SPAKE-related tests in FIPS mode
Resolves: RHBZ#1909630
- Fixed kdcproxy_version to 0.4-3
- Fixed krb5_version to 1.17-7
Related: RHBZ#1684528
- Handle NFS configuration file changes. nfs-utils moved the
configuration file from /etc/sysconfig/nfs to /etc/nfs.conf.
Resolves: RHBZ#1676981
- webui: Allow grace login limit
Resolves: RHBZ#2109243
- check_repl_update: in progress is a boolean
Resolves: RHBZ#2117303
- Disabling gracelimit does not prevent LDAP binds
Resolves: RHBZ#2109236
- Set passwordgracelimit to match global policy on group pw policies
Resolves: RHBZ#2115475
- Add Requires on krb5-pkinit-openssl
- Upstream release FreeIPA 4.9.6
Related: RHBZ#1945038
- Revise PKINIT upgrade code
Resolves: RHBZ#1886837
- ipa-cert-fix man page: add note about certmonger renewal
Resolves: RHBZ#1780317
- Certificate Serial Number issue
Resolves: RHBZ#1919384
- Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
- Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to
handle PKINIT certificates/anchors
- certdb: add named trust flag constants
- certdb, certs: make trust flags argument mandatory
- certdb: use custom object for trust flags
- install: trust IPA CA for PKINIT
- client install: fix client PKINIT configuration
- install: introduce generic Kerberos Augeas lens
- server install: fix KDC PKINIT configuration
- ipapython.ipautil.run: Add option to set umask before executing command
- certs: do not export keys world-readable in install_key_from_p12
- certs: do not export CA certs in install_pem_from_p12
- server install: fix KDC certificate validation in CA-less
- replica install: respect --pkinit-cert-file
- cacert manage: support PKINIT
- server certinstall: support PKINIT
- Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
option
- certs: do not export CA certs in install_pem_from_p12
- server install: fix KDC certificate validation in CA-less
- Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
decommissioned
- ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname
- Resolves: #1451712 KRA installation fails on server that was originally
installed as CA-less
- ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
- Resolves: #1441499 ipa cert-show does not raise error if no file name
specified
- ca/cert-show: check certificate_out in options
- Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
- Remove pkinit-anonymous command
- Resolves: #1449523 Provide an API command to retrieve PKINIT status
in the FreeIPA topology
- Allow for multivalued server attributes
- Refactor the role/attribute member reporting code
- Add an attribute reporting client PKINIT-capable servers
- Add the list of PKINIT servers as a virtual attribute to global config
- Add `pkinit-status` command
- test_serverroles: Get rid of MockLDAP and use ldap2 instead
- Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
- Fix rare race condition with missing ccache file
- Resolves: #1455045 Simple service uninstallers must be able to handle
missing service files gracefully
- only stop/disable simple service if it is installed
- Resolves: #1455541 after upgrade login from web ui breaks
- krb5: make sure KDC certificate is readable
- Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
command "ipa cert-request --add" after upgrade
- Change python-cryptography to python2-cryptography
- Require krb5 release 1.18.2-25 or later
Resolves: RHBZ#2234711
- Rebase ipa to 4.9.12
Resolves: RHBZ#2196425
- user or group name: explain the supported format
Resolves: RHBZ#2150217
- Allow insecure binds for migration
Resolves: RHBZ#1731963
- Trust add tries to add same value of --base-id for sub domain,
causing an error (#1033068)
- Improved error reporting for adding trust case (#1029856)
- Do not fetch a principal two times, remove potential memory leak (#1070924)
- Depend on krb5-kdb-version-devel for BuildRequires
- Update nss dependency to 3.44.0-4
- Reset per-indicator Kebreros policy
Resolves: RHBZ#1784761
- Resolves: #1339233 CA installed on replica is always marked as renewal master
- Related: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.3.1.201605241723GIT1b427d3
- Pull upstream changelog 722
- Add Conflicts mod_ssl (435360)
- Use default ssh host key algorithms
Resolves: RHBZ#1756432
- Do not run trust upgrade code if master lacks Samba bindings
Resolves: RHBZ#1757064
- Finish group membership management UI
Resolves: RHBZ#1773528
- Add ipa-host-net-manage script
- Use the OpenSSL certificate parser in cert-find
Resolves: RHBZ#2209947
- Add a- heck into ipa-cert-fix tool to avoid updating certs if CA is close to expire
Resolves: RHEL-4941
- Fix rpminspect's 'patches' warnings
Resolves: RHEL-22497
- replica install failing with avc denial for custodia component
Resolves: RHBZ#1857157
- Upstream pre release FreeIPA 4.9.0rc1
Resolves: RHBZ#1891832
- Requirements and design for libpwquality integration
Resolves: RHBZ#1340463
- When parsing options require name/value pairs
Resolves: RHBZ#1357495
- WebUI: Fix issue with opening links in new tab/window
Resolves: RHBZ#1484088
- Use a state to determine if a 389-ds upgrade is in progress
Resolves: RHBZ#1569011
- Unlock user accounts after a password reset and replicate that unlock to
all IdM servers
Resolves: RHBZ#1784657
- Set the certmonger subject with a string, not an object
Resolves: RHBZ#1810148
- Implement ACME certificate enrolment
Resolves: RHBZ#1851835
- [WebUI] Backport jQuery patches from newer versions of the library (e.g.
3.5.0)
Resolves: RHBZ#1859249
- It is not possible to edit KDC database when the FreeIPA server is running
Resolves: RHBZ#1875001
- Fix nsslapd-db-lock tuning of BDB backend
Resolves: RHBZ#1882340
- ipa-kdb: support subordinate/superior UPN suffixes
Resolves: RHBZ#1891056
- wgi/plugins.py: ignore empty plugin directories
Resolves: RHBZ#1894800
- Default to systemd for Fedora 16 and onwards
- Update to upstream 3.2.0 GA
- ipa-client-install fails if /etc/ipa does not exist (#961483)
- Certificate status is not visible in Service and Host page (#956718)
- ipa-client-install removes needed options from ldap.conf (#953991)
- Handle socket.gethostbyaddr() exceptions when verifying hostnames (#953957)
- Add triggerin scriptlet to support OpenSSH 6.2 (#953617)
- Require nss 3.14.3-12.0 to address certutil certificate import
errors (#953485)
- Require pki-ca 10.0.2-3 to pull in fix for sslget and mixed IPv4/6
environments. (#953464)
- ipa-client-install removes 'sss' from /etc/nsswitch.conf (#953453)
- ipa-server-install --uninstall doesn't stop dirsrv instances (#953432)
- Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for
socket based connections (#960222)
- Require libsss_nss_idmap-python
- Add Conflicts on nss-pam-ldapd < 0.8.4. The mapping from uniqueMember to
member is now done automatically and having it in the config file raises
an error.
- Add backup and restore tools, directory.
- require at least systemd 38 which provides the journal (we no longer
need to require syslog.target)
- Update Requires on policycoreutils to 2.1.14-37
- Update Requires on selinux-policy to 3.12.1-42
- Update Requires on 389-ds-base to 1.3.1.0
- Remove a Requires for java-atk-wrapper
- Preserve user: fix the confusing summary
Resolves: RHBZ#2022028
- Only calculate LDAP password grace when the password is expired
Related: RHBZ#782917
- Resolves: #1260663 crash of ipa-dnskeysync-replica component during
ipa-restore
- IPA Restore: allows to specify files that should be removed
- Resolves: #1261806 Installing ipa-server package breaks httpd
- Handle timeout error in ipa-httpd-kdcproxy
- Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
- Server Upgrade: backup CS.cfg when dogtag is turned off
- ipa-server-install crashes when AD subpackage is not installed (#1026434)
- Resolves: #1228671 pkispawn fails in ipa-ca-install and ipa-kra-install
- Related: #1204809 Rebase ipa to 4.2
- Fix minimum version of slapi-nis
- Require python-sss and python-sss-murmur (provided by sssd-1.13.0)
- Drop conflicts on mod_nss
- Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
- Drop a slew of conditionals on older Fedora releases (< 12)
- Add a few conditionals against RHEL 6
- Add Requires of nss-tools on ipa-client
- Upstream release FreeIPA 4.9.3
Resolves: RHBZ#1945038
- Fix systemd-user HBAC rule
Resolves: RHBZ#1664974
- sudo rule for "admins" members should be created by default (#1609873)
- New upstream release 1.2.1
- Updated to current upstream state of 3.0.0 beta 2 development
- Wrong directories created on full restore (#1186398)
- ipa-restore crashes if replica is unreachable (#1186396)
- idoverrideuser-add option --sshpubkey does not work (#1185410)
- Missing objectclasses when empty password passed to host-add (#1052979)
- sudoOrder missing in sudoers (#1052983)
- Missing examples in sudorule help (#1049464)
- Client automount does not uninstall when fstore is empty (#910899)
- Error not clear for invalid realm given to trust-fetch-domains (#1052981)
- trust-fetch-domains does not add idrange for subdomains found (#1049926)
- Add option to show if an AD subdomain is enabled/disabled (#1052973)
- ipa-adtrust-install still failed with long NetBIOS names (#1030517)
- Error not clear for invalid relam given to trustdomain-find (#1049455)
- renewed client cert not recognized during IPA CA renewal (#1033273)
- Revert bind-pkcs11-utils configuration in freeipa.spec.
Resolves: RHBZ#2026732
- Replace TurboGears requirement with python-cherrypy
- Update to upstream 3.2.1
- Drop dogtag-pki-server-theme requires, it won't be build for RHEL-7.0
- Remove ipa-idoverride-memberof as superceded by ipa-server 4.8.7
Resolves: RHBZ#1846434
- Respin after the tarball has been re-released upstream
New hash is 506c9c92dcaf9f227cba5030e999f177
- Allow Web-based migration to work with tightened SE Linux policy (#769440)
- Rebuild slapi plugins against re-enterant version of libldap
- Remove strict dependencies to krb5-server version in order to allow
update of krb5 to 1.17 and change dependency to KDB DAL version.
Resolves: RHBZ#1700121
- Fixed: rhbz#1643445 - External CA step 2 fails with pki_client_database_dir is missing
- Fixed: rhbz#1642834 - Smart card advise script uses hard-coded Python interpreter
- Resolves: #1277696 IPA certificate auto renewal fail with "Invalid
Credential"
- cert renewal: make renewal of ipaCert atomic
- Resolves: #1278330 installer options are not validated at the beginning of
installation
- install: fix command line option validation
- Resolves: #1282845 sshd_config change on ipa-client-install can prevent sshd
from starting up
- client install: do not corrupt OpenSSH config with Match sections
- Resolves: #1282935 ipa upgrade causes vault internal error
- install: export KRA agent PEM file in ipa-kra-install
- Resolves: #1283429 Default CA ACL rule is not created during
ipa-replica-install
- TLS and Dogtag HTTPS request logging improvements
- Avoid race condition caused by profile delete and recreate
- Do not erroneously reinit NSS in Dogtag interface
- Add profiles and default CA ACL on migration
- disconnect ldap2 backend after adding default CA ACL profiles
- do not disconnect when using existing connection to check default CA ACLs
- Resolves: #1283430 ipa-kra-install: fails to apply updates
- suppress errors arising from adding existing LDAP entries during KRA
install
- Resolves: #1283748 Caching of ipaconfig does not work in framework
- fix caching in get_ipa_config
- Resolves: #1283943 IPA DNS Zone/DNS Forward Zone details missing after
upgrade from RHEL 7.0 to RHEL 7.2
- upgrade: fix migration of old dns forward zones
- Fix upgrade of forwardzones when zone is in realmdomains
- Resolves: #1284413 ipa-cacert-manage renew fails on nonexistent ldap
connection
- ipa-cacert-renew: Fix connection to ldap.
- Resolves: #1284414 ipa-otptoken-import fails on nonexistent ldap connection
- ipa-otptoken-import: Fix connection to ldap.
- Resolves: #1286635 IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using
"yum update ipa* sssd"
- Set minimal required version for openssl
- Resolves: #1286781 ipa-nis-manage does not update ldap with all NIS maps
- Upgrade: Fix upgrade of NIS Server configuration
- Resolves: #1289311 umask setting causes named-pkcs11 issue with directory
permissions on /var/lib/ipa/dnssec
- DNS: fix file permissions
- Explicitly call chmod on newly created directories
- Fix: replace mkdir with chmod
- Resolves: #1290142 Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
- Fix version comparison
- use FFI call to rpmvercmp function for version comparison
- Resolves: #1292595 In IPA-AD trust environment some secondary IPA based Posix
groups are missing
- ipa-kdb: map_groups() consider all results
- Resolves: #1293870 User should be notified for wrong password in password
reset page
- Fixed login error message box in LoginScreen page
- Resolves: #1296196 Sysrestore did not restore state if a key is specified in
mixed case
- Allow to used mixed case for sysrestore
- Resolves: #1296214 DNSSEC key purging is not handled properly
- DNSSEC: Improve error reporting from ipa-ods-exporter
- DNSSEC: Make sure that current state in OpenDNSSEC matches key state in
LDAP
- DNSSEC: Make sure that current key state in LDAP matches key state in BIND
- DNSSEC: remove obsolete TODO note
- DNSSEC: add debug mode to ldapkeydb.py
- DNSSEC: logging improvements in ipa-ods-exporter
- DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP
- DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
- DNSSEC: ipa-ods-exporter: add ldap-cleanup command
- DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removal
- DNSSEC: Log debug messages at log level DEBUG
- Resolves: #1296216 ipa-server-upgrade fails if certmonger is not running
- prevent crash of CA-less server upgrade due to absent certmonger
- always start certmonger during IPA server configuration upgrade
- Resolves: #1297811 The ipa -e skip_version_check=1 still issues
incompatibility error when called against RHEL 6 server
- ipalib: assume version 2.0 when skip_version_check is enabled
- Resolves: #1298289 install fails when locale is "fr_FR.UTF-8"
- Do not decode HTTP reason phrase from Dogtag
- Resolves: #1300252 shared certificateProfiles container is missing on a
freshly installed RHEL7.2 system
- upgrade: unconditional import of certificate profiles into LDAP
- Resolves: #1301674 --setup-dns and other options is forgotten for using an
external PKI
- installer: Propagate option values from components instead of copying them.
- installer: Fix logic of reading option values from cache.
- Resolves: #1301687 issues with migration from RHEL 6 self-signed to RHEL 7 CA
IPA setup
- ipa-ca-install: print more specific errors when CA is already installed
- cert renewal: import all external CA certs on IPA CA cert renewal
- CA install: explicitly set dogtag_version to 10
- fix standalone installation of externally signed CA on IPA master
- replica install: validate DS and HTTP server certificates
- replica install: improvements in the handling of CA-related IPA config
entries
- Resolves: #1301901 [RFE] compat tree: show AD members of IPA groups
- slapi-nis: update configuration to allow external members of IPA groups
- Resolves: #1305533 ipa trust-add succeded but after that ipa trust-find
returns "0 trusts matched"
- upgrade: fix config of sidgen and extdom plugins
- trusts: use ipaNTTrustPartner attribute to detect trust entries
- Warn user if trust is broken
- fix upgrade: wait for proper DS socket after DS restart
- Insure the admin_conn is disconnected on stop
- Fix connections to DS during installation
- Fix broken trust warnings
- Resolves: #1321092 Installers fail when there are multiple versions of the
same certificate
- certdb: never use the -r option of certutil
- Related: #1317381 Crash during IPA upgrade due to slapd
- spec file: update minimum required version of slapi-nis
- Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112
CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws
[rhel-7.3]
- Rebuild against newer Samba version
- RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
(#1169591)
- CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
(#1172578)
- Re-arrange doc and defattr to clean up rpmlint warnings
- Remove conditionals on older releases
- Move some man pages into admintools subpackage
- Remove some explicit Requires in client that aren't needed
- Consistent use of buildroot vs RPM_BUILD_ROOT
- Update to upstream 3.3.1 (#991064)
- Update minimum version of bind-dyndb-ldap to 3.5
- Remove release from krb5-server in strict sub-package to allow for rebuilds.
- Fix krb5-kdb-server -> krb5-kdb-version
Related: RHBZ#1700121
- Unified spec file
- Update to upstream 3.1.2
- CVE-2012-4546: Incorrect CRLs publishing
- CVE-2012-5484: MITM Attack during Join process
- CVE-2013-0199: Cross-Realm Trust key leak
- Updated strict dependencies to 389-ds-base = 1.3.0.2 and
pki-ca = 10.0.1
- IPA Replicate creation fails with error "Update failed! Status: [10 Total
update abortedLDAP error: Referral]" (#1166265)
- running ipa-server-install --setup-dns results in a crash (#1072502)
- DNS zones are not migrated into forward zones if 4.0+ replica is added
(#1175384)
- gid is overridden by uid in default trust view (#1168904)
- When migrating warn user if compat is enabled (#1177133)
- Clean up debug log for trust-add (#1168376)
- No error message thrown on restore(full kind) on replica from full backup
taken on master (#1175287)
- ipa-restore proceed even IPA not configured (#1175326)
- Data replication not working as expected after data restore from full backup
(#1175277)
- IPA externally signed CA cert expiration warning missing from log (#1178128)
- ipa-upgradeconfig fails in CA-less installs (#1181767)
- IPA certs fail to autorenew simultaneouly (#1173207)
- More validation required on ipa-restore's options (#1176034)
- Installer did not detect different server and IPA domain (#1026845)
- Allow kernel keyring CCACHE when supported (#1026861)
- Resolves: #1442233 IPA client commands fail when pointing to replica
- httpinstance: wait until the service entry is replicated
- Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
not indexed
- Fix index definition for ipaAnchorUUID
- Resolves: #1438016 gssapi errors after IPA server upgrade
- Avoid possible endless recursion in RPC call
- rpc: preparations for recursion fix
- rpc: avoid possible recursion in create_connection
- Resolves: #1446087 services entries missing krbCanonicalName attribute.
- Changing cert-find to do not use only primary key to search in LDAP.
- Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
- ipa-kdb: reload certificate mapping rules periodically
- Resolves: #1455541 after upgrade login from web ui breaks
- kdc.key should not be visible to all
- Resolves: #1435606 Add pkinit_indicator option to KDC configuration
- ipa-kdb: add pkinit authentication indicator in case of a successful
certauth
- Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
issuance when ipa-ca records are not resolvable
- Turn off OCSP check
- Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
server_del - TypeError: 'NoneType' object is not iterable
- fix incorrect suffix handling in topology checks
- Hardening for CVE-2020-25717
- Related: RHBZ#2019668
- Require python-wehjit >= 0.2.2
- Resolves: #837369 [RFE] Switch to client promotion to replica model
- Resolves: #1199516 [RFE] Move replication topology to the shared tree
- Resolves: #1206588 [RFE] Visualize FreeIPA server replication topology
- Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
- Resolves: #1212713 ipa-csreplica-manage: it could be nice to have also
list-ruv / clean-ruv / abort-clean-ruv for o=ipaca backend
- Resolves: #1267206 ipa-server-install uninstall should warn if no
installation found
- Resolves: #1295865 The Domain option is not correctly set in idmapd.conf when
ipa-client-automount is executed.
- Resolves: #1327092 URI details missing and OCSP-URI details are incorrectly
displayed when certificate generated using IPA on RHEL 7.2up2.
- Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
because of missing dependencies
- Related: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.3.1.201605191449GITf8edf37
- Update to upstream 4.6.90.pre1
- Resolves: #1355753 adding two way non transitive(external) trust displays
internal error on the console
- Always fetch forest info from root DCs when establishing two-way trust
- factor out `populate_remote_domain` method into module-level function
- Always fetch forest info from root DCs when establishing one-way trust
- Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
after `ipa-replica-install`
- Track lightweight CAs on replica installation
- Resolves: #1357488 ipa command stuck forever on higher versioned client with
lower versioned server
- compat: Save server's API version in for pre-schema servers
- compat: Fix ping command call
- schema cache: Store and check info for pre-schema servers
- Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
- Fix man page ipa-replica-manage: remove duplicate -c option
from --no-lookup
- Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
when revoking certificate
- cert: include CA name in cert command output
- WebUI add support for sub-CAs while revoking certificates
- Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
- Add support for additional options taken from table facet
- WebUI: Fix showing certificates issued by sub-CA
- Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
internactively
- dns: normalize record type read interactively in dnsrecord_add
- dns: prompt for missing record parts in CLI
- dns: fix crash in interactive mode against old servers
- Resolves: #1370519 Certificate revocation in service-del and host-del isn't
aware of Sub CAs
- cert: fix cert-find --certificate when the cert is not in LDAP
- Make host/service cert revocation aware of lightweight CAs
- Resolves: #1371901 Use OAEP padding with custodia
- Use RSA-OAEP instead of RSA PKCS#1 v1.5
- Resolves: #1371915 When establishing external two-way trust, forest root
Administrator account is used to fetch domain info
- do not use trusted forest name to construct domain admin principal
- Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
certificate request
- Fix CA ACL Check on SubjectAltNames
- Resolves: #1373272 CLI always sends default command version
- cli: use full name when executing a command
- Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
- Fix ipa-certupdate for CA-less installation
- Resolves: #1373540 client-install with IPv6 address fails on link-local
address (always)
- Fix parse errors with link-local addresses
- man page: update ipa-server-upgrade.1
Resolves: RHBZ#1973273
- Fall back to krbprincipalname when validating host auth indicators
Resolves: RHBZ#1979625
- Add dependency for sssd-winbind-idmap to server-trust-ad
Resolves: RHBZ#1982211
- Fix replica installation failing on certificate subject (#983075)
- Rebase ipa to 4.9.11
Resolves: RHBZ#2141316
- updates: fix memberManager ACI to allow managers from a specified group
Resolves: RHBZ#2056009
- Defer creating the final krb5.conf on clients
Resolves: RHBZ#2148259
- Exclude installed policy module file from RPM verification
Resolves: RHBZ#2149567
- Spec file: ipa-client depends on krb5-pkinit-openssl
Resolves: RHBZ#2149889
- When IdM server trusts multiple AD forests, IPA client returns invalid group
membership info (#1079498)
- IPA server in debug mode fails to run because time.perf_counter_ns is
Python 3.7+
Resolves: RHBZ#1974822
- Add checks to prevent assigning authentication indicators to internal IPA
services
Resolves: RHBZ#1979625
- Unable to set ipaUserAuthType with stageuser-add
Resolves: RHBZ#1979605
- Replica installation fails for RHEL 6.4 master (#1004680)
- Server uninstallation crashes if DS is not available (#998069)
- Updated to upstream 3.1.0 GA
- Set minimum for sssd to 1.9.2
- Set minimum for pki-ca to 10.0.0-1
- Set minimum for 389-ds-base to 1.3.0
- Set minimum for selinux-policy to 3.11.1-60
- Remove unneeded dogtag package requires
- Updated to upstream 3.0.0 rc 1
- Update BR for 389-ds-base to 1.2.11.14
- Update BR for krb5 to 1.10
- Update BR for samba4-devel to 4.0.0-139 (rc1)
- Add BR for python-polib
- Update BR and Requires on sssd to 1.9.0
- Update Requires on policycoreutils to 2.1.12-5
- Update Requires on 389-ds-base to 1.2.11.14
- Update Requires on selinux-policy to 3.11.1-21
- Update Requires on dogtag to 10.0.0-0.33.a1
- Update Requires on certmonger to 0.60
- Update Requires on tomcat to 7.0.29
- Update minimum version of bind to 9.9.1-10.P3
- Update minimum version of bind-dyndb-ldap to 1.1.0-0.16.rc1
- Remove Requires on authconfig from python sub-package
- Update Requires on krb5-server to 1.11
- Moved directory install/static to install/ui
- Fix ipa-pwd-extop global configuration caching (#1187342)
- group-detach does not add correct objectclasses (#1187540)
- Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
- Keep NSS trust flags of existing certificates
- Resolves: #1360813 ipa-server-certinstall does not update all certificate
stores and doesn't set proper trust permissions
- Add cert checks in ipa-server-certinstall
- Resolves: #1371479 cert-find --all does not show information about revocation
- cert: add revocation reason back to cert-find output
- Resolves: #1375133 WinSync users who have First.Last casing creates users who
can have their password set
- ipa passwd: use correct normalizer for user principals
- Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
- Properly handle LDAP socket closures in ipa-otpd
- Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
- Make httpd publish its CA certificate on DL1
- ipatests: remove additional check for failed units.
Resolves: RHBZ#2053024
- ipa-cldap: fix memory leak.
Resolves: RHBZ#2032738
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Resolves: #1382053 Need to have validation for idrange names
- idrange-add: properly handle empty --dom-name option
- Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
helper when installing replica
- dsinstance: reconnect ldap2 after DS is restarted by certmonger
- httpinstance: avoid httpd restart during certificate request
- dsinstance, httpinstance: consolidate certificate request code
- install: request service certs after host keytab is set up
- renew agent: revert to host keytab authentication
- renew agent, restart scripts: connect to LDAP after kinit
- Resolves: #1436987 ipasam: gidNumber attribute is not created in the trusted
domain entry
- ipa-sam: create the gidNumber attribute in the trusted domain entry
- Upgrade: add gidnumber to trusted domain entry
- Resolves: #1438679 [ipa-replica-install] - IncorrectPasswordException:
Incorrect client security database password
- Add pki_pin only when needed
- Resolves: #1438348 Console output message while adding trust should be
mapped with texts changed in Samba.
- ipaserver/dcerpc: unify error processing
- Resolves: #1438366 ipa trust-fetch-domains: ValidationError: invalid
'Credentials': Missing credentials for cross-forest communication
- trust: always use oddjobd helper for fetching trust information
- Resolves: #1441192 Add the name of URL parameter which will be check for
username during cert login
- WebUI: cert login: Configure name of parameter used to pass username
- Resolves: #1437879 [copr] Replica install failing
- Create system users for FreeIPA services during package installation
- Resolves: #1441316 WebUI cert auth fails after ipa-adtrust-install
- Fix s4u2self with adtrust
- Require samba 4.14.5-13 with IPA DC server role fixes
- Related: RHBZ#2021443
- Update to upstream 3.2.2
- Drop ipa-server-selinux subpackage
- Drop redundant directory /var/cache/ipa/sessions
- Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
- Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
issues when there are still old parts of software (like entitlements plugin)
- Version bump for release
- Add versioned dependency of samba-client-libs to ipa-server
- Related: RHBZ#2021443
- Upstream release FreeIPA 4.8.7
- Require new samba build 4.12.3-0
Related: RHBZ#1818765
- New client-epn sub package
Resolves: RHBZ#913799
iso-codes-3.79-2.el8.noarch.rpm | - Upstream renamed README to README.md
- Update to 3.68
- Update to 1.6
- Updated spec to use recent macros
- Added needed BR: python3
- Update to 0.56
- Update to 3.10.3
- Update to 3.5.1
- Update to 1.2
- Update to 3.61
- Drop Group tag
- use %license macro
- Update to 3.76 version
- Update to 3.55
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Update to 3.66
- Upstream now providing json formatted iso-codes data
- Bump gettext BR
- Use the smaller .bz2 tarball
- Update to 2.1
- Update to 3.1
- Update to 3.38
- Update to 3.79 version (#1577820)
- Update to 3.77 version (#1516284)
- Update to 3.20
- Drop buildroot, %clean and cleaning buildroot in %install
- Update to 3.5
- Update to 3.63
- Update to 0.53
- Missing BR gettext
- Update to 3.56
- Update to 3.32.1
- Update to 1.7
- Update to 3.49
- Update to 3.25
- Update to 3.7
- Update to 3.13
- Update to 3.60
- Update to 3.51
- Update to 3.53
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Update to 3.74
- Update to 3.31
- Update to 3.12
- Update to 3.21
- Update to 3.36
- Update to 3.30
- Update to 3.24
- Update to 3.24.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Update to 3.34
- Update to 3.46
- Update to 3.10.1
- Update to 3.64
- Update to 3.65
- Update to 3.35
- Update to 0.49
- Update to 0.47
- Update to 3.37
- Update to 3.10.2
- Update to 3.14
- Update to 3.11.1
- Update to 3.72
- Update to 3.32.2
- bump the spec for missing updated sources
- Update to 3.8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Update to 3.15
- Initial RPM
- Update to 3.59
- Update to 3.62
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Update to 3.44
- Update to 3.42
- Update to 3.22
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to 2.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Update to 3.12.1
- Update to 3.29
- Update to 3.75 version
- Update to 3.70
- Update to 3.69
- Update to 3.23
- The .pc file should be installed in %{_datadir} instead of %{_libdir}
since this is a noarch package. 64bit platforms will otherwise look in
the 64bit version of the %{_libdir} and not find the .pc file and
cause them to not find iso-codes
- Update to 3.47
- Update to 3.28
- Update to 3.17
- Upstream stopped providing iso_639.tab file since 3.9 release,
so remove it from %files.
- Update to 1.5
- Update to 3.58
- Update to 1.0
- Update to 3.27
- Update to 3.25.1
- Update to 3.40
- rebuilt
- Update to 3.33
- Update to 3.43
- Update to 3.50
- Update to 3.45
- Update to 3.54
- Update to 3.41
- Update to 3.19
- Update to 3.24.2
- Update to 1.3
- Update the license field
- Use %find_lang for translations
- Don't create debuginfo
- Update to 3.18
- Update to 3.27.1
- Update to 3.52
- Update to 3.39
- Update to 3.32
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Update to 3.71
- Update to 1.4
- Update to 1.8
- Update to 3.10
- Update to 3.6
- Update to 3.57
- Update to 3.11
- Update to 1.9
- Update to 3.67
- LICENSE renamed to COPYING file
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update to 3.73
- Resolves:rh#1615536: iso-codes FTBFS for missing BR:python3-devel
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Update to 3.3.
- Address minor issues in merge review (#225918): update %description,
don't use %makeinstall, drop unneeded %debug_package override, use
parallel build.
- Update to 3.16
- Update to 3.48
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
kernel-4.18.0-553.89.1.el8_10.x86_64.rpm | - Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)
kernel-core-4.18.0-553.89.1.el8_10.x86_64.rpm | - Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)
kernel-modules-4.18.0-553.89.1.el8_10.x86_64.rpm | - Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
- Adding Rocky secure boot certs (Sherif Nagy)
- Fixing vmlinuz removal (Sherif Nagy)
- Fixing UEFI CA path (Sherif Nagy)
- Porting to 8.10, debranding and Rocky branding (Louis Abel)
- Fixing pesign_key_name values (Sherif Nagy)
krb5-pkinit-1.18.2-32.el8_10.x86_64.rpm | - incorporate upstream patch for remote crash of KDCs which serve multiple
realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800,
- Add recursion limit for ASN.1 indefinite lengths (CVE-2020-28196)
- Resolves: #1906492
- add draft fix from Tom Yu for slc_add_reply() buffer overflow (CAN-2005-0469)
- add draft fix from Tom Yu for env_opt_add() buffer overflow (CAN-2005-0468)
- update to 1.11.3
- drop patch for RT#7605, fixed in this release
- drop patch for CVE-2002-2443, fixed in this release
- drop patch for RT#7369, fixed in this release
- pull upstream fix for breaking t_skew.py by adding the patch for #961221
- add explicit build-time dependency on a version of keyutils that's new
enough to include keyctl_get_persistent() (more of #991148)
- make sure workstation servers are all disabled by default
- clean up krb5server init script
- rework file labeling patch to not depend on fragile preprocessor trickery,
in another attempt at fixing #428355 and friends
- pull in patches from master to not test GSSRPC-over-UDP and to not
depend on the portmapper, which are areas where our build systems
often give us trouble, too
- Explicitly look for python2 in configure.in
- back out buildrequires: keyutils-libs-devel for now
- add LSB-style init script info
- drop not-needed-since-1.8 build dependency on rsh (ssorce)
- build with -fstack-protector-all instead of the default -fstack-protector,
so that we add checking to more functions (i.e., all of them) (#629950)
- also link binaries with -Wl,-z,relro,-z,now (part of #629950)
- Drop DES3 from sample kdc.conf
- Resolves: #1802334
- apply patch to address MITKRB-SA-2006-001 (CVE-2006-3084)
- tweak graceful start/stop logic in post and preun
- fix bug ID in changelog
- patch ksu man page because the -C option never works
- add access() checks and disable debug mode in ksu
- modify default ksu build arguments to specify more directories in CMD_PATH
and to use getusershell()
- Backport soft-pkcs11 testing code
- Resolves: #1734158
- New upstream release (1.16)
- No changes from beta2
- Fix typo of crypto-policies file in previous version
- undo rename from krb5-pkinit-openssl to krb5-pkinit on EL6
- version the Obsoletes: on the krb5-pkinit-openssl to krb5-pkinit rename
- reintroduce the init scripts for non-systemd releases
- forward-port %{?_rawbuild} annotations from EL6 packaging
- incorporate fix for MITKRB5-SA-2014-001 (CVE-2014-4345)
- add buildprereq for autoconf
- correct some configuration file paths which the KDC_DIR patch missed
- fix license handling
- pull up fix for upstream #6745, in which the gssapi library would add the
wrong error table but subsequently attempt to unload the right one
- fix trigger scriptlet's invocation of sed (#1016945)
- attempt to account for UnversionedDocdirs for the -libs subpackage
- rename the krb5 package back to krb5-libs; the previous rename caused
something of an uproar
- update to 1.2.3, which includes the FTP and telnetd fixes
- configure without --enable-dns-for-kdc --enable-dns-for-realm, which now set
the default behavior instead of enabling the feature (the feature is enabled
by --enable-dns, which we still use)
- reenable optimizations on Alpha
- support more encryption types in the default kdc.conf (heads-up from post
to comp.protocols.kerberos by Jason Heiss)
- Replace _kadmin/_kprop with systemd macros
- Remove traces of upstart from fedora package per policy
- Resolves: #1290185
- Use responder for non-preauth AS requests
- Resolves: #1370622
- Set error message on KCM get_princ failure
- remove hesiod dependency at build-time
- mktemp was long obsoleted by coreutils
- add backport of in-development preauth module interface (#208643)
- update to 1.8.3
- drop backports of fixes for gss context expiration and error table
registration/deregistration mismatch
- drop patch for upstream #6750
- ftp: use the correct local filename during mget when the 'case' option is
enabled (#442713)
- make krb5-server-ldap also depend on the same version-release of krb5-libs,
as the other subpackages do, if only to make it clearer than it is when we
just do it through krb5-server
- drop explicit linking with libtinfo for applications that use libss, now
that readline itself links with libtinfo (as of readline-5.2-3, since
fedora 7 or so)
- go back to building without strict aliasing (compiler warnings in gssrpc)
- simplify the man pages patch by only preprocessing the files we care about
and moving shared configure.in logic into a shared function
- catch the case of ftpd printing file sizes using %i, when they might be
bigger than an int now
- add patch from Dhiru Kholia for the AES-NI implementations to allow
libk5crypto to be properly marked as not needing an executable stack
on arches where they're used (#1045699, and so many others)
- add upstream patch to fix freeing an uninitialized pointer and dereferencing
another uninitialized pointer in the KDC (MITKRB5-SA-2012-001, CVE-2012-1014
and CVE-2012-1015, #844779 and #844777)
- fix a thinko in whether or not we mess around with devel .so symlinks on
systems without a separate /usr (sbose)
- fix license tag
- update to 1.11 alpha 1
- drop backported patch for RT #7406
- drop backported patch for RT #7407
- drop backported patch for RT #7408
- the new docs system generates PDFs, so stop including them as sources
- drop backported patch to allow deltat.y to build with the usual
warning flags and the current gcc
- drop backported fix for disabling use of a replay cache when verifying
initial credentials
- drop backported fix for teaching PKINIT clients which trust the KDC's
certificate directly to verify signed-data messages that are signed with
the KDC's certificate, when the blobs don't include a copy of the KDC's
certificate
- drop backported patches to make keytab-based authentication attempts
work better when the client tells the KDC that it supports a particular
cipher, but doesn't have a key for it in the keytab
- drop backported fix for avoiding spurious clock skew when a TGT is
decrypted long after the KDC sent it to the client which decrypts it
- move the cross-referenced HTML docs into the -libs package to avoid
broken internal links
- drop patches to fixup paths in man pages, shouldn't be needed any more
- backport fixes to krb5_copy_context (RT#7807, #1044735/#1044739)
- override the default build rules to not delete temporary y.tab.c files,
so that they can be packaged, allowing debuginfo files which point to them
do so usefully (#729044)
- Move kdbversion info into -server for IPA (so we can rebase)
- Resolves: #1645594
- rebuild
- Backport OID mech fix
- Resolves: #1317609
- Update includedir processing to match upstream
- re-enable large file support, fell out in 1.3-1
- patch rcp to use long long and %lld format specifiers when reporting file
sizes on large files
- incorporate fixes for MITKRB5-SA-2007-006 (CVE-2007-3999, CVE-2007-4000)
- Make krb5-devel depend on libkadm5
- Resolves: #1364487
- Fix string RPC ACLs (RT#7093); CVE-2012-1012
- Don't check for write access on /etc/krb5.conf if SELinux
- Re-provide krb5-kdb-version in -devel as well (IPA wants it)
- Resolves: #1645594
- increase the maximum name length allowed by kuserok() to the higher value
used in development versions
- fix for potentially gzipped man pages
- gssapi: pull in upstream fix for a possible NULL dereference
in spnego (CVE-2014-4344)
- update to 1.6.3, dropping now-integrated patches for CVE-2007-3999
and CVE-2007-4000 (the new pkinit module is built conditionally and goes
into the -pkinit-openssl package, at least for now, to make a buildreq
loop with openssl avoidable)
- rebuilt
- rebuilt with new openssl
- Ignore bad enctypes in krb5_string_to_keysalts()
- Resolves: #1858322
- Make krb5kdc.log not world-readable by default
- Resolves: #1276484
- build shared libraries with partial RELRO support (#723995)
- filter out potentially multiple instances of -Wl,-z,relro from krb5-config
output, now that it's in the buildroot's default LDFLAGS
- pull in a patch to fix losing track of the replay cache FD, from SVN by
way of Kevin Coffman
- install src/krb524/README as README.krb524 in the -servers package,
includes information about converting for AFS principals
- explicitly run the pdf generation script using sh (part of #225974)
- rebuild in new environment
- reenable statglue
- add patch to correct GSSAPI library null pointer dereference which could be
triggered by malformed client requests (CVE-2010-1321, #582466)
- incorporate revised fixes from Tom Yu for CAN-2004-0642, CAN-2004-0644,
CAN-2004-0772
- New upstream beta version
- update to 1.6.1
- drop no-longer-needed patches for CVE-2007-0956,CVE-2007-0957,CVE-2007-1216
- drop patch for sendto bug in 1.6, fixed in 1.6.1
- specify dependencies on the same arch of krb5-libs by using the %{?_isa}
suffix, to avoid dragging 32-bit libraries onto 64-bit systems (#980155)
- Switch to python3-sphinx for docs
- Resolves: #1590928
- pull in fix from master to return a NULL pointer rather than allocating
zero bytes of memory if we read a zero-length input token (RT#7794, part of
- pull in fix from master to ignore an empty token from an acceptor if
we've already finished authenticating (RT#7797, part of #1043962)
- pull in fix from master to avoid a memory leak when a mechanism's
init_sec_context function fails (RT#7803, part of #1043962)
- pull in fix from master to avoid a memory leak in a couple of error
cases which could occur while obtaining acceptor credentials (RT#7805, part
of #1043962)
- Match Heimdal behavior for channel bindings
- Code hygiene + test stability fix included
- Resolves: #1840518
- initial update to 1.6, pre-package-reorg
- move workstation daemons to a new subpackage (#81836, #216356, #217301), and
make the new subpackage require xinetd (#211885)
- update to 1.4
- v1.4 kadmin client requires a v1.4 kadmind on the server, or use the "-O"
flag to specify that it should communicate with the server using the older
protocol
- new libkrb5support library
- v5passwdd and kadmind4 are gone
- versioned symbols
- pick up $KRB5KDC_ARGS from /etc/sysconfig/krb5kdc, if it exists, and pass
it on to krb5kdc
- pick up $KADMIND_ARGS from /etc/sysconfig/kadmin, if it exists, and pass
it on to kadmind
- pick up $KRB524D_ARGS from /etc/sysconfig/krb524, if it exists, and pass
it on to krb524d *instead of* "-m"
- set "forwardable" in [libdefaults] in the default krb5.conf to match the
default setting which we supply for pam_krb5
- set a default of 24h for "ticket_lifetime" in [libdefaults], reflecting the
compiled-in default
- ensure that the gssapi library's been initialized before walking the
internal mechanism list in gss_release_oid(), needed if called from
gss_release_name() right after a gss_import_name() (#198092)
- rebuild
- rename the krb5-libs package to krb5 (naming a subpackage -libs when there
is no main package is silly)
- move defaults for PAM to the appdefaults section of krb5.conf -- this is
the area where the krb5_appdefault_* functions look for settings)
- disable statglue (warning: breaks binary compatibility with previous
packages, but has to be broken at some point to work correctly with
unpatched versions built with newer versions of glibc)
- pull in upstream fix to start treating a KRB5CCNAME value that begins
with DIR:: the same as it would a DIR: value with just one ccache file
in it (RT#7172, #965574)
- fixup URL in a comment
- when built with NSS, require 3.12.10 rather than 3.12.9
- provide docs in PDF format instead of as tex source (Enrico Scholz, #209943)
- convert to systemd
- update to 1.2.7
- disable use of tcl
- update to 1.12.2
- drop patch for RT#7820, fixed in 1.12.2
- drop patch for #231147, fixed as RT#3277 in 1.12.2
- drop patch for RT#7818, fixed in 1.12.2
- drop patch for RT#7836, fixed in 1.12.2
- drop patch for RT#7858, fixed in 1.12.2
- drop patch for RT#7924, fixed in 1.12.2
- drop patch for RT#7926, fixed in 1.12.2
- drop patches for CVE-2014-4341/CVE-2014-4342, included in 1.12.2
- drop patch for CVE-2014-4343, included in 1.12.2
- drop patch for CVE-2014-4344, included in 1.12.2
- drop patch for CVE-2014-4345, included in 1.12.2
- replace older proposed changes for ksu with backports of the changes
after review and merging upstream (#1015559, #1026099, #1118347)
- patch mkdir/rmdir problem in ftpcmd.y
- add condrestart option to init script
- split the server init script into three pieces and add one for kpropd
- tweak statglue.c to fix stat/stat64 aliasing problems
- be cleaner in use of gcc to build shlibs
- Support KDC_ERR_MORE_PREAUTH_DATA_REQUIRED (RT#8063)
- Add pkinit_anchors default value to krb5.conf
- Reindent krb5.conf to not be terrible
- Support PAC with KDC extended signature and without ticket signature
- Resolves: rhbz#2169477
- update to 1.3.3
- debloat
- update to 1.11 beta 1
- Merge krb5-configs back into krb5-libs. The krb5.conf file is marked as
a %config file anyway.
- Make krb5.conf a noreplace config file.
- apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (#218456)
- apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (#218456)
- fix a regression (not labeling a kdb database lock file correctly, #569902)
- correctly use stdargs
- Zap copy of secret in RC4 string-to-key
- kadmind: add upstream patch to fix free() on an invalid pointer (#696343,
MITKRB5-SA-2011-004, CVE-2011-0285)
- apply patch from MITKRB5-SA-2004-001 (#125001)
- add patch to support "ANY" keytab type (i.e.,
"default_keytab_name = ANY:FILE:/etc/krb5.keytab,SRVTAB:/etc/srvtab"
patch from Gerald Britton, #42551)
- build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (#30697)
- patch ftpd to use long long and %lld format specifiers to support the SIZE
command on large files (also #30697)
- don't use LOG_AUTH as an option value when calling openlog() in ksu (#45965)
- implement reload in krb5kdc and kadmind init scripts (#41911)
- lose the krb5server init script (not using it any more)
- incorporate patch to fix double-free in the KDC (CVE-2010-1320, #581922)
- Add support for start_realm cache config
- Resolves: #1901195
- make krb5-config suppress CFLAGS output when called with --libs (#544391)
- add patch included in MITKRB5-SA-2003-003 (CAN-2003-0028)
- Do not block HMAC-MD4/5 in FIPS mode
Resolves: RHEL-86786
- Don't issue RC4 session keys by default (CVE-2025-3576)
Resolves: RHEL-88049
- Add PKINIT paChecksum2 from MS-PKCA v20230920
Resolves: RHEL-82648
- add man pages for kerberos(1), kvno(1), .k5login(5)
- add kvno to -workstation
- update to 1.4.1, incorporating fixes for CAN-2005-0468 and CAN-2005-0469
- when starting the KDC or kadmind, if KRB5REALM is set via the /etc/sysconfig
file for the service, pass it as an argument for the -r flag
- back out this labeling change (dwalsh):
- when building the new label for a file we're about to create, also mix
in the current range, in addition to the current user
- update to 1.2.6
- fix configure stuff for ia64
- fix telnet client environment variable disclosure the same way NetKit's
telnet client did (CAN-2005-0488) (#159305)
- keep apps which call krb5_principal_compare() or krb5_realm_compare() with
malformed or NULL principal structures from crashing outright (Thomas Biege)
(#161475)
- libgssapi_krb5: backport fix for some errors which can occur when
we fail to set up the server half of a context (CVE-2009-0845)
- remove hashless key types from the default kdc.conf, they're not supposed to
be there, noted by Sam Hartman on krbdev
- try to make gss_krb5_copy_ccache() work correctly for spnego (#542868)
- Depend on crypto-policies which provides /etc/krb5.conf.d (#1225792)
- pull a fix from SVN to try to avoid triggering a PTR lookup in getaddrinfo()
during krb5_sname_to_principal(), and to let getaddrinfo() decide whether or
not to ask for an IPv6 address based on the set of configured interfaces
(#717378, RT#6922)
- pull a fix from SVN to use AI_ADDRCONFIG more often (RT#6923)
- incorporate upstream patch to fix uninitialized pointer crash in the KDC's
authorization data handling (CVE-2010-1322, #636335)
- Use openssl's PRNG in FIPS mode
- Resolves: #1663571
- allocate space for the nul-terminator in the local pathname when looking up
a file context, and properly free a previous context (Jose Plans, #426085)
- fix for CVE-2014-5355 (#1193939) "krb5: unauthenticated
denial of service in recvauth_common() and others"
- pass absolute path to kadm5.keytab if/when extracting keys at startup
- switch to the simplified version of the patch for #1029110 (RT#7764)
- Omit KDC indicator check for S4U2Self requests
- Resolves: #1802334
- ftp: add patch to fix "runique on" case when globbing fixes applied
- stop adding a redundant but harmless call to initialize the gssapi internals
- fix a typo in a ksu error message (Marek Mahut)
- "rev" works the way the test suite expects now, so don't disable tests
that use it
- actually pull up the patch for RT#7063, and not some other ticket (#773496)
- Fix kprop for propagating dump files larger than 4GB
- Resolves: #2026462
- apply fixes from draft of MIT-KRB5-SA-2005-002 (CAN-2005-1174,CAN-2005-1175)
(#157104)
- apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (#159755)
- Fix problem with ccache_name logic in previous build
- Fix arch name (ppc64le, not ppc64el)
- Related-to: #1464381
- fix 32/64-bit bug storing and retrieving the issue_date in v4 credentials
- Use standard trigger logic for krb5 snippet
- Address some optimized-out memset() calls
- Resolves: #1663503
- apply kpasswd bug fixes from David Wragg
- fix bug in krb5.csh which would cause the path check to always succeed
- Fix a leak in the previous commit
- Restore dist macro that was accidentally removed
- Resolves: #1540939
- fix reading of keyUsage extensions when attempting to select pkinit client
certs (part of #629022, RT#6775)
- fix selection of pkinit client certs when one or more don't include a
subjectAltName extension (part of #629022, RT#6774)
- Fix backward check in kprop.service
- move to using pregenerated PDF docs to cure multilib conflicts (#222721)
- temporarily back out %post changes, fix for #143289 for security update
- add preliminary patch to correct unauthorized access via krb5-aware telnet
- fix globbing patch port mode (#139075)
- Allow verification of attributes on krb5.conf
- fix a logic bug in computing key expiration times (RT#6762, #627022)
- include profile.d scriptlets in krb5-devel so that krb5-config will be in
the path if krb5-workstation isn't installed, reported by Kir Kolyshkin
- Correct copyright: it's exportable now, provided the proper paperwork is
filed with the government.
- backed out ncurses and makeshlib patches
- update for krb5-1.1
- add KDC rotation to rc.boot, based on ideas from Michael's C version
- update to beta2
- drop obsolete backports for storing KDC time offsets and expiration times
in keyring credential caches
- fix bug in patch to make rlogind start login with a clean environment a la
netkit rlogin, spotted and fixed by Scott McClung
- Disable dns_canonicalize_hostname. This may break some setups.
- automated rebuild
- patch to handle truncated dns responses
- pull in upstream patch for RT#6952, confusion following referrals for
cross-realm auth (#734341)
- pull in build-time deps for the tests
- revert that last change for a bit while sorting out execstack when we
use AES-NI (#1045699)
- Eliminate preprocessor-disabled dead code
- rebuild
- on EL6, conflict with libsmbclient before 3.5.10-124, which is when it
stopped linking with a symbol which we no longer export (#771687)
- pull up patch for RT#7063, in which not noticing a prompt for a long
time throws the client library's idea of the time difference between it
and the KDC really far out of whack (#773496)
- add a backport of more patches to set the client's list of supported enctypes
when using a keytab to be the list of types of keys in the keytab, plus the
list of other types the client supports but for which it doesn't have keys,
in that order, so that KDCs have a better chance of being able to issue
tickets with session keys of types that the client can use (#837855)
- Patch CVE-2015-2698
- rebuilt
- include .so.* symlinks as well as .so.*.*
- rebuild in new environment
- update to 1.9 final
- pull up the change to make kpasswd's behavior better match the docs
when there's no ccache (#563431)
- Process included directories in alphabetical order
- krb5_get_init_creds_password: check opte->flags instead of options->flags
when checking whether or not we get to use the prompter callback (#555875)
- Don't enable the server by default.
- Compress info pages.
- Add defaults for the PAM module to krb5.conf
- fix for CVE-2014-5352 (#1179856) "gss_process_context_token()
incorrectly frees context (MITKRB5-SA-2015-001)"
- fix for CVE-2014-9421 (#1179857) "kadmind doubly frees partial
deserialization results (MITKRB5-SA-2015-001)"
- fix for CVE-2014-9422 (#1179861) "kadmind incorrectly
validates server principal name (MITKRB5-SA-2015-001)"
- fix for CVE-2014-9423 (#1179863) "libgssrpc server applications
leak uninitialized bytes (MITKRB5-SA-2015-001)"
- backport the callback to use the libkrb5 prompter when we can't load PEM
files for PKINIT (RT#7590, includes part of #965721/#1016690)
- extract the rest of the fix #965721/#1016690 from the changes for RT#7680
- update to 1.6.2
- add "buildrequires: texinfo-tex" to get texi2pdf
- spnego: pull in patch from master to restore preserving the OID of the
mechanism the initiator requested when we have multiple OIDs for the same
mechanism, so that we reply using the same mechanism OID and the initiator
doesn't get confused (#1066000, RT#7858)
- update to 1.4.3
- make ksu setuid again (#137934, others)
- when testing the RPC library, treat denials from the local portmapper the
same as a portmapper-not-running situation, to allow other library tests
to be run while building the package
- add patch based on one from Filip Krska to not call poll() with a negative
timeout when the caller's intent is for us to just stop calling it (#838548)
- Work around KDC client prinicipal in referrals issue (#1259844)
- update to beta 1
- Patch build by disabling failing test; will fix properly soon
- move the package changelog to the end to match the usual style (jdennis)
- scrub out references to $RPM_SOURCE_DIR (jdennis)
- include a symlink to the readme with the name LICENSE so that people can
find it more easily (jdennis)
- Use SHA-256 instead of MD5 for audit ticket IDs
- run kadmin.local correctly at startup
- automated rebuild
- rename krb5.sh and krb5.csh so that they don't overlap (#210623)
- way-late application of added error info in kadmind.init (#65853)
- Bump 1%{?dist} to 2%{?dist} to workaround RPM sort issue
which would lead yum updates to treat the last alpha as newer
than the final version.
- Use the correct patches this time.
- Resolves: #1321135
- Fix incorrect recv() size calculation in libkrad
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- update backport of the preauth module interface
- add proposed patches 4566, 4567
- add proposed edata reporting interface for KDC
- add temporary placeholder for module global context fixes
- Rebuilt for gcc bug 634757
- Set error message on KCM get_princ failure
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- drop a patch we weren't not applying (build tooling)
- wrap kadmind and kpropd in scripts which check for the presence/absence
of files which dictate particular exit codes before exec'ing the actual
binaries, instead of trying to use ConditionPathExists in the unit files
to accomplish that, so that we exit with failure properly when what we
expect isn't actually in effect on the system (#800343)
- Add patch to fix Redhat Bug #1227542 ("[SELinux] AVC denials may appear
when kadmind starts"). The issue was caused by an unneeded |htons()|
which triggered SELinux AVC denials due to the "random" port usage.
- move man pages that live in the -libs subpackage into the regular
%{_mandir} tree where they'll still be found if that package is the
only one installed (#529319)
- drop krshd patch for now
- handle releases where texlive packaging wasn't yet as complicated as it
is in Fedora 18
- fix an uninitialized-variable error building one of the test programs
- fix link flags and permissions on shared libraries (ausil)
- merge security fixes from RHSA-2007:0095
- add missing shebang headers to krsh and krlogin wrapper scripts (#209238)
- add an xinetd configuration file for encryption-only telnetd, parallelling
the kshell/ekshell pair (#167535)
- Backport fix for GSSAPI fallback realm
- Full FIPS compliance
- Resolves: #1754690
- New upstream version (1.18.1)
- Resolves: #1802334
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- update to 1.5
- fix deadlock during file transfer via rsync/krsh
- thanks goes to James Antill for hint
- rebuild
- add patch from Mark Cox for exploitable bugs in ftp client
- rebuilt
- Backport fix for chrome crash in spnego_gss_inquire_context
- Resolves: #1295893
- backport fix for not being able to verify the list of transited realms
in GSS acceptors (RT#7639, #959685)
- backport fix for not being able to pass an empty password to the
get-init-creds APIs and have them actually use it (RT#7642, #960001)
- add backported proposed fix to use the unauthenticated server time
as the basis for computing the requested credential expiration times,
rather than the client's idea of the current time, which could be
significantly incorrect (#961221)
- Add free hook to KDB; increments KDB version
- Add KDB version flag
- fix for CVE-2014-5353 (#1174543) "Fix LDAP misused policy
name crash"
- switch to the upstream patch for #727829
- Fix use of KKDCPP with SNI
- Resolves: #1365027
- add upstream patches to fix standalone kpropd exiting if the per-client
child process exits with an error (MITKRB5-SA-2011-001), a hang or crash
in the KDC when using the LDAP kdb backend, and an uninitialized pointer
use in the KDC (MITKRB5-SA-2011-002) (CVE-2010-4022, #664009,
CVE-2011-0281, #668719, CVE-2011-0282, #668726, CVE-2011-0283, #676126)
- make use of install-info more failsafe (Ville Skyttä, #223704)
- preserve timestamps on shell scriptlets at %install-time
- update to 1.13 alpha1
- drop upstreamed and backported patches
- pull in fix to store KDC time offsets in keyring credential caches (RT#7768,
- pull in fix to set expiration times on credentials stored in keyring
credential caches (RT#7769, #1031724)
- add documentation for the ticket_lifetime option (#561174)
- Fix memory leak in GSSAPI interface
Resolves: RHEL-27250
- Fix memory leak in PMAP RPC interface
Resolves: RHEL-27244
- Make TCP waiting time configurable
Resolves: RHEL-17131
- Fix leaks in gss_inquire_cred_by_oid()
- automatic rebuild
- pull up patch to get the client libraries to correctly perform password
changes over IPv6 (Sumit Bose, RT#6661)
- fix the kpropd init script
- Remove "-nodes" option from make-certs scripts
- Be more careful asking for AS key in SPAKE client
- disable servers by default to keep linuxconf from thinking they need to be
started when they don't
- move the rather large pile of html and pdf docs to -workstation, so
that just having something that links to the libraries won't drag
them onto a system, and we avoid having to sort out hard-coded paths
that include %{_libdir} showing up in docs in multilib packages
- actually create %{_var}/kerberos/kdc/user, so that it can be packaged
- correct the list of packaged man pages
- don't dummy up required tex stylesheets, require them
- require pdflatex and makeindex
- bump again for double-long bug on ppc(64)
- Fix leak of default credentials in gss_inquire_cred()
Resolves: RHEL-32258
- Backport kdc policy plugin, but this time with dependencies
- add in glue code to make sure that libkrb5 continues to provide a
weak copy of stat()
- if the init script fails to start krb5kdc/kadmind/kpropd because it's already
running (according to status()), return 0 (part of #521772)
- rebuild
- fix conditional for future RHEL
- krb5kdc init script: prototype some changes to do a quick spot-check
of the TGS and kadmind keys and warn if there aren't any non-weak keys
on file for them (to flush out parts of #651466)
- tweak configuration files used during tests to try to reduce the number
of conflicts encountered when builds for multiple arches land on the same
builder
- add upstream patch for KDC crash during referral processing (CVE-2009-3295),
via Tom Yu (#545002)
- prefer the kdc which last replied to a request when sending requests to kdcs
- pull the changing of the compiled-in default ccache location to
DIR:/run/user/%{uid}/krb5cc back into F19, in line with SSSD and
the most recent pam_krb5 build
- Fix some broken tests for Python 3
- use PICFLAGS when building code from the ktany patch
- fix an uninitialized length value which could cause a crash when parsing
key data coming from a directory server
- correct a typo in the krb5.conf man page ("ldap_server"->"ldap_servers")
- Use system nss_wrapper and socket_wrapper for testing.
Patch by Andreas Schneider
- removed rpath
- give a little bit more information to the user when kinit gets the catch-all
I/O error (#180175)
- Fix RC4 blocking in FIPS mode
- Resolves: #1660222
- throw in a not-applied-by-default patch to try to make pkinit debugging
into a run-time boolean option named "pkinit_debug"
- Backport upstream certauth EKU fixes
- broke out configuration files
- add patch for buffer overflow in kadmind4 (not used by default)
- libkrad: implement support for Message-Authenticator (CVE-2024-3596)
Resolves: RHEL-50253
- Remove RSA protocol for PKINIT
Resolves: RHEL-17616
- change a LINE_MAX to 1024, fix from Ken Raeburn
- add fix for login vulnerability in case anyone rebuilds without krb4 compat
- add tweaks for byte-swapping macros in krb.h, also from Ken
- add xinetd config files
- make rsh and rlogin quieter
- build with debug to fix credential forwarding
- add rsh as a build-time req because the configure scripts look for it to
determine paths
- rebuild with OpenSSL 1.1.0, added backported upstream patch
- Tom Yu's patch to fix compatibility between 1.2 kadmin and 1.1.1 kadmind
- pull out 6.2 options in the spec file (sonames changing in 1.2 means it's not
compatible with other stuff in 6.2, so no need)
- pull in patch from master to move the default directory which the KDC uses
when computing the socket path for a local OTP daemon from the database
directory (/var/kerberos/krb5kdc) to the newly-added run directory
(/run/krb5kdc), in line with what we're expecting in 1.13 (RT#7859, more
of #1040056 as #1063905)
- add a tmpfiles.d configuration file to have /run/krb5kdc created at
boot-time
- own /var/run/krb5kdc
- gssapi: pull in proposed fix for a double free in initiators (David
Woodhouse, CVE-2014-4343, #1117963)
- and put it back in
- update to 1.2.5
- disable statglue
- remove rc4-hmac:norealm and rc4-hmac:onlyrealm from the default list of
supported keytypes in kdc.conf -- they produce exactly the same keys as
rc4-hmac:normal because rc4 string-to-key ignores salts
- nuke kdcrotate -- there are better ways to balance the load on KDCs, and
the SELinux policy for it would have been scary-looking
- update to 1.3.5, mainly to include MITKRB5SA 2004-002 and 2004-003
- apply second set of buffer overflow fixes from Tom Yu
- fix from Dirk Husung for a bug in buffer cleanups in the test suite
- work around possibly broken rev binary in running test suite
- move default realm configs from /var/kerberos to %{_var}/kerberos
- add preliminary patch to fix buffer overflow in krb5kdc and kadmind
(#231528, CVE-2007-0957)
- add preliminary patch to fix double-free in kadmind (#231537, CVE-2007-1216)
- don't let comments intended for one scriptlet become part of the "script"
that gets passed to ldconfig as part of another one (Mattias Ellert, #1005675)
- Explicitly require python2 packages
- Add upstream lookaside cache behavior fix (RT#7082)
- apply Mike Friedman's patch to fix format string problems
- don't strip off argv[0] when invoking regular rsh/rlogin
- Include fixes for previous commit
- Resolves: #1433083
- Skip test suite on ppc64el
- Related-to: #1464381
- Fix integer overflows in PAC parsing (CVE-2022-42898)
- Resolves: rhbz#2140968
- Fix FTBFS by no longer working around bug in nss_wrapper
- move initscript back
- enable patch for key-expiration reporting
- enable patch to make kpasswd fall back to TCP if UDP fails (#251206)
- enable patch to make kpasswd use the right sequence number on retransmit
- enable patch to allow mech-specific creds delegated under spnego to be found
when searching for creds
- Turn OFD locks back on with glibc workaround
- Resolves: #1274922
- fix indexing error in server sorting patch (#127336)
- move /etc/pam.d/ksu from krb5-workstation-servers to krb5-workstation,
where it's actually needed (#538703)
- add currently-proposed changes to teach ksu about credential cache
collections and the default_ccache_name setting (#1015559,#1026099)
- make proper use of pam_loginuid and pam_selinux in rshd and ftpd
- rebuild in new environment
- fix a type mismatch in krb5_copy_error_message()
- ftp: fix some odd use of strlen()
- selinux labeling: use selabel_open() family of functions rather than
matchpathcon(), bail on it if attempting to get the mutex lock fails
- go back to not messing with library file paths on Fedora 17: it breaks
file path dependencies in other packages, and since Fedora 17 is already
released, breaking that is our fault
- pass -Wl,--warn-shared-textrel to the compiler when we're creating shared
libraries
- create and own /etc/gss (#1019937)
- force -fPIC
- CVE-2024-37370 CVE-2024-37371
Fix vulnerabilities in GSS message token handling
Resolves: RHEL-45398 RHEL-45386
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Backport getrandom() support
- Remove patch numbering
- Update tmpfiles dropin to use /run instead of /var/run
- Resolves: #1945679
- Make klogind pass a clean environment to children, like NetKit's rlogind does.
- add some comments to the ksu patches for the curious
- re-enable optimization on alphas
- Support config snippets in /etc/krb5.conf.d/ and /usr/share/krb5.conf.d/
(#1225792, #1146370, #1145808)
- Fix CVE-2015-8629, CVE-2015-8630, CVE-2015-8631
- update to 1.11 release
- drop patch to suppress key expiration warnings sent from the KDC in
the last-req field, as the KDC is expected to just be configured to either
send them or not as a particular key approaches expiration (#556495)
- pkinit: when verifying signed data, use the CMS APIs for better
interoperability (#636985, RT#6851)
- change /usr/dict/words to /usr/share/dict/words in default kdc.conf (#20000)
- only remove old krb5server init script links if the init script is there
- turn on NSS as the backend for libk5crypto, adding nss-devel as a build
dependency when that switch is flipped
- add patch from Tom Yu to fix ftpd overflows (#37731)
- Add libverto-devel requires for krb5-devel
- Add otp support
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- ksu: move session management calls to before we drop privileges, like
su does (#596887), and don't skip the PAM account check for root or the
same user (more of #540769)
- fix a memory leak when acquiring credentials using a keytab (RT#7586, #911110)
- Add German translation
- move the default acl_file, dict_file, and admin_keytab settings to
the part of the default/example kdc.conf where they'll actually have
an effect (#236417)
- start moving to 1.9 with beta 1
- drop patches for RT#5755, RT#6762, RT#6774, RT#6775
- drop no-longer-needed backport patch for #539423
- drop no-longer-needed patch for CVE-2010-1322
- if WITH_NSS is set, built with --with-crypto-impl=nss (requires NSS 3.12.9)
- don't forget the README
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- rebuilt
- add patch to fix server-side crashes when principals have no
components (CAN-2003-0072)
- started changelog (previous package from zedz.net)
- updated existing 1.0.5 RPM from Eos Linux to krb5 1.0.6
- added --force to makeinfo commands to skip errors during build
- Backport KCM performance enablements
- Resolves: #1956388
- add some minimal description to the top of the wrapper scripts we use
when starting krb5kdc and kadmind to describe why they exist (tooling)
- update to 1.9.1:
- drop no-longer-needed patches for CVE-2010-4022, CVE-2011-0281,
CVE-2011-0282, CVE-2011-0283, CVE-2011-0284, CVE-2011-0285
- Re-enable test suite on ppc64le (no other changes)
- catch krb4 send_to_kdc cases in kdc preference patch
- prereq chkconfig for the server subpackage
- Update otp backport patches (libk5radius => libkrad)
- Use "new" systemd macros for service handling. (Thanks vpavlin!)
- Resolves: #850399
- set SS_LIB at configure-time so that libss-using apps get working readline
support (#197044)
- revise previous patch to initialize one more element
- add patch to correct unauthorized access via krb5-aware telnet
daemon (#229782, CVE-2007-0956)
- add patch to fix buffer overflow in krb5kdc and kadmind
(#231528, CVE-2007-0957)
- add patch to fix double-free in kadmind (#231537, CVE-2007-1216)
- pass some structures by address instead of on the stack in krb5kdc
- update to latest patch kit for MITKRB5-SA-2003-004
- New upstream beta version
- selinux: hang on to the list of selinux contexts, freeing and reloading
it only when the file we read it from is modified, freeing it when the
shared library is being unloaded (#845125)
- fix output of kprop's init script's "status" and "reload" commands (#588222)
- create and own /var/kerberos/krb5/user instead of /var/kerberos/kdc/user,
since that's what the libraries actually look for
- add buildrequires on nss-myhostname, in an attempt to get more of the tests
to run properly during builds
- pull in Simo's patch to recognize "client_keytab" as a key type which can
be passed in to gss_acquire_cred_from() (RT#7598)
- when iterating over lists of interfaces which are "up" from getifaddrs(),
skip over those which have no address (#113347)
- Separate out the kadm5 libs
- add LDCOMBINE=-lc to configure invocation to use libc versioning (bug #10653)
- change Requires: for/in subpackages to include %{version}
- Fix KDC null deref on TGS inner body null server (CVE-2021-37750)
- Resolves: #1997601
- rebuilt
- switch to the updated patch for MITKRB-SA-2006-001
- Add kprop service env config file
- update to 1.12 final
- stop exporting kadmin keys to a keytab file when kadmind starts -- the
daemon's been able to use the database directly for a long long time now
- belatedly add aes128,aes256 to the default set of supported key types
- tag a couple of other patches which we still need to be applied during
%{?_rawbuild} builds (zmraz)
- change cleanup code in post to not tickle chkconfig
- add grep as a Prereq: for -libs
- Add SPAKE support
- Improve protections on internal sensitive buffers
- Improve internal hex encoding/decoding
- Rebuilt for glibc bug#747377
- update to 1.8
- temporarily bundling the krb5-appl package (split upstream as of 1.8)
until its package review is complete
- profile.d scriptlets are now only needed by -workstation-clients
- adjust paths in init scripts
- drop upstreamed fix for KDC denial of service (CVE-2010-0283)
- drop patch to check the user's password correctly using crypt(), which
isn't a code path we hit when we're using PAM
- Fix configuration of default ccache name to match file indentation
- rebuild
- Fix leak in KERB_AP_OPTIONS_CBT server support
- Resolves: #1860831
- Add hostname-based ccselect module
- Resolves: #1463665
- Document -k option in kvno(1) synopsis
- Resolves: #1869055
- use %{_lib} for the sake of multilib systems
- fix for kinit -C loops (#1184629, MIT/krb5 issue 243, "Do not
loop on principal unknown errors").
- Added "python-sphinx-latex" to the build requirements
to fix build failures on F22 machines.
- own the directories which are created for each package (#26342)
- update to 1.2.1
- back out Tom Yu's patch, which is a big chunk of the 1.2 -> 1.2.1 update
- start using the official source tarball instead of its contents
- TEMPORARILY disable usage of OFD locks as a workaround for x86
- rebuild
- disable optimizations on the alpha again
- change back dns_lookup_kdc to the default setting (Stef Walter, #805318)
- comment out example.com examples in default krb5.conf (Stef Walter, #805320)
- put the conditional back for the -devel subpackage
- back down to the earlier version of the patch for #551764; the backported
alternate version was incomplete
- FIPS: disable 3DES and ed25519
- Resolves: #1616326
- Add BuildRequires on python2 so we can run tests at build-time
- build without -g3, which gives us large static libraries in -devel
- Backport my interposer fixes from upstream
- Supersedes krb5-mechglue_inqure_attrs.patch
- Add build dependency on gcc
- add yasm as a build requirement for AES-NI support, on arches that have
yasm and AES-NI
- New upstream release
- Update names and numbers to match external git
- make ksu and v4rcp owned by root
- prevent spurious EBADF in krshd when stdin is closed by the client while
the command is running (#151111)
- update to 1.7
- no need to work around build issues with ASN1BUF_OMIT_INLINE_FUNCS
- configure recognizes --enable/--disable-pkinit now
- configure can take --disable-rpath now
- no more libdes425, krb524d, krb425.info
- kadmin/k5srvutil/ktutil are user commands now
- new kproplog
- FAST encrypted-challenge plugin is new
- drop static build logic
- drop pam_krb5-specific configuration from the default krb5.conf
- drop only-use-v5 flags being passed to various things started by xinetd
- put %{krb5prefix}/sbin in everyone's path, too (#504525)
- fix combination of --with-netlib and --enable-dns (#82176)
- add upstream patch for integer underflow during AES and RC4 decryption
(CVE-2009-4212), via Tom Yu (#545015)
- update to 1.11.2
- drop pulled in patch for RT#7586, included in this release
- drop pulled in patch for RT#7592, included in this release
- pull in fix for keeping track of the message type when parsing FAST requests
in the KDC (RT#7605, #951843) (also #951965)
- try to merge and clean up all the large file support for ftp and rcp
- ftpd no longer prints a negative length when sending a large file
from a 32-bit host
- pull up fix for UDP ping-pong flaw in kpasswd service (CVE-2002-2443,
- silence compiler warning in kprop by using an in-memory ccache with a fixed
name instead of an on-disk ccache with a name generated by tmpnam()
- don't break during %check when the session keyring is revoked
- rebuild
- Gain FIPS awareness
- Resolves: #1660222
- New upstream release - 1.16.1
- Backport certauth plugin and related pkinit changes
- incorporate Simo's updated backport of his updated persistent-keyring changes
(more of #991148)
- rebuild
- Fix network service dependencies
- Resolves: #1525230
- Add PKINIT KDC support for freshness token
- update to 1.2.4
- update to 1.9 beta 3
- Log when non-root ksu authorization fails
- Resolves: #1575771
- Allow to make AD-SIGNEDPATH optional
Resolves: RHEL-10514
- rebuild
- fix a version comparison to expect newer texlive build requirements when
%{_rhel} > 6 rather than when it's > 7
- don't bail from the KDC init script if there's no database, it may be in
a different location than the default (fenlason)
- remove the [kdc] section from the default krb5.conf -- doesn't seem to have
been applicable for a while
- Ensure pwsize is initialized in chpass_util.c
- fix config_subpackage logic
- pull up changes to allow GSSAPI modules to provide more functions
(RT#7682, #986564/#986565)
- some init script cleanups
- drop unquoted check and silent exit for "$NETWORKING" (#426852, #242502)
- krb524: don't barf on missing database if it looks like we're using kldap,
same as for kadmin
- return non-zero status for missing files which cause startup to
fail (#242502)
- update to 1.12.1
- drop patch for RT#7794, included now
- drop patch for RT#7797, included now
- drop patch for RT#7803, included now
- drop patch for RT#7805, included now
- drop patch for RT#7807, included now
- drop patch for RT#7045, included now
- drop patches for RT#7813 and RT#7815, included now
- add patch to always retrieve the KDC time offsets from keyring caches,
so that we don't mistakenly interpret creds as expired before their
time when our clock is ahead of the KDC's (RT#7820, #1030607)
- cover more cases in labeling files on creation
- add missing gawk build dependency
- drop a hunk from the dnsparse patch which is actually redundant (thanks to
Tom Yu)
- back that last change out
- Remove outdated note in krb5kdc man page
- remove libdefault ticket_lifetime option from the default krb5.conf, it is
ignored by libkrb5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- take another stab at accounting for UnversionedDocdirs for the -libs
subpackage (spotted by ssorce)
- switch to just the snapshot of nss_wrapper we were using, since we
no longer need to carry anything that isn't in the cwrap.org repository
(ssorce)
- Up-port a bunch of stuff from the el-7.3 cycle
- Resolves: #1255450, #1314989
- pull down patches from trunk to implement k5login_authoritative and
k5login_directory settings for krb5.conf (#539423)
- rebuild
- Hammer refresh around transient rawhide issue
- pull fix for non-compliant encoding of salt field in etype-info2 preauth
data from 1.3.1 beta 1, until 1.3.1 is released.
- update to 1.8.1
- no longer need patches for #555875, #561174, #563431, RT#6661, CVE-2010-0628
- replace buildrequires on tetex-latex with one on texlive-latex, which is
the package that provides it now
- Fix argument order on strlcpy() in enctype_name()
- Resolves: #1754369
- incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772
(MITKRB5-SA-2004-002, #130732)
- incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, #130732)
- rebuild to compress man pages.
- if we successfully change the user's password during an attempt to get
initial credentials, but then fail to get initial creds from a non-master
using the new password, retry against the master (#432334)
- Restrict pre-authentication fallback cases
- Fix KCM client time offset propagation
- Resolves: #1738553
- update to 1.4.2, incorporating the fixes for MIT-KRB5-SA-2005-002 and
MIT-KRB5-SA-2005-003
- kadmind.init: drop the attempt to detect no-database-present errors (#723723),
which is too fragile in cases where the database has been manually moved or
is accessed through another kdb plugin
- rebuild
- update to 1.3
- Automatically add includedir where not present
- Try removing sleep statement to see if it is still needed
- Resolves: #1433083
- reintroduce ld.so.conf munging in the -libs %post
- handle an assertion failure that starts cropping up when the patch for
using poll (#701446) meets servers that aren't running KDCs or against
which the connection fails for other reasons (#727829, #734172)
- Backport interposer fix (#1284985)
- Drop workaround pwsize initialization patch (gcc has been fixed)
- Explicitly use openssl rather than builtin crypto
- Resolves: #1570910
- fix info page insertions
- Fix krb5kdf support and add proper openssl version requirements
- Resolves: #1754690
- configure --without-krb5-config so that we don't pull in the old default
ccache name when we want to stop setting a default ccache name at configure-
time
- pull the newer F21 defaults back to F20 (sgallagh)
- update backport of the preauth module interface (part of #194654)
- initial update to alpha1
- drop backport of persistent keyring support
- drop backport for RT#7689
- drop obsolete patch for fixing a use-before-init in a test program
- drop obsolete patch teaching config.guess/config.sub about aarch64-linux
- drop backport for RT#7598
- drop backport for RT#7172
- drop backport for RT#7642
- drop backport for RT#7643
- drop patches from master to not test GSSRPC-over-UDP and to not
depend on the portmapper, which are areas where our build systems
often give us trouble, too; obsolete
- drop backports for RT#7682
- drop backport for RT#7709
- drop backport for RT#7590 and partial backport for RT#7680
- drop OTP backport
- drop backports for RT#7656 and RT#7657
- BuildRequires: libedit-devel to prefer it
- BuildRequires: pkgconfig, since configure uses it
- OpenSSL has an epoch, apparently
- Resolves: #1754690
- rebase to master
- update to beta1
- drop obsolete backport of fix for RT#7706
- further munge krb5-config so that 'libdir=/usr/lib' is given even on 64-bit
architectures, to avoid multilib conflicts; other changes will conspire to
strip out the -L flag which uses this, so it should be harmless (#192692)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- apply the fix for CVE-2007-4000 instead of the experimental patch for
setting ok-as-delegate flags
- adjust the patch which removes the use of rpath to also produce a
krb5-config which is okay in multilib environments (#190118)
- make the name-of-the-tempfile comment which compile_et adds to error code
headers always list the same file to avoid conflicts on multilib installations
- strip SIZEOF_LONG out of krb5.h so that it doesn't conflict on multilib boxes
- strip GSS_SIZEOF_LONG out of gssapi.h so that it doesn't conflict on mulitlib
boxes
- Fix KDC null deref on bad encrypted challenge (CVE-2021-36222)
- Resolves: #1983729
- add patches from patchkit from MITKRB5-SA-2003-004 (CAN-2003-0138 and
CAN-2003-0139)
- login: don't truncate passwords before passing them into crypt(), in
case they're significant (#149476)
- switch to the upstream patch for #707145
- kpropd hasn't bothered with -S since 1.11; stop trying to use that flag
in the systemd unit file
- when removing -workstation, remove our files from the info index while
the file is still there, in %preun, rather than %postun, and use the
compressed file's name (#801035)
- kdc.conf: default to listening for TCP clients, too (#248415)
- New upstream release (1.18.2)
- Resolves: #1802334
- rebuild
- fix pid path in krb5kdc.service
- rebuild
- hardcode pid file as option in krb5kdc.service
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- backport fixes to teach libkrb5 to use descriptors higher than FD_SETSIZE
to talk to a KDC by using poll() if it's detected at compile-time (#701446,
RT#6905)
- Fix hex conversion of PKINIT certid strings
- rebuilt
- check more thoroughly for errors when resolving KEYRING ccache names of type
"persistent", which should only have a numeric UID as the next part of the
name (#1029110)
- pull up Simo's patch to mark the correct mechanism on imported GSSAPI
contexts (RT#7592)
- go back to using reconf to run autoconf and autoheader (part of #925640)
- add temporary patch to use newer config.guess/config.sub (more of #925640)
- special-case /run/user/0, attempting to create it when resolving a
directory cache below it fails due to ENOENT and we find that it doesn't
already exist, either, before attempting to create the directory cache
(maybe helping, maybe just making things more confusing for #961235)
- make krb5.conf %verify(not md5 size mtime) in addition to
%config(noreplace), like /etc/nsswitch.conf (#329811)
- turn off NSS as the backend for libk5crypto for now to work around its
DES string2key not working (#679012)
- add revised upstream patch to fix double-free in KDC while returning
typed-data with errors (MITKRB5-SA-2011-003, CVE-2011-0284, #674325)
- add patches for read overflow and null pointer dereference in the
implementation of the SPNEGO mechanism (CVE-2009-0844, CVE-2009-0845)
- add patch for attempt to free uninitialized pointer in libkrb5
(CVE-2009-0846)
- add patch to fix length validation bug in libkrb5 (CVE-2009-0847)
- put the krb5-user .info file into just -workstation and not also
-workstation-clients
- add missing dependency on newer keyutils-libs (#1012034)
- update to 1.10 final
- Fix CVE-2016-3119 (NULL deref in LDAP module)
- Patch CVE-2015-2697, CVE-2015-2696, CVE-2015-2695
- bump release number and rebuild
- Add fix for RedHat Bug #1164304 ("Upstream unit tests loads
the installed shared libraries instead the ones from the build")
- clean up quoting of command-line arguments passed to the krsh/krlogin
wrapper scripts
- patch around TIOCGTLC defined on alpha and remove warnings from libpty.h
- add installation of info docs
- remove krb4 compat patch because it doesn't fix workstation-side servers
- added krb5.csh and krb5.sh to /etc/profile.d
- rebuild
- Remove incorrect KDC assertion
- Resolves: #1673016
- test update to 1.3 beta 4
- ditch statglue build option
- krb5-devel requires e2fsprogs-devel, which now provides libss and libcom_err
- In FIPS mode, add plaintext fallback for RC4 usages and taint
- mark %{krb5prefix}/man so that files which are packaged within it are
flagged as %doc (#168163)
- incorporate fixes for MITKRB5-SA-2007-004 (CVE-2007-2442,CVE-2007-2443)
and MITKRB5-SA-2007-005 (CVE-2007-2798)
- Update from krb5-1.13-alpha1 to final krb5-1.13
- Removed patch for CVE-2014-5351 (#1145425) "krb5: current
keys returned when randomizing the keys for a service principal" -
now part of upstream sources
- Use patch for glibc |eventfd()| prototype mismatch (#1147887) only
for Fedora > 20
- apply upstream patch to fix a null pointer dereference with the LDAP kdb
backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb
backends (CVE-2011-1528), and a null pointer dereference with multiple kdb
backends (CVE-2011-1529) (#737711)
- pull in fix from master to make reporting of errors encountered by
the SPNEGO mechanism work better (RT#7045, part of #1043962)
- update to 1.10.2
- when building the new label for a file we're about to create, also mix
in the current range, in addition to the current user
- also package the PDF format admin, user, and install guides
- drop some PDFs that no longer get built right
- add a backport of Stef's patch to set the client's list of supported
enctypes to match the types of keys that we have when we are using a
keytab to try to get initial credentials, so that a KDC won't send us
an AS reply that we can't encrypt (RT#2131, #748528)
- don't shuffle around any shared libraries on releases with no-separate-/usr,
since /usr/lib is the same place as /lib
- add explicit buildrequires: on 'hostname', for the tests, on systems where
it's in its own package, and require net-tools, which used to provide the
command, everywhere
- fix a null pointer dereference and crash introduced in our PAM patch that
would happen if ftpd was given the name of a user who wasn't known to the
local system, limited to being triggerable by gssapi-authenticated clients by
the default xinetd config (Olivier Fourdan, #569472)
- build
- incorporate Simo's backport of his persistent-keyring changes (#991148)
- restore build-time default DEFCCNAME on Fedora 21 and later and EL, and
instead set default_ccache_name in the default krb5.conf's [libdefaults]
section (#991148)
- on releases where we expect krb5.conf to be configured with a
default_ccache_name, add it whenever we upgrade from an older version of
the package that wouldn't have included it in its default configuration
file (#991148)
- Remove duplication between subpackages
- Resolves: #1250228
- use portreserve correctly -- portrelease takes the basename of the file
whose entries should be released, so we need three files, not one
- update to 1.3.2
- use gcc to build shared libraries
- Fix dependicy on binfmt.service
- update to 1.9 beta 2
- Fix formatting typo in kinit.1 (krb5-kinit-man-typo.patch)
- Prevent overflow when calculating ulog block size (CVE-2025-24528)
Resolves: RHEL-78248
- kdb5_util: fix DB entry flags on modification
Resolves: RHEL-56060
- Restore accidentally dropped patch
- Resolves: #1754690
- Backport fix of memory use after free during libkrad cleanup
- Backport support for larger RADIUS attributes in libkrad
- Resolves: rhbz#2103125
- tweak server init script to automatically extract kadm5 keys if
/var/kerberos/krb5kdc/kadm5.keytab doesn't exist yet
- adjust package descriptions
- Fix SPAKE memory leak
- Fix custom build with -DDEBUG
- New upstream version (1.17)
- Resolves: #1645594
- pull in fix for denial of service by injection of malformed GSSAPI tokens
(CVE-2014-4341, CVE-2014-4342, #1116181)
- Convert Python tests to Python 3
- fix for CVE-2015-2694 (#1216133) "requires_preauth bypass
in PKINIT-enabled KDC".
In MIT krb5 1.12 and later, when the KDC is configured with
PKINIT support, an unauthenticated remote attacker can
bypass the requires_preauth flag on a client principal and
obtain a ciphertext encrypted in the principal's long-term
key. This ciphertext could be used to conduct an off-line
dictionary attack against the user's password.
- Fix setting of AS key in OTP preauth failure
- Ensure we can build with the new CFLAGS
- Remove the git versioning in patches
- update to 1.11.1
- drop patch for noticing negative timeouts being passed to the poll()
wrapper in the client transmit functions
- Enable MD5 override for FIPS RADIUS
- Resolves: #1872689
- use (a bundled, for now, copy of) nss_wrapper to let us run some of the
self-tests at build-time in more places than we could previously (#978756)
- cover inconsistencies in whether or not there's a local caching nameserver
that's willing to answer when the build environment doesn't have a
resolver configuration, so that nss_wrapper's faking of the local
hostname can be complete
- added -lncurses to telnet and telnetd makefiles
- rebuild with keyutils 1.5.8 (part of #1012043)
- fix for CVE-2014-5354 (#1174546) "krb5: NULL pointer
dereference when using keyless entries"
- Remove "python-sphinx-latex" and "tar" from the build requirements
to fix build failures on F22 machines.
- Minor spec cleanup
- gcc 3.3 doesn't implement varargs.h, include stdarg.h instead
- Remove dependency on systemd-sysv which is no longer needed for fedora > 20
This also fixes a fail-to-build issue.
- Miscalaneous spec cleanup fixes
- add patch to accept keytab entries with vno==0 as matches when we're
searching for an entry with a specific name/kvno (#230382/#782211,RT#3349)
- rebuild to pick up the current forms of various patches
- update to 1.10 alpha 1
- on newer releases where we can assume NSS >= 3.13, configure PKINIT to build
using NSS
- on newer releases where we build PKINIT using NSS, configure libk5crypto to
build using NSS
- rename krb5-pkinit-openssl to krb5-pkinit on newer releases where we're
expecting to build PKINIT using NSS instead
- during %check, run check in the library and kdc subdirectories, which
should be able to run inside of the build system without issue
- add and own %{_libdir}/krb5/plugins/authdata
- cut down the number of times we load SELinux labeling configuration from
a minimum of two times to actually one (more of #845125)
- tighten up default permissions on kdc.conf and kadm5.acl (#558343)
- Fix gitignore problem with previous patchset
- compile with %{?_smp_mflags} (Steve Grubb)
- drop the bit where we munge part of the error table header, as it's not
needed any more
- build with -fno-strict-aliasing, which is needed because the library
triggers these warnings
- don't forget to label principal database lock files
- fix the labeling patch so that it doesn't break bootstrapping
- disable kshell and eklogin by default
- New upstream prerelease (1.16-beta2)
- klist: don't trip over referral entries when invoked with -s (#707145,
RT#6915)
- fix the problem where the %license file has been a dangling symlink
- pull in upstream fix for an incorrect check on the value returned by a
strdup() call (#1132062)
- update to 1.10.3, rolling in the fixes from MITKRB5-SA-2012-001
- Fix use of enterprise principals with forwarding
- move condrestarts to postun
- make xinetd configs noreplace
- add descriptions to xinetd configs
- add /etc/init.d as a prereq for the -server package
- patch to properly truncate $TERM in krlogind
- Actually bump kdbversion like I was supposed to
- fix credential forwarding problem in klogind (goof in KRB5CCNAME handling)
(#11588)
- fix heap corruption bug in FTP client (#14301)
- add fixes from MITKRB5-SA-2008-001 for use of null or dangling pointer
when v4 compatibility is enabled on the KDC (CVE-2008-0062, CVE-2008-0063,
- add fixes from MITKRB5-SA-2008-002 for array out-of-bounds accesses when
high-numbered descriptors are used (CVE-2008-0947, #433596)
- add backport bug fix for an attempt to free non-heap memory in
libgssapi_krb5 (CVE-2007-5901, #415321)
- add backport bug fix for a double-free in out-of-memory situations in
libgssapi_krb5 (CVE-2007-5971, #415351)
- apply patch from upstream to fix KDC denial of service (CVE-2010-0283,
- rebuild
- don't discard the error code from an error message received in response
to a change-password request (#658871, RT#6893)
- switch buildrequires: and requires: on e2fsprogs-devel into
buildrequires: and requires: on libss-devel, libcom_err-devel, per
sandeen on fedora-devel-list
- Enable building with bad system /etc/krb5.conf
- Update backports of certauth and corresponding test
- Remove Zanata test glue and related workarounds
- Bug #1234292 ("IPA server cannot be run in container due to incorrect /usr/sbin/_kadmind")
- Bug #1234326 ("krb5-server introduces new rpm dependency on ksh")
- also perform PAM session and credential management when ftpd accepts a
client using strong authentication, missed earlier
- also label kadmind log files and files created by the db2 plugin
- Bump release + rebuild.
- update to 1.3.1
- update to alpha 2
- drop a couple of patches which were integrated for alpha 2
- in login, allow PAM to interact with the user when they've been strongly
authenticated
- in login, signal PAM when we're changing an expired password that it's an
expired password, so that when cracklib flags a password as being weak it's
treated as an error even if we're running as root
- rebuild properly when pthread_mutexattr_setrobust_np() is defined but not
declared, such as with recent glibc when _GNU_SOURCE isn't being used
- add patch to document the reject-bad-transited option in kdc.conf
- suppress warnings of impending password expiration if expiration is more than
seven days away when the KDC reports it via the last-req field, just as we
already do when it reports expiration via the key-expiration field (#556495)
- link with libtinfo rather than libncurses, when we can, in future RHEL
- gettextize init scripts
- move the compiled-in default ccache location from the previous default of
FILE:/tmp/krb5cc_%{uid} to DIR:/run/user/%{uid}/krb5cc (part of #949588)
- Try harder to avoid password change replay errors
- Resolves: #2077563
- update to the 1.2 release
- ditch a lot of our patches which went upstream
- enable use of DNS to look up things at build-time
- disable use of DNS to look up things at run-time in default krb5.conf
- change ownership of the convert-config-files script to root.root
- compress PS docs
- fix some typos in the kinit man page
- run condrestart in server post, and shut down in preun
- Bump release number
- Include more test suite changes from upstream
- Resolves: #1464381
- update backport of the preauth module interface
- Adjust dependency on crypto-polices to be just the file we want
- Patch courtesy of lslebodn
- Resolves: #1308984
- pull in multiple changes to allow replay caches to be added to a GSS
credential store as "rcache"-type credentials (RT#7818/#7819/#7836,
- Fix CVE-2016-3120
- Resolves: #1361051
- incorporate a fix to teach the file labeling bits about when replay caches
are expunged (#576093)
- change the default configured encryption type for KDC databases to the
compiled-in default of des3-hmac-sha1 (#57847)
- ksu: move account management checks to before we drop privileges, like
su does (#540769)
- selinux: set the user part of file creation contexts to match the current
context instead of what we looked up
- configure with --enable-dns-for-realm instead of --enable-dns, which isn't
recognized any more
- Backport usage of SHA-256 instead of SHA-1 for PKINIT CMS digest
- Resolves: #2066316
- fix build failure caused by change of prototype for glibc
|eventfd()| (#1147887)
- Start using crypto-policies
- New upstream version (1.18)
- Resolves: #1802334
- Resolves: #1820311
- Resolves: #1791062
- Resolves: #1784655
- Add temporay workaround for RH bug #1204646 ("krb5-config
returns wrong -specs path") which modifies krb5-config post
build so that development of krb5 dependicies gets unstuck.
This MUST be removed before rawhide becomes F23 ...
- rebuild
- rebuild
- New upstream release - 1.15.1
- update to 1.10.1
- drop the KDC crash fix
- drop the KDC lookaside cache fix
- drop the fix for kadmind RPC ACLs (CVE-2012-1012)
- properly advertise that the kpropd init script now supports force-reload
(Zbysek Mraz, #630587)
- fix a typo in kerberos.ldif
- fix double-free of enc_part2 in krb524d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- override INSTALL_SETUID at build-time so that ksu is installed into
the buildroot with the right permissions (part of #225974)
- when building with our bundled copy of libverto, package it in with -libs
rather than with -server (#886049)
- update to 1.2.7-beta2 (internal only, not for release), dropping dnsparse
and kadmind4 fixes
- remove patch to set TERM in klogind which, combined with the upstream fix in
1.3.1, actually produces the bug now (#114762)
- Backport fix for change password requests when using FAST (RT#7868)
- Fix k5test prompts for Python 3
- have -server require /usr/share/dict/words, which we set as the default
dict_file in kdc.conf (#817089)
- don't include into the telnet client when we're not using curses
- move the db2 kdb plugin from -server to -libs, because a multilib libkdb
might need it
- patch to avoid depending on to define NI_MAXHOST and NI_MAXSERV
- Exit with status 0 from kadmind
- add patch from Tom Yu for exploitable bugs in rpc code used in kadmind
- fix predictable-tempfile-name bug in krb5-send-pr (CAN-2004-0971, #140036)
- pull patch from svn to undo unintentional chattiness in ftp
- pull patch from svn to handle NULL krb5_get_init_creds_opt structures
better in a couple of places where they're expected
- Update to krb5-1.13.2
- drop patch for krb5-1.13.2-CVE_2015_2694_requires_preauth_bypass_in_PKINIT_enabled_KDC, fixed in krb5-1.13.2
- drop patch for krb5-1.12.1-CVE_2014_5355_fix_krb5_read_message_handling, fixed in krb5-1.13.2
- Add script processing for upcoming Zanata l10n support
- Minor spec cleanup
- make PAM support for ksu also set PAM_RUSER
- fixed server package so that it works now
- drop netdb patch
- kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that
the DISALLOW_ALL_TIX flag is set on an entry, for better interop with Fedora,
Netscape, Red Hat Directory Server (Simo Sorce)
- rebuild on 1.1.1
- pull in fix for building against tcl 8.6 (#1107061)
- rebuild
- fix double-close in keytab handling
- add port of fixes for CAN-2004-0175 to krb5-aware rcp (#151612)
- fix comments in krb5-configs
- pull up fix for not calling a kdb plugin's check-transited-path
method before calling the library's default version, which only knows
how to read what's in the configuration file (RT#7709, #1013664)
- clear fuzz out of patches, dropping a man page patch which is no longer
necessary
- quote %{__cc} where needed because it includes whitespace now
- define ASN1BUF_OMIT_INLINE_FUNCS at compile-time (for now) to keep building
- make profile.d scriptlets mode 644 instead of 755 (part of #225974)
- backport change from SVN to fix a computed-value-not-used warning in
kpropd (#684065)
- pull in changes from upstream which add processing of the contents of
/etc/gss/mech.d/*.conf when loading GSS modules (#1102839)
- work around a compile problem with new openssl
- Fix KDC null dereference on large TGS replies
- update to 1.3.4 final
- always #include to access errno, never do it directly
- enable LFS on a bunch of other 32-bit arches
- update to 1.8.2
- drop patches for CVE-2010-1320, CVE-2010-1321
- New rawhide, new upstream version
- Drop CVE patches
- Rename fix_interposer.patch to acquire_cred_interposer.patch
- Update acquire_cred_interposer.patch to apply to new source
- update to 1.7.1
- don't trip AD lockout on wrong password (#542687, #554351)
- incorporates fixes for CVE-2009-4212 and CVE-2009-3295
- fixes gss_krb5_copy_ccache() when SPNEGO is used
- move sim_client/sim_server, gss-client/gss-server, uuclient/uuserver to
the devel subpackage, better lining up with the expected krb5/krb5-appl
split in 1.8
- drop kvno,kadmin,k5srvutil,ktutil from -workstation-servers, as it already
depends on -workstation which also includes them
- refresh nss_wrapper and add socket_wrapper to the %check environment
- pull in patch for RT#7046: tag a ccache containing credentials obtained via
S4U2Proxy with the principal name of the proxying principal (part of #761317)
so that the default principal name can be set to that of the client for which
it is proxying, which results in the ccache looking more normal to consumers
of the ccache that don't care that there's proxying going on
- pull in patch for RT#7047: allow tickets obtained via S4U2Proxy to be cached
(more of #761317)
- pull in patch for RT#7048: allow PAC verification to only bother trying to
verify the signature with keys that it's given (still more of #761317)
- omit dependent libraries from the krb5-config --libs output, as using
shared libraries (no more static libraries) makes them unnecessary and
they're not part of the libkrb5 interface (patch by Rex Dieter, #240220)
(strips out libkeyutils, libresolv, libdl)
- add more etypes (arcfour) to the default enctype list in kdc.conf
- don't apply previous patch, refused upstream
- fix segfault in telnet due to incorrect checking of gethostbyname_r result
codes (#129059)
- Fix pkinit_anchors path
- Resolves: #1661339
- Fix KDC return code and set prompt types for OTP client preauth
- Resolves: #1370072
- only apply the patch to autocreate /run/user/0 when we're hard-wiring the
default ccache location to be under it; otherwise it's unnecessary
- Make docs build python3-compatible
- Resolves: #1590928
- update to 1.2.8
- Save other programs from worrying about CVE-2017-11462
- Resolves: #1488873
- Resolves: #1488874
- Merge duplicate subsections in profile library
- New upstream release
- Update selinux with RHEL hygene
- Resolves: #1314096
- Drop dependency on pax, ksh
- Remove support for fedora < 20
- Fix log file permissions patch with our selinux
- Resolves: #1309421
- Make krb5kdc -p affect TCP ports
- label all files at creation-time according to the SELinux policy (#228157)
- New upstream release
- pam_rhosts_auth.so's been gone, use pam_rhosts.so instead
- add bison as a BuildPrereq (#20091)
- rebuild
- backport patch to disable replay detection in krb5_verify_init_creds()
while reading the AP-REQ that's generated in the same function (RT#7229)
- update the PIC patch for iaesx86.s to not use ELF relocations to the version
that landed upstream (RT#7815, #1045699)
- back out setting default_ccache_name to the new default for now, resetting
it to the old default while the kernel/keyutils bits get sorted (sgallagh)
- use portreserve to make sure the KDC can always bind to the kerberos-iv
port, kpropd can always bind to the krb5_prop port, and that kadmind can
always bind to the kerberos-adm port (#555279)
- correct inadvertent use of macros in the changelog (rpmlint)
- Fix source URLs in spec file
- Resolves: #1755959
- switch to the version of persistent-keyring that was just merged to
master (RT#7711), along with related changes to kinit (RT#7689)
- go back to setting default_ccache_name to a KEYRING type
- don't forget to set the SELinux label when creating the directory for
a DIR: ccache
- pull in proposed fix for attempts to get initial creds, which end up
following referrals, incorrectly trying to always use master KDCs if
they talked to a master at any point (should fix RT#7650)
- Put KDB authdata first
- Resolves: #1800575
- Move krb5-kdb-version provides from -libs to -devel
- Fix upstream URLs in spec file
- Resolves: #1868039
- Pass gss_localname() through SPNEGO
- Resolves: #1802334
- Display an error message if ocsp pkinit is requested
- add buildrequires: on keyutils-libs-devel to enable use of keyring ccaches,
dragging keyutils-libs in as a dependency
- move /usr/kerberos/bin to end of PATH
- install kadmin header files
- update a test wrapper to properly handle things that the new libkrad does,
and add python-pyrad as a build requirement so that we can run its tests
- New upstream version 1.14.3
- Update to krb5-1.13.1
- drop patch for CVE_2014_5353_fix_LDAP_misused_policy_name_crash, fixed in krb5-1.13.1
- drop patch for kinit -C loops (MIT/krb5 bug #243), fixed in krb5-1.13.1
- drop patch for CVEs { 2014-9421, 2014-9422, 2014-9423, 2014-5352 }, fixed in krb5-1.13.1
- Minor spec cleanup
- Drop dependency on python2-pyrad (dead upstream, broken with new python)
- Switch to using autosetup macro.
- Patches come from git, so it is easiest to just make a git repo
- fixup some int/pointer varargs wackiness
- update to 1.3.6, which includes the previous fix
- build even libdb.a with -fPIC and $RPM_OPT_FLAGS.
- apply upstream patch by way of Burt Holzman to fall back to a non-referral
method in cases where we might be derailed by a KDC that rejects the
canonicalize option (for example, those from the RHEL 2.1 or 3 era) (#715074)
- build alpha with -O0 for now
- Fix flaws in LDAP DN checking
- CVE-2018-5729, CVE-2018-5730
- add some conditional logic to simplify building on older Fedora releases
- turn off krb4 support (it won't be part of the 1.7 release, but do it now)
- use triggeruns to properly shut down and disable krb524d when -server and
-workstation-servers gets upgraded, because it's gone now
- move the libraries to /%{_lib}, but leave --libdir alone so that plugins
get installed and are searched for in the same locations (#473333)
- clean up buildprereq/prereqs, explicit mktemp requires, and add the
ldconfig for the -server-ldap subpackage (part of #225974)
- escape possible macros in the changelog (part of #225974)
- fixup summary texts (part of #225974)
- take the execute bit off of the protocol docs (part of #225974)
- unflag init scripts as configuration files (part of #225974)
- make the kpropd init script treat 'reload' as 'restart' (part of #225974)
- update to 1.3.4 beta1
- remove MITKRB5-SA-2004-001, included in 1.3.4
- Backport patch to fix mechglue for gss_inqure_attrs_for_mech()
- respin with updated version of patch for RT#7650 (#969331)
- pull up latest revision of patch to reduce lockups in rsh/rshd
- drop patch to add additional access() checks to ksu - they add to breakage
when non-FILE: caches are in use (#1026099), shouldn't be resulting in any
benefit, and clash with proposed changes to fix its cache handling
- add deadlock patch, removed old patch
- fix for CVE-2014-5351 (#1145425) "krb5: current keys returned when
randomizing the keys for a service principal"
- fix buffer underrun in unparsing certain principals (CAN-2003-0082)
- New upstream release - krb5-1.15.2
- Adjust patches as appropriate
- Properly close krad sockets
- Resolves: #1380836
- switch man pages to being generated with the right paths in them
- drop old, incomplete SELinux patch
- add patch from Greg Hudson to make srvtab routines report missing-file errors
at same point that keytab routines do (#241805)
- update to 1.2.2, which fixes some bugs relating to empty ETYPE-INFO
- re-enable optimization on Alpha
- use %global instead of %define
- pull up proposed patch for creating previously-not-there lock files for
kdb databases when 'kdb5_util' is called to 'load' (#551764)
- Nix /usr/share/krb5.conf.d to reduce complexity
- update to 1.11.4
- drop patch for RT#7650, obsoleted
- drop patch for RT#7706, obsoleted as RT#7723
- drop patch for CVE-2013-1418/CVE-2013-6800, included in 1.11.4
- fix double-free in the kdc (patch merged into MIT tree)
- include convert-config-files script as a documentation file
- Fix CVE-2017-15088 (Buffer overflow in get_matching_data())
- extend PAM support to ksu: perform account and session management for the
target user
- pull up and merge James Leddy's changes to also set PAM_RHOST in PAM-aware
network-facing services
- incorporate updated fix for CVE-2007-3999 (CVE-2007-4743)
- fix incorrect call to "test" in the kadmin init script (#252322,#287291)
- add patch to fix telnetd vulnerability
- Clean up etype display on KDC
- Resolves: #1664157
- Log preauth names in trace output
- Misc bugfixes from upstream
- Add APIs for marshalling credentials
- Resolves: #1964619
- prebuild PDF docs to reduce multilib differences (internal tooling, #884065)
- drop the kerberos-iv portreserve file, and drop the rest on systemd systems
- escape uses of macros in comments (more of #884065)
- tell krb5kdc and kadmind to create pid files, since they can
- add logrotate configuration files for krb5kdc and kadmind (#462658)
- fix parsing of the pidfile option in the KDC (upstream #6750)
- specify the location of the subsystem lock when using the status() function
in the kadmind and kpropd init scripts, so that we get the right error when
we're dead but have a lock file - requires initscripts 8.99 (#521772)
- remove the krb5-appl bits (the -workstation-clients and -workstation-servers
subpackages) now that krb5-appl is its own package
- replace our patch for #563431 (kpasswd doesn't fall back to guessing your
principal name using your user name if you don't have a ccache) with the
one upstream uses
- backport a fix to allow a PKINIT client to handle SignedData from a KDC
that's signed with a certificate that isn't in the SignedData, but which
is available as an anchor or intermediate on the client (RT#7183)
- pull in keyutils as a build requirement to get the "KEYRING:" ccache type,
because we've merged
- remove setuid bit on v4rcp and ksu in case the checks previously added
don't close all of the problems in ksu
- apply patches from Jeffrey Schiller to fix overruns Chris Evans found
- reintroduce configs subpackage for use in the errata
- add PreReq: sh-utils
- update to 1.11 beta 2
- refresh patch for #542868 from trunk
- Add support to query the SSF of a context
- Pick up rename of perl dependency
- generate src/include/krb5/krb5.h before building
- fix conditional for sparcv9
- Switch to %ldconfig_scriptlets
- mark profile.d config files noreplace (Laurent Rineau, #196447)
- fix krb5-send-pr (#18932) and move it from -server to -workstation
- buildprereq libtermcap-devel
- temporariliy disable optimization on alphas
- gettextize init scripts
- build alpha with -O0 for now
- own %{_var}/kerberos
- Zap data when freeing krb5_spake_factor
- fix broken dependency on awk (should be gawk, rdieter)
- libgssapi: pull in patch from svn to stop returning context-expired errors
when the ticket which was used to set up the context expires (#605366,
upstream #6739)
- kadmin.service: fix #723723 again
- kadmin.service,krb5kdc.service: remove optional use of $KRB5REALM in command
lines, because systemd parsing doesn't handle alternate value shell variable
syntax
- kprop.service: add missing Type=forking so that systemd doesn't assume simple
- kprop.service: expect the ACL configuration to be there, not absent
- handle a harder-to-trigger assertion failure that starts cropping up when we
exit the transmit loop on time (#739853)
- Add flag to disable encrypted timestamp on client
- rebuild
- New upstream prerelease (1.16-beta1)
- apply upstream patch to fix a null pointer dereference when processing
TGS requests (CVE-2011-1530, #753748)
- Remove WITH_NSS macro (always false)
- Remove WITH_SYSTEMD macro (always true)
- Remove WITH_LDAP macro (always true)
- Remove WITH_OPENSSL macro (always true)
- fix summaries and descriptions
- switched the default transfer protocol from PORT to PASV as proposed on
bugzilla (#16134), and to match the regular ftp package's behavior
- Add send/receive sendto_kdc hooks and corresponding tests
- Resolves: #1321135
- clean up init script for server, verify that it works [jlkatz]
- clean up rotation script so that rc likes it better
- add clean stanza
- add patch to build semi-useful static libraries, but don't apply it unless
we need them
- Continue after KRB5_CC_END in KCM cache iteration
- Fix capaths "." values on client
- Resolves: 1551099
- rebuild
- grab a more-commented version of the most recent patch from upstream
master
- make a guess at making the 32-bit AES-NI implementation sufficiently
position-independent to not require execmod permissions for libk5crypto
(more of #1045699)
- make krb5-libs obsolete the old krb5-configs package (#18351)
- don't quit from the kpropd init script if there's no principal database so
that you can propagate the first time without running kpropd manually
- don't complain if /etc/ld.so.conf doesn't exist in the -libs %post
- use %{_infodir} to better comply with FHS
- move .so files to -devel subpackage
- tweak xinetd config files (bugs #11833, #11835, #11836, #11840)
- fix package descriptions again
- apply fix from Tom Yu for MITKRB5-SA-2004-004 (CAN-2004-1189)
- Upstream release. No actual change from beta, just version bump
- Clean up unused parts of spec file
- Fix CVE-2017-11368 (remote triggerable assertion failure)
- fix a compile error in the SELinux labeling patch when -DDEBUG is used (Sumit
Bose)
- Put openssl runtime requirement in the right place this time
- Resolves: #1754690
- Backport kdcpolicy interface
- amend the PIC patch for iaesx86.s to also save/restore ebx in the
functions where we modify it, because the ELF spec says we need to
- Backport certauth eku security fix
- pull in patch from trunk to rename krb5int_pac_sign() to krb5_pac_sign() and
make it public (#745533)
- pull a fix from SVN to get libgssrpc clients (e.g. kadmin) authenticating
using the old protocol over IPv4 again (RT#6920)
- Add krb5_db_register_keytab
- Resolves: #1376812
- correct a bug in the fix for #754001 so that the file creation context is
consistently reset
- Add upstream crashfix patch (RT#7081)
- skip the setfscreatecon() if fopen() is passed "rb" as the open mode (part
of #819115)
- rebuild
- Guess Samba client mutual flag using ap_option
- Resolves: #1370980
- pull up fix for importing previously-exported credential caches in the
gssapi library (RT# 7706, #1019420)
- modify the deltat grammar to also tell gcc (4.7) to suppress
"maybe-uninitialized" warnings in addition to the "uninitialized" warnings
it's already being told to suppress (RT#7080)
- Unify kvno option documentation
- Resolves: #1869055
- Update otp patches
- Merge otp patches into a single patch
- Add keycheck patch
- libgssapi_krb5: properly export the acceptor subkey when creating a lucid
context (Kevin Coffman, via the nfs4 mailing list)
- Use full paths in krb5.sh to avoid path lookups
- set "rdns = false" in the default krb5.conf (#908323,#908324)
- New upstream release
- add an auth stack to ksu's PAM configuration so that pam_setcred() calls
won't just fail
- reintroduce missing %postun for the non-split_workstation case
- add missing pam-devel build requirement, force selinux-or-fail build
- kadmind.init: don't fail outright if the default principal database
isn't there if it looks like we might be using the kldap plugin
- kadmind.init: attempt to extract the key for the host-specific kadmin
service when we try to create the keytab
- Remove downloadable source signature file
- Resolves: rhbz#2219654
- apply updated patch from MITKRB5-SA-2004-001 (revision 2004-06-02)
- add upstream fix for denial-of-service in SPNEGO (CVE-2010-0628, #576325)
- kdc.conf: no more need to suggest keeping keys with v4-compatible salting
krb5-workstation-1.18.2-32.el8_10.x86_64.rpm | - incorporate upstream patch for remote crash of KDCs which serve multiple
realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800,
- Add recursion limit for ASN.1 indefinite lengths (CVE-2020-28196)
- Resolves: #1906492
- add draft fix from Tom Yu for slc_add_reply() buffer overflow (CAN-2005-0469)
- add draft fix from Tom Yu for env_opt_add() buffer overflow (CAN-2005-0468)
- update to 1.11.3
- drop patch for RT#7605, fixed in this release
- drop patch for CVE-2002-2443, fixed in this release
- drop patch for RT#7369, fixed in this release
- pull upstream fix for breaking t_skew.py by adding the patch for #961221
- add explicit build-time dependency on a version of keyutils that's new
enough to include keyctl_get_persistent() (more of #991148)
- make sure workstation servers are all disabled by default
- clean up krb5server init script
- rework file labeling patch to not depend on fragile preprocessor trickery,
in another attempt at fixing #428355 and friends
- pull in patches from master to not test GSSRPC-over-UDP and to not
depend on the portmapper, which are areas where our build systems
often give us trouble, too
- Explicitly look for python2 in configure.in
- back out buildrequires: keyutils-libs-devel for now
- add LSB-style init script info
- drop not-needed-since-1.8 build dependency on rsh (ssorce)
- build with -fstack-protector-all instead of the default -fstack-protector,
so that we add checking to more functions (i.e., all of them) (#629950)
- also link binaries with -Wl,-z,relro,-z,now (part of #629950)
- Drop DES3 from sample kdc.conf
- Resolves: #1802334
- apply patch to address MITKRB-SA-2006-001 (CVE-2006-3084)
- tweak graceful start/stop logic in post and preun
- fix bug ID in changelog
- patch ksu man page because the -C option never works
- add access() checks and disable debug mode in ksu
- modify default ksu build arguments to specify more directories in CMD_PATH
and to use getusershell()
- Backport soft-pkcs11 testing code
- Resolves: #1734158
- New upstream release (1.16)
- No changes from beta2
- Fix typo of crypto-policies file in previous version
- undo rename from krb5-pkinit-openssl to krb5-pkinit on EL6
- version the Obsoletes: on the krb5-pkinit-openssl to krb5-pkinit rename
- reintroduce the init scripts for non-systemd releases
- forward-port %{?_rawbuild} annotations from EL6 packaging
- incorporate fix for MITKRB5-SA-2014-001 (CVE-2014-4345)
- add buildprereq for autoconf
- correct some configuration file paths which the KDC_DIR patch missed
- fix license handling
- pull up fix for upstream #6745, in which the gssapi library would add the
wrong error table but subsequently attempt to unload the right one
- fix trigger scriptlet's invocation of sed (#1016945)
- attempt to account for UnversionedDocdirs for the -libs subpackage
- rename the krb5 package back to krb5-libs; the previous rename caused
something of an uproar
- update to 1.2.3, which includes the FTP and telnetd fixes
- configure without --enable-dns-for-kdc --enable-dns-for-realm, which now set
the default behavior instead of enabling the feature (the feature is enabled
by --enable-dns, which we still use)
- reenable optimizations on Alpha
- support more encryption types in the default kdc.conf (heads-up from post
to comp.protocols.kerberos by Jason Heiss)
- Replace _kadmin/_kprop with systemd macros
- Remove traces of upstart from fedora package per policy
- Resolves: #1290185
- Use responder for non-preauth AS requests
- Resolves: #1370622
- Set error message on KCM get_princ failure
- remove hesiod dependency at build-time
- mktemp was long obsoleted by coreutils
- add backport of in-development preauth module interface (#208643)
- update to 1.8.3
- drop backports of fixes for gss context expiration and error table
registration/deregistration mismatch
- drop patch for upstream #6750
- ftp: use the correct local filename during mget when the 'case' option is
enabled (#442713)
- make krb5-server-ldap also depend on the same version-release of krb5-libs,
as the other subpackages do, if only to make it clearer than it is when we
just do it through krb5-server
- drop explicit linking with libtinfo for applications that use libss, now
that readline itself links with libtinfo (as of readline-5.2-3, since
fedora 7 or so)
- go back to building without strict aliasing (compiler warnings in gssrpc)
- simplify the man pages patch by only preprocessing the files we care about
and moving shared configure.in logic into a shared function
- catch the case of ftpd printing file sizes using %i, when they might be
bigger than an int now
- add patch from Dhiru Kholia for the AES-NI implementations to allow
libk5crypto to be properly marked as not needing an executable stack
on arches where they're used (#1045699, and so many others)
- add upstream patch to fix freeing an uninitialized pointer and dereferencing
another uninitialized pointer in the KDC (MITKRB5-SA-2012-001, CVE-2012-1014
and CVE-2012-1015, #844779 and #844777)
- fix a thinko in whether or not we mess around with devel .so symlinks on
systems without a separate /usr (sbose)
- fix license tag
- update to 1.11 alpha 1
- drop backported patch for RT #7406
- drop backported patch for RT #7407
- drop backported patch for RT #7408
- the new docs system generates PDFs, so stop including them as sources
- drop backported patch to allow deltat.y to build with the usual
warning flags and the current gcc
- drop backported fix for disabling use of a replay cache when verifying
initial credentials
- drop backported fix for teaching PKINIT clients which trust the KDC's
certificate directly to verify signed-data messages that are signed with
the KDC's certificate, when the blobs don't include a copy of the KDC's
certificate
- drop backported patches to make keytab-based authentication attempts
work better when the client tells the KDC that it supports a particular
cipher, but doesn't have a key for it in the keytab
- drop backported fix for avoiding spurious clock skew when a TGT is
decrypted long after the KDC sent it to the client which decrypts it
- move the cross-referenced HTML docs into the -libs package to avoid
broken internal links
- drop patches to fixup paths in man pages, shouldn't be needed any more
- backport fixes to krb5_copy_context (RT#7807, #1044735/#1044739)
- override the default build rules to not delete temporary y.tab.c files,
so that they can be packaged, allowing debuginfo files which point to them
do so usefully (#729044)
- Move kdbversion info into -server for IPA (so we can rebase)
- Resolves: #1645594
- rebuild
- Backport OID mech fix
- Resolves: #1317609
- Update includedir processing to match upstream
- re-enable large file support, fell out in 1.3-1
- patch rcp to use long long and %lld format specifiers when reporting file
sizes on large files
- incorporate fixes for MITKRB5-SA-2007-006 (CVE-2007-3999, CVE-2007-4000)
- Make krb5-devel depend on libkadm5
- Resolves: #1364487
- Fix string RPC ACLs (RT#7093); CVE-2012-1012
- Don't check for write access on /etc/krb5.conf if SELinux
- Re-provide krb5-kdb-version in -devel as well (IPA wants it)
- Resolves: #1645594
- increase the maximum name length allowed by kuserok() to the higher value
used in development versions
- fix for potentially gzipped man pages
- gssapi: pull in upstream fix for a possible NULL dereference
in spnego (CVE-2014-4344)
- update to 1.6.3, dropping now-integrated patches for CVE-2007-3999
and CVE-2007-4000 (the new pkinit module is built conditionally and goes
into the -pkinit-openssl package, at least for now, to make a buildreq
loop with openssl avoidable)
- rebuilt
- rebuilt with new openssl
- Ignore bad enctypes in krb5_string_to_keysalts()
- Resolves: #1858322
- Make krb5kdc.log not world-readable by default
- Resolves: #1276484
- build shared libraries with partial RELRO support (#723995)
- filter out potentially multiple instances of -Wl,-z,relro from krb5-config
output, now that it's in the buildroot's default LDFLAGS
- pull in a patch to fix losing track of the replay cache FD, from SVN by
way of Kevin Coffman
- install src/krb524/README as README.krb524 in the -servers package,
includes information about converting for AFS principals
- explicitly run the pdf generation script using sh (part of #225974)
- rebuild in new environment
- reenable statglue
- add patch to correct GSSAPI library null pointer dereference which could be
triggered by malformed client requests (CVE-2010-1321, #582466)
- incorporate revised fixes from Tom Yu for CAN-2004-0642, CAN-2004-0644,
CAN-2004-0772
- New upstream beta version
- update to 1.6.1
- drop no-longer-needed patches for CVE-2007-0956,CVE-2007-0957,CVE-2007-1216
- drop patch for sendto bug in 1.6, fixed in 1.6.1
- specify dependencies on the same arch of krb5-libs by using the %{?_isa}
suffix, to avoid dragging 32-bit libraries onto 64-bit systems (#980155)
- Switch to python3-sphinx for docs
- Resolves: #1590928
- pull in fix from master to return a NULL pointer rather than allocating
zero bytes of memory if we read a zero-length input token (RT#7794, part of
- pull in fix from master to ignore an empty token from an acceptor if
we've already finished authenticating (RT#7797, part of #1043962)
- pull in fix from master to avoid a memory leak when a mechanism's
init_sec_context function fails (RT#7803, part of #1043962)
- pull in fix from master to avoid a memory leak in a couple of error
cases which could occur while obtaining acceptor credentials (RT#7805, part
of #1043962)
- Match Heimdal behavior for channel bindings
- Code hygiene + test stability fix included
- Resolves: #1840518
- initial update to 1.6, pre-package-reorg
- move workstation daemons to a new subpackage (#81836, #216356, #217301), and
make the new subpackage require xinetd (#211885)
- update to 1.4
- v1.4 kadmin client requires a v1.4 kadmind on the server, or use the "-O"
flag to specify that it should communicate with the server using the older
protocol
- new libkrb5support library
- v5passwdd and kadmind4 are gone
- versioned symbols
- pick up $KRB5KDC_ARGS from /etc/sysconfig/krb5kdc, if it exists, and pass
it on to krb5kdc
- pick up $KADMIND_ARGS from /etc/sysconfig/kadmin, if it exists, and pass
it on to kadmind
- pick up $KRB524D_ARGS from /etc/sysconfig/krb524, if it exists, and pass
it on to krb524d *instead of* "-m"
- set "forwardable" in [libdefaults] in the default krb5.conf to match the
default setting which we supply for pam_krb5
- set a default of 24h for "ticket_lifetime" in [libdefaults], reflecting the
compiled-in default
- ensure that the gssapi library's been initialized before walking the
internal mechanism list in gss_release_oid(), needed if called from
gss_release_name() right after a gss_import_name() (#198092)
- rebuild
- rename the krb5-libs package to krb5 (naming a subpackage -libs when there
is no main package is silly)
- move defaults for PAM to the appdefaults section of krb5.conf -- this is
the area where the krb5_appdefault_* functions look for settings)
- disable statglue (warning: breaks binary compatibility with previous
packages, but has to be broken at some point to work correctly with
unpatched versions built with newer versions of glibc)
- pull in upstream fix to start treating a KRB5CCNAME value that begins
with DIR:: the same as it would a DIR: value with just one ccache file
in it (RT#7172, #965574)
- fixup URL in a comment
- when built with NSS, require 3.12.10 rather than 3.12.9
- provide docs in PDF format instead of as tex source (Enrico Scholz, #209943)
- convert to systemd
- update to 1.2.7
- disable use of tcl
- update to 1.12.2
- drop patch for RT#7820, fixed in 1.12.2
- drop patch for #231147, fixed as RT#3277 in 1.12.2
- drop patch for RT#7818, fixed in 1.12.2
- drop patch for RT#7836, fixed in 1.12.2
- drop patch for RT#7858, fixed in 1.12.2
- drop patch for RT#7924, fixed in 1.12.2
- drop patch for RT#7926, fixed in 1.12.2
- drop patches for CVE-2014-4341/CVE-2014-4342, included in 1.12.2
- drop patch for CVE-2014-4343, included in 1.12.2
- drop patch for CVE-2014-4344, included in 1.12.2
- drop patch for CVE-2014-4345, included in 1.12.2
- replace older proposed changes for ksu with backports of the changes
after review and merging upstream (#1015559, #1026099, #1118347)
- patch mkdir/rmdir problem in ftpcmd.y
- add condrestart option to init script
- split the server init script into three pieces and add one for kpropd
- tweak statglue.c to fix stat/stat64 aliasing problems
- be cleaner in use of gcc to build shlibs
- Support KDC_ERR_MORE_PREAUTH_DATA_REQUIRED (RT#8063)
- Add pkinit_anchors default value to krb5.conf
- Reindent krb5.conf to not be terrible
- Support PAC with KDC extended signature and without ticket signature
- Resolves: rhbz#2169477
- update to 1.3.3
- debloat
- update to 1.11 beta 1
- Merge krb5-configs back into krb5-libs. The krb5.conf file is marked as
a %config file anyway.
- Make krb5.conf a noreplace config file.
- apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (#218456)
- apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (#218456)
- fix a regression (not labeling a kdb database lock file correctly, #569902)
- correctly use stdargs
- Zap copy of secret in RC4 string-to-key
- kadmind: add upstream patch to fix free() on an invalid pointer (#696343,
MITKRB5-SA-2011-004, CVE-2011-0285)
- apply patch from MITKRB5-SA-2004-001 (#125001)
- add patch to support "ANY" keytab type (i.e.,
"default_keytab_name = ANY:FILE:/etc/krb5.keytab,SRVTAB:/etc/srvtab"
patch from Gerald Britton, #42551)
- build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (#30697)
- patch ftpd to use long long and %lld format specifiers to support the SIZE
command on large files (also #30697)
- don't use LOG_AUTH as an option value when calling openlog() in ksu (#45965)
- implement reload in krb5kdc and kadmind init scripts (#41911)
- lose the krb5server init script (not using it any more)
- incorporate patch to fix double-free in the KDC (CVE-2010-1320, #581922)
- Add support for start_realm cache config
- Resolves: #1901195
- make krb5-config suppress CFLAGS output when called with --libs (#544391)
- add patch included in MITKRB5-SA-2003-003 (CAN-2003-0028)
- Do not block HMAC-MD4/5 in FIPS mode
Resolves: RHEL-86786
- Don't issue RC4 session keys by default (CVE-2025-3576)
Resolves: RHEL-88049
- Add PKINIT paChecksum2 from MS-PKCA v20230920
Resolves: RHEL-82648
- add man pages for kerberos(1), kvno(1), .k5login(5)
- add kvno to -workstation
- update to 1.4.1, incorporating fixes for CAN-2005-0468 and CAN-2005-0469
- when starting the KDC or kadmind, if KRB5REALM is set via the /etc/sysconfig
file for the service, pass it as an argument for the -r flag
- back out this labeling change (dwalsh):
- when building the new label for a file we're about to create, also mix
in the current range, in addition to the current user
- update to 1.2.6
- fix configure stuff for ia64
- fix telnet client environment variable disclosure the same way NetKit's
telnet client did (CAN-2005-0488) (#159305)
- keep apps which call krb5_principal_compare() or krb5_realm_compare() with
malformed or NULL principal structures from crashing outright (Thomas Biege)
(#161475)
- libgssapi_krb5: backport fix for some errors which can occur when
we fail to set up the server half of a context (CVE-2009-0845)
- remove hashless key types from the default kdc.conf, they're not supposed to
be there, noted by Sam Hartman on krbdev
- try to make gss_krb5_copy_ccache() work correctly for spnego (#542868)
- Depend on crypto-policies which provides /etc/krb5.conf.d (#1225792)
- pull a fix from SVN to try to avoid triggering a PTR lookup in getaddrinfo()
during krb5_sname_to_principal(), and to let getaddrinfo() decide whether or
not to ask for an IPv6 address based on the set of configured interfaces
(#717378, RT#6922)
- pull a fix from SVN to use AI_ADDRCONFIG more often (RT#6923)
- incorporate upstream patch to fix uninitialized pointer crash in the KDC's
authorization data handling (CVE-2010-1322, #636335)
- Use openssl's PRNG in FIPS mode
- Resolves: #1663571
- allocate space for the nul-terminator in the local pathname when looking up
a file context, and properly free a previous context (Jose Plans, #426085)
- fix for CVE-2014-5355 (#1193939) "krb5: unauthenticated
denial of service in recvauth_common() and others"
- pass absolute path to kadm5.keytab if/when extracting keys at startup
- switch to the simplified version of the patch for #1029110 (RT#7764)
- Omit KDC indicator check for S4U2Self requests
- Resolves: #1802334
- ftp: add patch to fix "runique on" case when globbing fixes applied
- stop adding a redundant but harmless call to initialize the gssapi internals
- fix a typo in a ksu error message (Marek Mahut)
- "rev" works the way the test suite expects now, so don't disable tests
that use it
- actually pull up the patch for RT#7063, and not some other ticket (#773496)
- Fix kprop for propagating dump files larger than 4GB
- Resolves: #2026462
- apply fixes from draft of MIT-KRB5-SA-2005-002 (CAN-2005-1174,CAN-2005-1175)
(#157104)
- apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (#159755)
- Fix problem with ccache_name logic in previous build
- Fix arch name (ppc64le, not ppc64el)
- Related-to: #1464381
- fix 32/64-bit bug storing and retrieving the issue_date in v4 credentials
- Use standard trigger logic for krb5 snippet
- Address some optimized-out memset() calls
- Resolves: #1663503
- apply kpasswd bug fixes from David Wragg
- fix bug in krb5.csh which would cause the path check to always succeed
- Fix a leak in the previous commit
- Restore dist macro that was accidentally removed
- Resolves: #1540939
- fix reading of keyUsage extensions when attempting to select pkinit client
certs (part of #629022, RT#6775)
- fix selection of pkinit client certs when one or more don't include a
subjectAltName extension (part of #629022, RT#6774)
- Fix backward check in kprop.service
- move to using pregenerated PDF docs to cure multilib conflicts (#222721)
- temporarily back out %post changes, fix for #143289 for security update
- add preliminary patch to correct unauthorized access via krb5-aware telnet
- fix globbing patch port mode (#139075)
- Allow verification of attributes on krb5.conf
- fix a logic bug in computing key expiration times (RT#6762, #627022)
- include profile.d scriptlets in krb5-devel so that krb5-config will be in
the path if krb5-workstation isn't installed, reported by Kir Kolyshkin
- Correct copyright: it's exportable now, provided the proper paperwork is
filed with the government.
- backed out ncurses and makeshlib patches
- update for krb5-1.1
- add KDC rotation to rc.boot, based on ideas from Michael's C version
- update to beta2
- drop obsolete backports for storing KDC time offsets and expiration times
in keyring credential caches
- fix bug in patch to make rlogind start login with a clean environment a la
netkit rlogin, spotted and fixed by Scott McClung
- Disable dns_canonicalize_hostname. This may break some setups.
- automated rebuild
- patch to handle truncated dns responses
- pull in upstream patch for RT#6952, confusion following referrals for
cross-realm auth (#734341)
- pull in build-time deps for the tests
- revert that last change for a bit while sorting out execstack when we
use AES-NI (#1045699)
- Eliminate preprocessor-disabled dead code
- rebuild
- on EL6, conflict with libsmbclient before 3.5.10-124, which is when it
stopped linking with a symbol which we no longer export (#771687)
- pull up patch for RT#7063, in which not noticing a prompt for a long
time throws the client library's idea of the time difference between it
and the KDC really far out of whack (#773496)
- add a backport of more patches to set the client's list of supported enctypes
when using a keytab to be the list of types of keys in the keytab, plus the
list of other types the client supports but for which it doesn't have keys,
in that order, so that KDCs have a better chance of being able to issue
tickets with session keys of types that the client can use (#837855)
- Patch CVE-2015-2698
- rebuilt
- include .so.* symlinks as well as .so.*.*
- rebuild in new environment
- update to 1.9 final
- pull up the change to make kpasswd's behavior better match the docs
when there's no ccache (#563431)
- Process included directories in alphabetical order
- krb5_get_init_creds_password: check opte->flags instead of options->flags
when checking whether or not we get to use the prompter callback (#555875)
- Don't enable the server by default.
- Compress info pages.
- Add defaults for the PAM module to krb5.conf
- fix for CVE-2014-5352 (#1179856) "gss_process_context_token()
incorrectly frees context (MITKRB5-SA-2015-001)"
- fix for CVE-2014-9421 (#1179857) "kadmind doubly frees partial
deserialization results (MITKRB5-SA-2015-001)"
- fix for CVE-2014-9422 (#1179861) "kadmind incorrectly
validates server principal name (MITKRB5-SA-2015-001)"
- fix for CVE-2014-9423 (#1179863) "libgssrpc server applications
leak uninitialized bytes (MITKRB5-SA-2015-001)"
- backport the callback to use the libkrb5 prompter when we can't load PEM
files for PKINIT (RT#7590, includes part of #965721/#1016690)
- extract the rest of the fix #965721/#1016690 from the changes for RT#7680
- update to 1.6.2
- add "buildrequires: texinfo-tex" to get texi2pdf
- spnego: pull in patch from master to restore preserving the OID of the
mechanism the initiator requested when we have multiple OIDs for the same
mechanism, so that we reply using the same mechanism OID and the initiator
doesn't get confused (#1066000, RT#7858)
- update to 1.4.3
- make ksu setuid again (#137934, others)
- when testing the RPC library, treat denials from the local portmapper the
same as a portmapper-not-running situation, to allow other library tests
to be run while building the package
- add patch based on one from Filip Krska to not call poll() with a negative
timeout when the caller's intent is for us to just stop calling it (#838548)
- Work around KDC client prinicipal in referrals issue (#1259844)
- update to beta 1
- Patch build by disabling failing test; will fix properly soon
- move the package changelog to the end to match the usual style (jdennis)
- scrub out references to $RPM_SOURCE_DIR (jdennis)
- include a symlink to the readme with the name LICENSE so that people can
find it more easily (jdennis)
- Use SHA-256 instead of MD5 for audit ticket IDs
- run kadmin.local correctly at startup
- automated rebuild
- rename krb5.sh and krb5.csh so that they don't overlap (#210623)
- way-late application of added error info in kadmind.init (#65853)
- Bump 1%{?dist} to 2%{?dist} to workaround RPM sort issue
which would lead yum updates to treat the last alpha as newer
than the final version.
- Use the correct patches this time.
- Resolves: #1321135
- Fix incorrect recv() size calculation in libkrad
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- update backport of the preauth module interface
- add proposed patches 4566, 4567
- add proposed edata reporting interface for KDC
- add temporary placeholder for module global context fixes
- Rebuilt for gcc bug 634757
- Set error message on KCM get_princ failure
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- drop a patch we weren't not applying (build tooling)
- wrap kadmind and kpropd in scripts which check for the presence/absence
of files which dictate particular exit codes before exec'ing the actual
binaries, instead of trying to use ConditionPathExists in the unit files
to accomplish that, so that we exit with failure properly when what we
expect isn't actually in effect on the system (#800343)
- Add patch to fix Redhat Bug #1227542 ("[SELinux] AVC denials may appear
when kadmind starts"). The issue was caused by an unneeded |htons()|
which triggered SELinux AVC denials due to the "random" port usage.
- move man pages that live in the -libs subpackage into the regular
%{_mandir} tree where they'll still be found if that package is the
only one installed (#529319)
- drop krshd patch for now
- handle releases where texlive packaging wasn't yet as complicated as it
is in Fedora 18
- fix an uninitialized-variable error building one of the test programs
- fix link flags and permissions on shared libraries (ausil)
- merge security fixes from RHSA-2007:0095
- add missing shebang headers to krsh and krlogin wrapper scripts (#209238)
- add an xinetd configuration file for encryption-only telnetd, parallelling
the kshell/ekshell pair (#167535)
- Backport fix for GSSAPI fallback realm
- Full FIPS compliance
- Resolves: #1754690
- New upstream version (1.18.1)
- Resolves: #1802334
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- update to 1.5
- fix deadlock during file transfer via rsync/krsh
- thanks goes to James Antill for hint
- rebuild
- add patch from Mark Cox for exploitable bugs in ftp client
- rebuilt
- Backport fix for chrome crash in spnego_gss_inquire_context
- Resolves: #1295893
- backport fix for not being able to verify the list of transited realms
in GSS acceptors (RT#7639, #959685)
- backport fix for not being able to pass an empty password to the
get-init-creds APIs and have them actually use it (RT#7642, #960001)
- add backported proposed fix to use the unauthenticated server time
as the basis for computing the requested credential expiration times,
rather than the client's idea of the current time, which could be
significantly incorrect (#961221)
- Add free hook to KDB; increments KDB version
- Add KDB version flag
- fix for CVE-2014-5353 (#1174543) "Fix LDAP misused policy
name crash"
- switch to the upstream patch for #727829
- Fix use of KKDCPP with SNI
- Resolves: #1365027
- add upstream patches to fix standalone kpropd exiting if the per-client
child process exits with an error (MITKRB5-SA-2011-001), a hang or crash
in the KDC when using the LDAP kdb backend, and an uninitialized pointer
use in the KDC (MITKRB5-SA-2011-002) (CVE-2010-4022, #664009,
CVE-2011-0281, #668719, CVE-2011-0282, #668726, CVE-2011-0283, #676126)
- make use of install-info more failsafe (Ville Skyttä, #223704)
- preserve timestamps on shell scriptlets at %install-time
- update to 1.13 alpha1
- drop upstreamed and backported patches
- pull in fix to store KDC time offsets in keyring credential caches (RT#7768,
- pull in fix to set expiration times on credentials stored in keyring
credential caches (RT#7769, #1031724)
- add documentation for the ticket_lifetime option (#561174)
- Fix memory leak in GSSAPI interface
Resolves: RHEL-27250
- Fix memory leak in PMAP RPC interface
Resolves: RHEL-27244
- Make TCP waiting time configurable
Resolves: RHEL-17131
- Fix leaks in gss_inquire_cred_by_oid()
- automatic rebuild
- pull up patch to get the client libraries to correctly perform password
changes over IPv6 (Sumit Bose, RT#6661)
- fix the kpropd init script
- Remove "-nodes" option from make-certs scripts
- Be more careful asking for AS key in SPAKE client
- disable servers by default to keep linuxconf from thinking they need to be
started when they don't
- move the rather large pile of html and pdf docs to -workstation, so
that just having something that links to the libraries won't drag
them onto a system, and we avoid having to sort out hard-coded paths
that include %{_libdir} showing up in docs in multilib packages
- actually create %{_var}/kerberos/kdc/user, so that it can be packaged
- correct the list of packaged man pages
- don't dummy up required tex stylesheets, require them
- require pdflatex and makeindex
- bump again for double-long bug on ppc(64)
- Fix leak of default credentials in gss_inquire_cred()
Resolves: RHEL-32258
- Backport kdc policy plugin, but this time with dependencies
- add in glue code to make sure that libkrb5 continues to provide a
weak copy of stat()
- if the init script fails to start krb5kdc/kadmind/kpropd because it's already
running (according to status()), return 0 (part of #521772)
- rebuild
- fix conditional for future RHEL
- krb5kdc init script: prototype some changes to do a quick spot-check
of the TGS and kadmind keys and warn if there aren't any non-weak keys
on file for them (to flush out parts of #651466)
- tweak configuration files used during tests to try to reduce the number
of conflicts encountered when builds for multiple arches land on the same
builder
- add upstream patch for KDC crash during referral processing (CVE-2009-3295),
via Tom Yu (#545002)
- prefer the kdc which last replied to a request when sending requests to kdcs
- pull the changing of the compiled-in default ccache location to
DIR:/run/user/%{uid}/krb5cc back into F19, in line with SSSD and
the most recent pam_krb5 build
- Fix some broken tests for Python 3
- use PICFLAGS when building code from the ktany patch
- fix an uninitialized length value which could cause a crash when parsing
key data coming from a directory server
- correct a typo in the krb5.conf man page ("ldap_server"->"ldap_servers")
- Use system nss_wrapper and socket_wrapper for testing.
Patch by Andreas Schneider
- removed rpath
- give a little bit more information to the user when kinit gets the catch-all
I/O error (#180175)
- Fix RC4 blocking in FIPS mode
- Resolves: #1660222
- throw in a not-applied-by-default patch to try to make pkinit debugging
into a run-time boolean option named "pkinit_debug"
- Backport upstream certauth EKU fixes
- broke out configuration files
- add patch for buffer overflow in kadmind4 (not used by default)
- libkrad: implement support for Message-Authenticator (CVE-2024-3596)
Resolves: RHEL-50253
- Remove RSA protocol for PKINIT
Resolves: RHEL-17616
- change a LINE_MAX to 1024, fix from Ken Raeburn
- add fix for login vulnerability in case anyone rebuilds without krb4 compat
- add tweaks for byte-swapping macros in krb.h, also from Ken
- add xinetd config files
- make rsh and rlogin quieter
- build with debug to fix credential forwarding
- add rsh as a build-time req because the configure scripts look for it to
determine paths
- rebuild with OpenSSL 1.1.0, added backported upstream patch
- Tom Yu's patch to fix compatibility between 1.2 kadmin and 1.1.1 kadmind
- pull out 6.2 options in the spec file (sonames changing in 1.2 means it's not
compatible with other stuff in 6.2, so no need)
- pull in patch from master to move the default directory which the KDC uses
when computing the socket path for a local OTP daemon from the database
directory (/var/kerberos/krb5kdc) to the newly-added run directory
(/run/krb5kdc), in line with what we're expecting in 1.13 (RT#7859, more
of #1040056 as #1063905)
- add a tmpfiles.d configuration file to have /run/krb5kdc created at
boot-time
- own /var/run/krb5kdc
- gssapi: pull in proposed fix for a double free in initiators (David
Woodhouse, CVE-2014-4343, #1117963)
- and put it back in
- update to 1.2.5
- disable statglue
- remove rc4-hmac:norealm and rc4-hmac:onlyrealm from the default list of
supported keytypes in kdc.conf -- they produce exactly the same keys as
rc4-hmac:normal because rc4 string-to-key ignores salts
- nuke kdcrotate -- there are better ways to balance the load on KDCs, and
the SELinux policy for it would have been scary-looking
- update to 1.3.5, mainly to include MITKRB5SA 2004-002 and 2004-003
- apply second set of buffer overflow fixes from Tom Yu
- fix from Dirk Husung for a bug in buffer cleanups in the test suite
- work around possibly broken rev binary in running test suite
- move default realm configs from /var/kerberos to %{_var}/kerberos
- add preliminary patch to fix buffer overflow in krb5kdc and kadmind
(#231528, CVE-2007-0957)
- add preliminary patch to fix double-free in kadmind (#231537, CVE-2007-1216)
- don't let comments intended for one scriptlet become part of the "script"
that gets passed to ldconfig as part of another one (Mattias Ellert, #1005675)
- Explicitly require python2 packages
- Add upstream lookaside cache behavior fix (RT#7082)
- apply Mike Friedman's patch to fix format string problems
- don't strip off argv[0] when invoking regular rsh/rlogin
- Include fixes for previous commit
- Resolves: #1433083
- Skip test suite on ppc64el
- Related-to: #1464381
- Fix integer overflows in PAC parsing (CVE-2022-42898)
- Resolves: rhbz#2140968
- Fix FTBFS by no longer working around bug in nss_wrapper
- move initscript back
- enable patch for key-expiration reporting
- enable patch to make kpasswd fall back to TCP if UDP fails (#251206)
- enable patch to make kpasswd use the right sequence number on retransmit
- enable patch to allow mech-specific creds delegated under spnego to be found
when searching for creds
- Turn OFD locks back on with glibc workaround
- Resolves: #1274922
- fix indexing error in server sorting patch (#127336)
- move /etc/pam.d/ksu from krb5-workstation-servers to krb5-workstation,
where it's actually needed (#538703)
- add currently-proposed changes to teach ksu about credential cache
collections and the default_ccache_name setting (#1015559,#1026099)
- make proper use of pam_loginuid and pam_selinux in rshd and ftpd
- rebuild in new environment
- fix a type mismatch in krb5_copy_error_message()
- ftp: fix some odd use of strlen()
- selinux labeling: use selabel_open() family of functions rather than
matchpathcon(), bail on it if attempting to get the mutex lock fails
- go back to not messing with library file paths on Fedora 17: it breaks
file path dependencies in other packages, and since Fedora 17 is already
released, breaking that is our fault
- pass -Wl,--warn-shared-textrel to the compiler when we're creating shared
libraries
- create and own /etc/gss (#1019937)
- force -fPIC
- CVE-2024-37370 CVE-2024-37371
Fix vulnerabilities in GSS message token handling
Resolves: RHEL-45398 RHEL-45386
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Backport getrandom() support
- Remove patch numbering
- Update tmpfiles dropin to use /run instead of /var/run
- Resolves: #1945679
- Make klogind pass a clean environment to children, like NetKit's rlogind does.
- add some comments to the ksu patches for the curious
- re-enable optimization on alphas
- Support config snippets in /etc/krb5.conf.d/ and /usr/share/krb5.conf.d/
(#1225792, #1146370, #1145808)
- Fix CVE-2015-8629, CVE-2015-8630, CVE-2015-8631
- update to 1.11 release
- drop patch to suppress key expiration warnings sent from the KDC in
the last-req field, as the KDC is expected to just be configured to either
send them or not as a particular key approaches expiration (#556495)
- pkinit: when verifying signed data, use the CMS APIs for better
interoperability (#636985, RT#6851)
- change /usr/dict/words to /usr/share/dict/words in default kdc.conf (#20000)
- only remove old krb5server init script links if the init script is there
- turn on NSS as the backend for libk5crypto, adding nss-devel as a build
dependency when that switch is flipped
- add patch from Tom Yu to fix ftpd overflows (#37731)
- Add libverto-devel requires for krb5-devel
- Add otp support
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- ksu: move session management calls to before we drop privileges, like
su does (#596887), and don't skip the PAM account check for root or the
same user (more of #540769)
- fix a memory leak when acquiring credentials using a keytab (RT#7586, #911110)
- Add German translation
- move the default acl_file, dict_file, and admin_keytab settings to
the part of the default/example kdc.conf where they'll actually have
an effect (#236417)
- start moving to 1.9 with beta 1
- drop patches for RT#5755, RT#6762, RT#6774, RT#6775
- drop no-longer-needed backport patch for #539423
- drop no-longer-needed patch for CVE-2010-1322
- if WITH_NSS is set, built with --with-crypto-impl=nss (requires NSS 3.12.9)
- don't forget the README
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- rebuilt
- add patch to fix server-side crashes when principals have no
components (CAN-2003-0072)
- started changelog (previous package from zedz.net)
- updated existing 1.0.5 RPM from Eos Linux to krb5 1.0.6
- added --force to makeinfo commands to skip errors during build
- Backport KCM performance enablements
- Resolves: #1956388
- add some minimal description to the top of the wrapper scripts we use
when starting krb5kdc and kadmind to describe why they exist (tooling)
- update to 1.9.1:
- drop no-longer-needed patches for CVE-2010-4022, CVE-2011-0281,
CVE-2011-0282, CVE-2011-0283, CVE-2011-0284, CVE-2011-0285
- Re-enable test suite on ppc64le (no other changes)
- catch krb4 send_to_kdc cases in kdc preference patch
- prereq chkconfig for the server subpackage
- Update otp backport patches (libk5radius => libkrad)
- Use "new" systemd macros for service handling. (Thanks vpavlin!)
- Resolves: #850399
- set SS_LIB at configure-time so that libss-using apps get working readline
support (#197044)
- revise previous patch to initialize one more element
- add patch to correct unauthorized access via krb5-aware telnet
daemon (#229782, CVE-2007-0956)
- add patch to fix buffer overflow in krb5kdc and kadmind
(#231528, CVE-2007-0957)
- add patch to fix double-free in kadmind (#231537, CVE-2007-1216)
- pass some structures by address instead of on the stack in krb5kdc
- update to latest patch kit for MITKRB5-SA-2003-004
- New upstream beta version
- selinux: hang on to the list of selinux contexts, freeing and reloading
it only when the file we read it from is modified, freeing it when the
shared library is being unloaded (#845125)
- fix output of kprop's init script's "status" and "reload" commands (#588222)
- create and own /var/kerberos/krb5/user instead of /var/kerberos/kdc/user,
since that's what the libraries actually look for
- add buildrequires on nss-myhostname, in an attempt to get more of the tests
to run properly during builds
- pull in Simo's patch to recognize "client_keytab" as a key type which can
be passed in to gss_acquire_cred_from() (RT#7598)
- when iterating over lists of interfaces which are "up" from getifaddrs(),
skip over those which have no address (#113347)
- Separate out the kadm5 libs
- add LDCOMBINE=-lc to configure invocation to use libc versioning (bug #10653)
- change Requires: for/in subpackages to include %{version}
- Fix KDC null deref on TGS inner body null server (CVE-2021-37750)
- Resolves: #1997601
- rebuilt
- switch to the updated patch for MITKRB-SA-2006-001
- Add kprop service env config file
- update to 1.12 final
- stop exporting kadmin keys to a keytab file when kadmind starts -- the
daemon's been able to use the database directly for a long long time now
- belatedly add aes128,aes256 to the default set of supported key types
- tag a couple of other patches which we still need to be applied during
%{?_rawbuild} builds (zmraz)
- change cleanup code in post to not tickle chkconfig
- add grep as a Prereq: for -libs
- Add SPAKE support
- Improve protections on internal sensitive buffers
- Improve internal hex encoding/decoding
- Rebuilt for glibc bug#747377
- update to 1.8
- temporarily bundling the krb5-appl package (split upstream as of 1.8)
until its package review is complete
- profile.d scriptlets are now only needed by -workstation-clients
- adjust paths in init scripts
- drop upstreamed fix for KDC denial of service (CVE-2010-0283)
- drop patch to check the user's password correctly using crypt(), which
isn't a code path we hit when we're using PAM
- Fix configuration of default ccache name to match file indentation
- rebuild
- Fix leak in KERB_AP_OPTIONS_CBT server support
- Resolves: #1860831
- Add hostname-based ccselect module
- Resolves: #1463665
- Document -k option in kvno(1) synopsis
- Resolves: #1869055
- use %{_lib} for the sake of multilib systems
- fix for kinit -C loops (#1184629, MIT/krb5 issue 243, "Do not
loop on principal unknown errors").
- Added "python-sphinx-latex" to the build requirements
to fix build failures on F22 machines.
- own the directories which are created for each package (#26342)
- update to 1.2.1
- back out Tom Yu's patch, which is a big chunk of the 1.2 -> 1.2.1 update
- start using the official source tarball instead of its contents
- TEMPORARILY disable usage of OFD locks as a workaround for x86
- rebuild
- disable optimizations on the alpha again
- change back dns_lookup_kdc to the default setting (Stef Walter, #805318)
- comment out example.com examples in default krb5.conf (Stef Walter, #805320)
- put the conditional back for the -devel subpackage
- back down to the earlier version of the patch for #551764; the backported
alternate version was incomplete
- FIPS: disable 3DES and ed25519
- Resolves: #1616326
- Add BuildRequires on python2 so we can run tests at build-time
- build without -g3, which gives us large static libraries in -devel
- Backport my interposer fixes from upstream
- Supersedes krb5-mechglue_inqure_attrs.patch
- Add build dependency on gcc
- add yasm as a build requirement for AES-NI support, on arches that have
yasm and AES-NI
- New upstream release
- Update names and numbers to match external git
- make ksu and v4rcp owned by root
- prevent spurious EBADF in krshd when stdin is closed by the client while
the command is running (#151111)
- update to 1.7
- no need to work around build issues with ASN1BUF_OMIT_INLINE_FUNCS
- configure recognizes --enable/--disable-pkinit now
- configure can take --disable-rpath now
- no more libdes425, krb524d, krb425.info
- kadmin/k5srvutil/ktutil are user commands now
- new kproplog
- FAST encrypted-challenge plugin is new
- drop static build logic
- drop pam_krb5-specific configuration from the default krb5.conf
- drop only-use-v5 flags being passed to various things started by xinetd
- put %{krb5prefix}/sbin in everyone's path, too (#504525)
- fix combination of --with-netlib and --enable-dns (#82176)
- add upstream patch for integer underflow during AES and RC4 decryption
(CVE-2009-4212), via Tom Yu (#545015)
- update to 1.11.2
- drop pulled in patch for RT#7586, included in this release
- drop pulled in patch for RT#7592, included in this release
- pull in fix for keeping track of the message type when parsing FAST requests
in the KDC (RT#7605, #951843) (also #951965)
- try to merge and clean up all the large file support for ftp and rcp
- ftpd no longer prints a negative length when sending a large file
from a 32-bit host
- pull up fix for UDP ping-pong flaw in kpasswd service (CVE-2002-2443,
- silence compiler warning in kprop by using an in-memory ccache with a fixed
name instead of an on-disk ccache with a name generated by tmpnam()
- don't break during %check when the session keyring is revoked
- rebuild
- Gain FIPS awareness
- Resolves: #1660222
- New upstream release - 1.16.1
- Backport certauth plugin and related pkinit changes
- incorporate Simo's updated backport of his updated persistent-keyring changes
(more of #991148)
- rebuild
- Fix network service dependencies
- Resolves: #1525230
- Add PKINIT KDC support for freshness token
- update to 1.2.4
- update to 1.9 beta 3
- Log when non-root ksu authorization fails
- Resolves: #1575771
- Allow to make AD-SIGNEDPATH optional
Resolves: RHEL-10514
- rebuild
- fix a version comparison to expect newer texlive build requirements when
%{_rhel} > 6 rather than when it's > 7
- don't bail from the KDC init script if there's no database, it may be in
a different location than the default (fenlason)
- remove the [kdc] section from the default krb5.conf -- doesn't seem to have
been applicable for a while
- Ensure pwsize is initialized in chpass_util.c
- fix config_subpackage logic
- pull up changes to allow GSSAPI modules to provide more functions
(RT#7682, #986564/#986565)
- some init script cleanups
- drop unquoted check and silent exit for "$NETWORKING" (#426852, #242502)
- krb524: don't barf on missing database if it looks like we're using kldap,
same as for kadmin
- return non-zero status for missing files which cause startup to
fail (#242502)
- update to 1.12.1
- drop patch for RT#7794, included now
- drop patch for RT#7797, included now
- drop patch for RT#7803, included now
- drop patch for RT#7805, included now
- drop patch for RT#7807, included now
- drop patch for RT#7045, included now
- drop patches for RT#7813 and RT#7815, included now
- add patch to always retrieve the KDC time offsets from keyring caches,
so that we don't mistakenly interpret creds as expired before their
time when our clock is ahead of the KDC's (RT#7820, #1030607)
- cover more cases in labeling files on creation
- add missing gawk build dependency
- drop a hunk from the dnsparse patch which is actually redundant (thanks to
Tom Yu)
- back that last change out
- Remove outdated note in krb5kdc man page
- remove libdefault ticket_lifetime option from the default krb5.conf, it is
ignored by libkrb5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- take another stab at accounting for UnversionedDocdirs for the -libs
subpackage (spotted by ssorce)
- switch to just the snapshot of nss_wrapper we were using, since we
no longer need to carry anything that isn't in the cwrap.org repository
(ssorce)
- Up-port a bunch of stuff from the el-7.3 cycle
- Resolves: #1255450, #1314989
- pull down patches from trunk to implement k5login_authoritative and
k5login_directory settings for krb5.conf (#539423)
- rebuild
- Hammer refresh around transient rawhide issue
- pull fix for non-compliant encoding of salt field in etype-info2 preauth
data from 1.3.1 beta 1, until 1.3.1 is released.
- update to 1.8.1
- no longer need patches for #555875, #561174, #563431, RT#6661, CVE-2010-0628
- replace buildrequires on tetex-latex with one on texlive-latex, which is
the package that provides it now
- Fix argument order on strlcpy() in enctype_name()
- Resolves: #1754369
- incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772
(MITKRB5-SA-2004-002, #130732)
- incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, #130732)
- rebuild to compress man pages.
- if we successfully change the user's password during an attempt to get
initial credentials, but then fail to get initial creds from a non-master
using the new password, retry against the master (#432334)
- Restrict pre-authentication fallback cases
- Fix KCM client time offset propagation
- Resolves: #1738553
- update to 1.4.2, incorporating the fixes for MIT-KRB5-SA-2005-002 and
MIT-KRB5-SA-2005-003
- kadmind.init: drop the attempt to detect no-database-present errors (#723723),
which is too fragile in cases where the database has been manually moved or
is accessed through another kdb plugin
- rebuild
- update to 1.3
- Automatically add includedir where not present
- Try removing sleep statement to see if it is still needed
- Resolves: #1433083
- reintroduce ld.so.conf munging in the -libs %post
- handle an assertion failure that starts cropping up when the patch for
using poll (#701446) meets servers that aren't running KDCs or against
which the connection fails for other reasons (#727829, #734172)
- Backport interposer fix (#1284985)
- Drop workaround pwsize initialization patch (gcc has been fixed)
- Explicitly use openssl rather than builtin crypto
- Resolves: #1570910
- fix info page insertions
- Fix krb5kdf support and add proper openssl version requirements
- Resolves: #1754690
- configure --without-krb5-config so that we don't pull in the old default
ccache name when we want to stop setting a default ccache name at configure-
time
- pull the newer F21 defaults back to F20 (sgallagh)
- update backport of the preauth module interface (part of #194654)
- initial update to alpha1
- drop backport of persistent keyring support
- drop backport for RT#7689
- drop obsolete patch for fixing a use-before-init in a test program
- drop obsolete patch teaching config.guess/config.sub about aarch64-linux
- drop backport for RT#7598
- drop backport for RT#7172
- drop backport for RT#7642
- drop backport for RT#7643
- drop patches from master to not test GSSRPC-over-UDP and to not
depend on the portmapper, which are areas where our build systems
often give us trouble, too; obsolete
- drop backports for RT#7682
- drop backport for RT#7709
- drop backport for RT#7590 and partial backport for RT#7680
- drop OTP backport
- drop backports for RT#7656 and RT#7657
- BuildRequires: libedit-devel to prefer it
- BuildRequires: pkgconfig, since configure uses it
- OpenSSL has an epoch, apparently
- Resolves: #1754690
- rebase to master
- update to beta1
- drop obsolete backport of fix for RT#7706
- further munge krb5-config so that 'libdir=/usr/lib' is given even on 64-bit
architectures, to avoid multilib conflicts; other changes will conspire to
strip out the -L flag which uses this, so it should be harmless (#192692)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- apply the fix for CVE-2007-4000 instead of the experimental patch for
setting ok-as-delegate flags
- adjust the patch which removes the use of rpath to also produce a
krb5-config which is okay in multilib environments (#190118)
- make the name-of-the-tempfile comment which compile_et adds to error code
headers always list the same file to avoid conflicts on multilib installations
- strip SIZEOF_LONG out of krb5.h so that it doesn't conflict on multilib boxes
- strip GSS_SIZEOF_LONG out of gssapi.h so that it doesn't conflict on mulitlib
boxes
- Fix KDC null deref on bad encrypted challenge (CVE-2021-36222)
- Resolves: #1983729
- add patches from patchkit from MITKRB5-SA-2003-004 (CAN-2003-0138 and
CAN-2003-0139)
- login: don't truncate passwords before passing them into crypt(), in
case they're significant (#149476)
- switch to the upstream patch for #707145
- kpropd hasn't bothered with -S since 1.11; stop trying to use that flag
in the systemd unit file
- when removing -workstation, remove our files from the info index while
the file is still there, in %preun, rather than %postun, and use the
compressed file's name (#801035)
- kdc.conf: default to listening for TCP clients, too (#248415)
- New upstream release (1.18.2)
- Resolves: #1802334
- rebuild
- fix pid path in krb5kdc.service
- rebuild
- hardcode pid file as option in krb5kdc.service
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- backport fixes to teach libkrb5 to use descriptors higher than FD_SETSIZE
to talk to a KDC by using poll() if it's detected at compile-time (#701446,
RT#6905)
- Fix hex conversion of PKINIT certid strings
- rebuilt
- check more thoroughly for errors when resolving KEYRING ccache names of type
"persistent", which should only have a numeric UID as the next part of the
name (#1029110)
- pull up Simo's patch to mark the correct mechanism on imported GSSAPI
contexts (RT#7592)
- go back to using reconf to run autoconf and autoheader (part of #925640)
- add temporary patch to use newer config.guess/config.sub (more of #925640)
- special-case /run/user/0, attempting to create it when resolving a
directory cache below it fails due to ENOENT and we find that it doesn't
already exist, either, before attempting to create the directory cache
(maybe helping, maybe just making things more confusing for #961235)
- make krb5.conf %verify(not md5 size mtime) in addition to
%config(noreplace), like /etc/nsswitch.conf (#329811)
- turn off NSS as the backend for libk5crypto for now to work around its
DES string2key not working (#679012)
- add revised upstream patch to fix double-free in KDC while returning
typed-data with errors (MITKRB5-SA-2011-003, CVE-2011-0284, #674325)
- add patches for read overflow and null pointer dereference in the
implementation of the SPNEGO mechanism (CVE-2009-0844, CVE-2009-0845)
- add patch for attempt to free uninitialized pointer in libkrb5
(CVE-2009-0846)
- add patch to fix length validation bug in libkrb5 (CVE-2009-0847)
- put the krb5-user .info file into just -workstation and not also
-workstation-clients
- add missing dependency on newer keyutils-libs (#1012034)
- update to 1.10 final
- Fix CVE-2016-3119 (NULL deref in LDAP module)
- Patch CVE-2015-2697, CVE-2015-2696, CVE-2015-2695
- bump release number and rebuild
- Add fix for RedHat Bug #1164304 ("Upstream unit tests loads
the installed shared libraries instead the ones from the build")
- clean up quoting of command-line arguments passed to the krsh/krlogin
wrapper scripts
- patch around TIOCGTLC defined on alpha and remove warnings from libpty.h
- add installation of info docs
- remove krb4 compat patch because it doesn't fix workstation-side servers
- added krb5.csh and krb5.sh to /etc/profile.d
- rebuild
- Remove incorrect KDC assertion
- Resolves: #1673016
- test update to 1.3 beta 4
- ditch statglue build option
- krb5-devel requires e2fsprogs-devel, which now provides libss and libcom_err
- In FIPS mode, add plaintext fallback for RC4 usages and taint
- mark %{krb5prefix}/man so that files which are packaged within it are
flagged as %doc (#168163)
- incorporate fixes for MITKRB5-SA-2007-004 (CVE-2007-2442,CVE-2007-2443)
and MITKRB5-SA-2007-005 (CVE-2007-2798)
- Update from krb5-1.13-alpha1 to final krb5-1.13
- Removed patch for CVE-2014-5351 (#1145425) "krb5: current
keys returned when randomizing the keys for a service principal" -
now part of upstream sources
- Use patch for glibc |eventfd()| prototype mismatch (#1147887) only
for Fedora > 20
- apply upstream patch to fix a null pointer dereference with the LDAP kdb
backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb
backends (CVE-2011-1528), and a null pointer dereference with multiple kdb
backends (CVE-2011-1529) (#737711)
- pull in fix from master to make reporting of errors encountered by
the SPNEGO mechanism work better (RT#7045, part of #1043962)
- update to 1.10.2
- when building the new label for a file we're about to create, also mix
in the current range, in addition to the current user
- also package the PDF format admin, user, and install guides
- drop some PDFs that no longer get built right
- add a backport of Stef's patch to set the client's list of supported
enctypes to match the types of keys that we have when we are using a
keytab to try to get initial credentials, so that a KDC won't send us
an AS reply that we can't encrypt (RT#2131, #748528)
- don't shuffle around any shared libraries on releases with no-separate-/usr,
since /usr/lib is the same place as /lib
- add explicit buildrequires: on 'hostname', for the tests, on systems where
it's in its own package, and require net-tools, which used to provide the
command, everywhere
- fix a null pointer dereference and crash introduced in our PAM patch that
would happen if ftpd was given the name of a user who wasn't known to the
local system, limited to being triggerable by gssapi-authenticated clients by
the default xinetd config (Olivier Fourdan, #569472)
- build
- incorporate Simo's backport of his persistent-keyring changes (#991148)
- restore build-time default DEFCCNAME on Fedora 21 and later and EL, and
instead set default_ccache_name in the default krb5.conf's [libdefaults]
section (#991148)
- on releases where we expect krb5.conf to be configured with a
default_ccache_name, add it whenever we upgrade from an older version of
the package that wouldn't have included it in its default configuration
file (#991148)
- Remove duplication between subpackages
- Resolves: #1250228
- use portreserve correctly -- portrelease takes the basename of the file
whose entries should be released, so we need three files, not one
- update to 1.3.2
- use gcc to build shared libraries
- Fix dependicy on binfmt.service
- update to 1.9 beta 2
- Fix formatting typo in kinit.1 (krb5-kinit-man-typo.patch)
- Prevent overflow when calculating ulog block size (CVE-2025-24528)
Resolves: RHEL-78248
- kdb5_util: fix DB entry flags on modification
Resolves: RHEL-56060
- Restore accidentally dropped patch
- Resolves: #1754690
- Backport fix of memory use after free during libkrad cleanup
- Backport support for larger RADIUS attributes in libkrad
- Resolves: rhbz#2103125
- tweak server init script to automatically extract kadm5 keys if
/var/kerberos/krb5kdc/kadm5.keytab doesn't exist yet
- adjust package descriptions
- Fix SPAKE memory leak
- Fix custom build with -DDEBUG
- New upstream version (1.17)
- Resolves: #1645594
- pull in fix for denial of service by injection of malformed GSSAPI tokens
(CVE-2014-4341, CVE-2014-4342, #1116181)
- Convert Python tests to Python 3
- fix for CVE-2015-2694 (#1216133) "requires_preauth bypass
in PKINIT-enabled KDC".
In MIT krb5 1.12 and later, when the KDC is configured with
PKINIT support, an unauthenticated remote attacker can
bypass the requires_preauth flag on a client principal and
obtain a ciphertext encrypted in the principal's long-term
key. This ciphertext could be used to conduct an off-line
dictionary attack against the user's password.
- Fix setting of AS key in OTP preauth failure
- Ensure we can build with the new CFLAGS
- Remove the git versioning in patches
- update to 1.11.1
- drop patch for noticing negative timeouts being passed to the poll()
wrapper in the client transmit functions
- Enable MD5 override for FIPS RADIUS
- Resolves: #1872689
- use (a bundled, for now, copy of) nss_wrapper to let us run some of the
self-tests at build-time in more places than we could previously (#978756)
- cover inconsistencies in whether or not there's a local caching nameserver
that's willing to answer when the build environment doesn't have a
resolver configuration, so that nss_wrapper's faking of the local
hostname can be complete
- added -lncurses to telnet and telnetd makefiles
- rebuild with keyutils 1.5.8 (part of #1012043)
- fix for CVE-2014-5354 (#1174546) "krb5: NULL pointer
dereference when using keyless entries"
- Remove "python-sphinx-latex" and "tar" from the build requirements
to fix build failures on F22 machines.
- Minor spec cleanup
- gcc 3.3 doesn't implement varargs.h, include stdarg.h instead
- Remove dependency on systemd-sysv which is no longer needed for fedora > 20
This also fixes a fail-to-build issue.
- Miscalaneous spec cleanup fixes
- add patch to accept keytab entries with vno==0 as matches when we're
searching for an entry with a specific name/kvno (#230382/#782211,RT#3349)
- rebuild to pick up the current forms of various patches
- update to 1.10 alpha 1
- on newer releases where we can assume NSS >= 3.13, configure PKINIT to build
using NSS
- on newer releases where we build PKINIT using NSS, configure libk5crypto to
build using NSS
- rename krb5-pkinit-openssl to krb5-pkinit on newer releases where we're
expecting to build PKINIT using NSS instead
- during %check, run check in the library and kdc subdirectories, which
should be able to run inside of the build system without issue
- add and own %{_libdir}/krb5/plugins/authdata
- cut down the number of times we load SELinux labeling configuration from
a minimum of two times to actually one (more of #845125)
- tighten up default permissions on kdc.conf and kadm5.acl (#558343)
- Fix gitignore problem with previous patchset
- compile with %{?_smp_mflags} (Steve Grubb)
- drop the bit where we munge part of the error table header, as it's not
needed any more
- build with -fno-strict-aliasing, which is needed because the library
triggers these warnings
- don't forget to label principal database lock files
- fix the labeling patch so that it doesn't break bootstrapping
- disable kshell and eklogin by default
- New upstream prerelease (1.16-beta2)
- klist: don't trip over referral entries when invoked with -s (#707145,
RT#6915)
- fix the problem where the %license file has been a dangling symlink
- pull in upstream fix for an incorrect check on the value returned by a
strdup() call (#1132062)
- update to 1.10.3, rolling in the fixes from MITKRB5-SA-2012-001
- Fix use of enterprise principals with forwarding
- move condrestarts to postun
- make xinetd configs noreplace
- add descriptions to xinetd configs
- add /etc/init.d as a prereq for the -server package
- patch to properly truncate $TERM in krlogind
- Actually bump kdbversion like I was supposed to
- fix credential forwarding problem in klogind (goof in KRB5CCNAME handling)
(#11588)
- fix heap corruption bug in FTP client (#14301)
- add fixes from MITKRB5-SA-2008-001 for use of null or dangling pointer
when v4 compatibility is enabled on the KDC (CVE-2008-0062, CVE-2008-0063,
- add fixes from MITKRB5-SA-2008-002 for array out-of-bounds accesses when
high-numbered descriptors are used (CVE-2008-0947, #433596)
- add backport bug fix for an attempt to free non-heap memory in
libgssapi_krb5 (CVE-2007-5901, #415321)
- add backport bug fix for a double-free in out-of-memory situations in
libgssapi_krb5 (CVE-2007-5971, #415351)
- apply patch from upstream to fix KDC denial of service (CVE-2010-0283,
- rebuild
- don't discard the error code from an error message received in response
to a change-password request (#658871, RT#6893)
- switch buildrequires: and requires: on e2fsprogs-devel into
buildrequires: and requires: on libss-devel, libcom_err-devel, per
sandeen on fedora-devel-list
- Enable building with bad system /etc/krb5.conf
- Update backports of certauth and corresponding test
- Remove Zanata test glue and related workarounds
- Bug #1234292 ("IPA server cannot be run in container due to incorrect /usr/sbin/_kadmind")
- Bug #1234326 ("krb5-server introduces new rpm dependency on ksh")
- also perform PAM session and credential management when ftpd accepts a
client using strong authentication, missed earlier
- also label kadmind log files and files created by the db2 plugin
- Bump release + rebuild.
- update to 1.3.1
- update to alpha 2
- drop a couple of patches which were integrated for alpha 2
- in login, allow PAM to interact with the user when they've been strongly
authenticated
- in login, signal PAM when we're changing an expired password that it's an
expired password, so that when cracklib flags a password as being weak it's
treated as an error even if we're running as root
- rebuild properly when pthread_mutexattr_setrobust_np() is defined but not
declared, such as with recent glibc when _GNU_SOURCE isn't being used
- add patch to document the reject-bad-transited option in kdc.conf
- suppress warnings of impending password expiration if expiration is more than
seven days away when the KDC reports it via the last-req field, just as we
already do when it reports expiration via the key-expiration field (#556495)
- link with libtinfo rather than libncurses, when we can, in future RHEL
- gettextize init scripts
- move the compiled-in default ccache location from the previous default of
FILE:/tmp/krb5cc_%{uid} to DIR:/run/user/%{uid}/krb5cc (part of #949588)
- Try harder to avoid password change replay errors
- Resolves: #2077563
- update to the 1.2 release
- ditch a lot of our patches which went upstream
- enable use of DNS to look up things at build-time
- disable use of DNS to look up things at run-time in default krb5.conf
- change ownership of the convert-config-files script to root.root
- compress PS docs
- fix some typos in the kinit man page
- run condrestart in server post, and shut down in preun
- Bump release number
- Include more test suite changes from upstream
- Resolves: #1464381
- update backport of the preauth module interface
- Adjust dependency on crypto-polices to be just the file we want
- Patch courtesy of lslebodn
- Resolves: #1308984
- pull in multiple changes to allow replay caches to be added to a GSS
credential store as "rcache"-type credentials (RT#7818/#7819/#7836,
- Fix CVE-2016-3120
- Resolves: #1361051
- incorporate a fix to teach the file labeling bits about when replay caches
are expunged (#576093)
- change the default configured encryption type for KDC databases to the
compiled-in default of des3-hmac-sha1 (#57847)
- ksu: move account management checks to before we drop privileges, like
su does (#540769)
- selinux: set the user part of file creation contexts to match the current
context instead of what we looked up
- configure with --enable-dns-for-realm instead of --enable-dns, which isn't
recognized any more
- Backport usage of SHA-256 instead of SHA-1 for PKINIT CMS digest
- Resolves: #2066316
- fix build failure caused by change of prototype for glibc
|eventfd()| (#1147887)
- Start using crypto-policies
- New upstream version (1.18)
- Resolves: #1802334
- Resolves: #1820311
- Resolves: #1791062
- Resolves: #1784655
- Add temporay workaround for RH bug #1204646 ("krb5-config
returns wrong -specs path") which modifies krb5-config post
build so that development of krb5 dependicies gets unstuck.
This MUST be removed before rawhide becomes F23 ...
- rebuild
- rebuild
- New upstream release - 1.15.1
- update to 1.10.1
- drop the KDC crash fix
- drop the KDC lookaside cache fix
- drop the fix for kadmind RPC ACLs (CVE-2012-1012)
- properly advertise that the kpropd init script now supports force-reload
(Zbysek Mraz, #630587)
- fix a typo in kerberos.ldif
- fix double-free of enc_part2 in krb524d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- override INSTALL_SETUID at build-time so that ksu is installed into
the buildroot with the right permissions (part of #225974)
- when building with our bundled copy of libverto, package it in with -libs
rather than with -server (#886049)
- update to 1.2.7-beta2 (internal only, not for release), dropping dnsparse
and kadmind4 fixes
- remove patch to set TERM in klogind which, combined with the upstream fix in
1.3.1, actually produces the bug now (#114762)
- Backport fix for change password requests when using FAST (RT#7868)
- Fix k5test prompts for Python 3
- have -server require /usr/share/dict/words, which we set as the default
dict_file in kdc.conf (#817089)
- don't include into the telnet client when we're not using curses
- move the db2 kdb plugin from -server to -libs, because a multilib libkdb
might need it
- patch to avoid depending on to define NI_MAXHOST and NI_MAXSERV
- Exit with status 0 from kadmind
- add patch from Tom Yu for exploitable bugs in rpc code used in kadmind
- fix predictable-tempfile-name bug in krb5-send-pr (CAN-2004-0971, #140036)
- pull patch from svn to undo unintentional chattiness in ftp
- pull patch from svn to handle NULL krb5_get_init_creds_opt structures
better in a couple of places where they're expected
- Update to krb5-1.13.2
- drop patch for krb5-1.13.2-CVE_2015_2694_requires_preauth_bypass_in_PKINIT_enabled_KDC, fixed in krb5-1.13.2
- drop patch for krb5-1.12.1-CVE_2014_5355_fix_krb5_read_message_handling, fixed in krb5-1.13.2
- Add script processing for upcoming Zanata l10n support
- Minor spec cleanup
- make PAM support for ksu also set PAM_RUSER
- fixed server package so that it works now
- drop netdb patch
- kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that
the DISALLOW_ALL_TIX flag is set on an entry, for better interop with Fedora,
Netscape, Red Hat Directory Server (Simo Sorce)
- rebuild on 1.1.1
- pull in fix for building against tcl 8.6 (#1107061)
- rebuild
- fix double-close in keytab handling
- add port of fixes for CAN-2004-0175 to krb5-aware rcp (#151612)
- fix comments in krb5-configs
- pull up fix for not calling a kdb plugin's check-transited-path
method before calling the library's default version, which only knows
how to read what's in the configuration file (RT#7709, #1013664)
- clear fuzz out of patches, dropping a man page patch which is no longer
necessary
- quote %{__cc} where needed because it includes whitespace now
- define ASN1BUF_OMIT_INLINE_FUNCS at compile-time (for now) to keep building
- make profile.d scriptlets mode 644 instead of 755 (part of #225974)
- backport change from SVN to fix a computed-value-not-used warning in
kpropd (#684065)
- pull in changes from upstream which add processing of the contents of
/etc/gss/mech.d/*.conf when loading GSS modules (#1102839)
- work around a compile problem with new openssl
- Fix KDC null dereference on large TGS replies
- update to 1.3.4 final
- always #include to access errno, never do it directly
- enable LFS on a bunch of other 32-bit arches
- update to 1.8.2
- drop patches for CVE-2010-1320, CVE-2010-1321
- New rawhide, new upstream version
- Drop CVE patches
- Rename fix_interposer.patch to acquire_cred_interposer.patch
- Update acquire_cred_interposer.patch to apply to new source
- update to 1.7.1
- don't trip AD lockout on wrong password (#542687, #554351)
- incorporates fixes for CVE-2009-4212 and CVE-2009-3295
- fixes gss_krb5_copy_ccache() when SPNEGO is used
- move sim_client/sim_server, gss-client/gss-server, uuclient/uuserver to
the devel subpackage, better lining up with the expected krb5/krb5-appl
split in 1.8
- drop kvno,kadmin,k5srvutil,ktutil from -workstation-servers, as it already
depends on -workstation which also includes them
- refresh nss_wrapper and add socket_wrapper to the %check environment
- pull in patch for RT#7046: tag a ccache containing credentials obtained via
S4U2Proxy with the principal name of the proxying principal (part of #761317)
so that the default principal name can be set to that of the client for which
it is proxying, which results in the ccache looking more normal to consumers
of the ccache that don't care that there's proxying going on
- pull in patch for RT#7047: allow tickets obtained via S4U2Proxy to be cached
(more of #761317)
- pull in patch for RT#7048: allow PAC verification to only bother trying to
verify the signature with keys that it's given (still more of #761317)
- omit dependent libraries from the krb5-config --libs output, as using
shared libraries (no more static libraries) makes them unnecessary and
they're not part of the libkrb5 interface (patch by Rex Dieter, #240220)
(strips out libkeyutils, libresolv, libdl)
- add more etypes (arcfour) to the default enctype list in kdc.conf
- don't apply previous patch, refused upstream
- fix segfault in telnet due to incorrect checking of gethostbyname_r result
codes (#129059)
- Fix pkinit_anchors path
- Resolves: #1661339
- Fix KDC return code and set prompt types for OTP client preauth
- Resolves: #1370072
- only apply the patch to autocreate /run/user/0 when we're hard-wiring the
default ccache location to be under it; otherwise it's unnecessary
- Make docs build python3-compatible
- Resolves: #1590928
- update to 1.2.8
- Save other programs from worrying about CVE-2017-11462
- Resolves: #1488873
- Resolves: #1488874
- Merge duplicate subsections in profile library
- New upstream release
- Update selinux with RHEL hygene
- Resolves: #1314096
- Drop dependency on pax, ksh
- Remove support for fedora < 20
- Fix log file permissions patch with our selinux
- Resolves: #1309421
- Make krb5kdc -p affect TCP ports
- label all files at creation-time according to the SELinux policy (#228157)
- New upstream release
- pam_rhosts_auth.so's been gone, use pam_rhosts.so instead
- add bison as a BuildPrereq (#20091)
- rebuild
- backport patch to disable replay detection in krb5_verify_init_creds()
while reading the AP-REQ that's generated in the same function (RT#7229)
- update the PIC patch for iaesx86.s to not use ELF relocations to the version
that landed upstream (RT#7815, #1045699)
- back out setting default_ccache_name to the new default for now, resetting
it to the old default while the kernel/keyutils bits get sorted (sgallagh)
- use portreserve to make sure the KDC can always bind to the kerberos-iv
port, kpropd can always bind to the krb5_prop port, and that kadmind can
always bind to the kerberos-adm port (#555279)
- correct inadvertent use of macros in the changelog (rpmlint)
- Fix source URLs in spec file
- Resolves: #1755959
- switch to the version of persistent-keyring that was just merged to
master (RT#7711), along with related changes to kinit (RT#7689)
- go back to setting default_ccache_name to a KEYRING type
- don't forget to set the SELinux label when creating the directory for
a DIR: ccache
- pull in proposed fix for attempts to get initial creds, which end up
following referrals, incorrectly trying to always use master KDCs if
they talked to a master at any point (should fix RT#7650)
- Put KDB authdata first
- Resolves: #1800575
- Move krb5-kdb-version provides from -libs to -devel
- Fix upstream URLs in spec file
- Resolves: #1868039
- Pass gss_localname() through SPNEGO
- Resolves: #1802334
- Display an error message if ocsp pkinit is requested
- add buildrequires: on keyutils-libs-devel to enable use of keyring ccaches,
dragging keyutils-libs in as a dependency
- move /usr/kerberos/bin to end of PATH
- install kadmin header files
- update a test wrapper to properly handle things that the new libkrad does,
and add python-pyrad as a build requirement so that we can run its tests
- New upstream version 1.14.3
- Update to krb5-1.13.1
- drop patch for CVE_2014_5353_fix_LDAP_misused_policy_name_crash, fixed in krb5-1.13.1
- drop patch for kinit -C loops (MIT/krb5 bug #243), fixed in krb5-1.13.1
- drop patch for CVEs { 2014-9421, 2014-9422, 2014-9423, 2014-5352 }, fixed in krb5-1.13.1
- Minor spec cleanup
- Drop dependency on python2-pyrad (dead upstream, broken with new python)
- Switch to using autosetup macro.
- Patches come from git, so it is easiest to just make a git repo
- fixup some int/pointer varargs wackiness
- update to 1.3.6, which includes the previous fix
- build even libdb.a with -fPIC and $RPM_OPT_FLAGS.
- apply upstream patch by way of Burt Holzman to fall back to a non-referral
method in cases where we might be derailed by a KDC that rejects the
canonicalize option (for example, those from the RHEL 2.1 or 3 era) (#715074)
- build alpha with -O0 for now
- Fix flaws in LDAP DN checking
- CVE-2018-5729, CVE-2018-5730
- add some conditional logic to simplify building on older Fedora releases
- turn off krb4 support (it won't be part of the 1.7 release, but do it now)
- use triggeruns to properly shut down and disable krb524d when -server and
-workstation-servers gets upgraded, because it's gone now
- move the libraries to /%{_lib}, but leave --libdir alone so that plugins
get installed and are searched for in the same locations (#473333)
- clean up buildprereq/prereqs, explicit mktemp requires, and add the
ldconfig for the -server-ldap subpackage (part of #225974)
- escape possible macros in the changelog (part of #225974)
- fixup summary texts (part of #225974)
- take the execute bit off of the protocol docs (part of #225974)
- unflag init scripts as configuration files (part of #225974)
- make the kpropd init script treat 'reload' as 'restart' (part of #225974)
- update to 1.3.4 beta1
- remove MITKRB5-SA-2004-001, included in 1.3.4
- Backport patch to fix mechglue for gss_inqure_attrs_for_mech()
- respin with updated version of patch for RT#7650 (#969331)
- pull up latest revision of patch to reduce lockups in rsh/rshd
- drop patch to add additional access() checks to ksu - they add to breakage
when non-FILE: caches are in use (#1026099), shouldn't be resulting in any
benefit, and clash with proposed changes to fix its cache handling
- add deadlock patch, removed old patch
- fix for CVE-2014-5351 (#1145425) "krb5: current keys returned when
randomizing the keys for a service principal"
- fix buffer underrun in unparsing certain principals (CAN-2003-0082)
- New upstream release - krb5-1.15.2
- Adjust patches as appropriate
- Properly close krad sockets
- Resolves: #1380836
- switch man pages to being generated with the right paths in them
- drop old, incomplete SELinux patch
- add patch from Greg Hudson to make srvtab routines report missing-file errors
at same point that keytab routines do (#241805)
- update to 1.2.2, which fixes some bugs relating to empty ETYPE-INFO
- re-enable optimization on Alpha
- use %global instead of %define
- pull up proposed patch for creating previously-not-there lock files for
kdb databases when 'kdb5_util' is called to 'load' (#551764)
- Nix /usr/share/krb5.conf.d to reduce complexity
- update to 1.11.4
- drop patch for RT#7650, obsoleted
- drop patch for RT#7706, obsoleted as RT#7723
- drop patch for CVE-2013-1418/CVE-2013-6800, included in 1.11.4
- fix double-free in the kdc (patch merged into MIT tree)
- include convert-config-files script as a documentation file
- Fix CVE-2017-15088 (Buffer overflow in get_matching_data())
- extend PAM support to ksu: perform account and session management for the
target user
- pull up and merge James Leddy's changes to also set PAM_RHOST in PAM-aware
network-facing services
- incorporate updated fix for CVE-2007-3999 (CVE-2007-4743)
- fix incorrect call to "test" in the kadmin init script (#252322,#287291)
- add patch to fix telnetd vulnerability
- Clean up etype display on KDC
- Resolves: #1664157
- Log preauth names in trace output
- Misc bugfixes from upstream
- Add APIs for marshalling credentials
- Resolves: #1964619
- prebuild PDF docs to reduce multilib differences (internal tooling, #884065)
- drop the kerberos-iv portreserve file, and drop the rest on systemd systems
- escape uses of macros in comments (more of #884065)
- tell krb5kdc and kadmind to create pid files, since they can
- add logrotate configuration files for krb5kdc and kadmind (#462658)
- fix parsing of the pidfile option in the KDC (upstream #6750)
- specify the location of the subsystem lock when using the status() function
in the kadmind and kpropd init scripts, so that we get the right error when
we're dead but have a lock file - requires initscripts 8.99 (#521772)
- remove the krb5-appl bits (the -workstation-clients and -workstation-servers
subpackages) now that krb5-appl is its own package
- replace our patch for #563431 (kpasswd doesn't fall back to guessing your
principal name using your user name if you don't have a ccache) with the
one upstream uses
- backport a fix to allow a PKINIT client to handle SignedData from a KDC
that's signed with a certificate that isn't in the SignedData, but which
is available as an anchor or intermediate on the client (RT#7183)
- pull in keyutils as a build requirement to get the "KEYRING:" ccache type,
because we've merged
- remove setuid bit on v4rcp and ksu in case the checks previously added
don't close all of the problems in ksu
- apply patches from Jeffrey Schiller to fix overruns Chris Evans found
- reintroduce configs subpackage for use in the errata
- add PreReq: sh-utils
- update to 1.11 beta 2
- refresh patch for #542868 from trunk
- Add support to query the SSF of a context
- Pick up rename of perl dependency
- generate src/include/krb5/krb5.h before building
- fix conditional for sparcv9
- Switch to %ldconfig_scriptlets
- mark profile.d config files noreplace (Laurent Rineau, #196447)
- fix krb5-send-pr (#18932) and move it from -server to -workstation
- buildprereq libtermcap-devel
- temporariliy disable optimization on alphas
- gettextize init scripts
- build alpha with -O0 for now
- own %{_var}/kerberos
- Zap data when freeing krb5_spake_factor
- fix broken dependency on awk (should be gawk, rdieter)
- libgssapi: pull in patch from svn to stop returning context-expired errors
when the ticket which was used to set up the context expires (#605366,
upstream #6739)
- kadmin.service: fix #723723 again
- kadmin.service,krb5kdc.service: remove optional use of $KRB5REALM in command
lines, because systemd parsing doesn't handle alternate value shell variable
syntax
- kprop.service: add missing Type=forking so that systemd doesn't assume simple
- kprop.service: expect the ACL configuration to be there, not absent
- handle a harder-to-trigger assertion failure that starts cropping up when we
exit the transmit loop on time (#739853)
- Add flag to disable encrypted timestamp on client
- rebuild
- New upstream prerelease (1.16-beta1)
- apply upstream patch to fix a null pointer dereference when processing
TGS requests (CVE-2011-1530, #753748)
- Remove WITH_NSS macro (always false)
- Remove WITH_SYSTEMD macro (always true)
- Remove WITH_LDAP macro (always true)
- Remove WITH_OPENSSL macro (always true)
- fix summaries and descriptions
- switched the default transfer protocol from PORT to PASV as proposed on
bugzilla (#16134), and to match the regular ftp package's behavior
- Add send/receive sendto_kdc hooks and corresponding tests
- Resolves: #1321135
- clean up init script for server, verify that it works [jlkatz]
- clean up rotation script so that rc likes it better
- add clean stanza
- add patch to build semi-useful static libraries, but don't apply it unless
we need them
- Continue after KRB5_CC_END in KCM cache iteration
- Fix capaths "." values on client
- Resolves: 1551099
- rebuild
- grab a more-commented version of the most recent patch from upstream
master
- make a guess at making the 32-bit AES-NI implementation sufficiently
position-independent to not require execmod permissions for libk5crypto
(more of #1045699)
- make krb5-libs obsolete the old krb5-configs package (#18351)
- don't quit from the kpropd init script if there's no principal database so
that you can propagate the first time without running kpropd manually
- don't complain if /etc/ld.so.conf doesn't exist in the -libs %post
- use %{_infodir} to better comply with FHS
- move .so files to -devel subpackage
- tweak xinetd config files (bugs #11833, #11835, #11836, #11840)
- fix package descriptions again
- apply fix from Tom Yu for MITKRB5-SA-2004-004 (CAN-2004-1189)
- Upstream release. No actual change from beta, just version bump
- Clean up unused parts of spec file
- Fix CVE-2017-11368 (remote triggerable assertion failure)
- fix a compile error in the SELinux labeling patch when -DDEBUG is used (Sumit
Bose)
- Put openssl runtime requirement in the right place this time
- Resolves: #1754690
- Backport kdcpolicy interface
- amend the PIC patch for iaesx86.s to also save/restore ebx in the
functions where we modify it, because the ELF spec says we need to
- Backport certauth eku security fix
- pull in patch from trunk to rename krb5int_pac_sign() to krb5_pac_sign() and
make it public (#745533)
- pull a fix from SVN to get libgssrpc clients (e.g. kadmin) authenticating
using the old protocol over IPv4 again (RT#6920)
- Add krb5_db_register_keytab
- Resolves: #1376812
- correct a bug in the fix for #754001 so that the file creation context is
consistently reset
- Add upstream crashfix patch (RT#7081)
- skip the setfscreatecon() if fopen() is passed "rb" as the open mode (part
of #819115)
- rebuild
- Guess Samba client mutual flag using ap_option
- Resolves: #1370980
- pull up fix for importing previously-exported credential caches in the
gssapi library (RT# 7706, #1019420)
- modify the deltat grammar to also tell gcc (4.7) to suppress
"maybe-uninitialized" warnings in addition to the "uninitialized" warnings
it's already being told to suppress (RT#7080)
- Unify kvno option documentation
- Resolves: #1869055
- Update otp patches
- Merge otp patches into a single patch
- Add keycheck patch
- libgssapi_krb5: properly export the acceptor subkey when creating a lucid
context (Kevin Coffman, via the nfs4 mailing list)
- Use full paths in krb5.sh to avoid path lookups
- set "rdns = false" in the default krb5.conf (#908323,#908324)
- New upstream release
- add an auth stack to ksu's PAM configuration so that pam_setcred() calls
won't just fail
- reintroduce missing %postun for the non-split_workstation case
- add missing pam-devel build requirement, force selinux-or-fail build
- kadmind.init: don't fail outright if the default principal database
isn't there if it looks like we might be using the kldap plugin
- kadmind.init: attempt to extract the key for the host-specific kadmin
service when we try to create the keytab
- Remove downloadable source signature file
- Resolves: rhbz#2219654
- apply updated patch from MITKRB5-SA-2004-001 (revision 2004-06-02)
- add upstream fix for denial-of-service in SPNEGO (CVE-2010-0628, #576325)
- kdc.conf: no more need to suggest keeping keys with v4-compatible salting
libXv-1.0.11-7.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Use ldconfig scriptlet macros
- libXv 1.0.10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- libXv 1.0.11
- fixes CVE-2016-5407
- libXv 1.0.9
- Drop useless %defattr
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
libasyncns-0.8-14.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- New release
- Initial packaging
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- New release
- New release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- New release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
libatomic-8.5.0-28.el8_10.x86_64.rpm | - Add a plugin-annobin subpackage. (#2067150)
- rebuild
- Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90240)
- add -Wbidi-chars patch (#2008392)
- avoid cycling on certain subreg reloads (PR rtl-optimization/96796, #2028798)
- fix bad use of VMAT_CONTIGUOUS (PR tree-optimization/97236, #1925632)
- backport workaround for broken C/C++ wrappers to LAPACK (#1711346)
- backport aarch64 LSE atomics (#1821994)
- apply cprop_hardreg fix for narrow mode != lowpart targets (#2028609)
- avoid changing PHIs in GIMPLE split_edge (#2117838)
- update from Fedora 8.1.1-1
- require docbook-style-xsl instead of docbook5-style-xsl (#2073888)
- backport Default widths with -fdec-format-defaults patch (#2074614)
- fix strlen range with a flexible member array (#2137448)
- Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-50290).
- enable annobin annotations (#1574936)
- update from Fedora 8.2.1-1
- backport straight-line-speculation mitigation (#2108721)
- update from GCC 8.5 release (#1946758)
- this includes a fix for PR target/87839 (#1958295)
- rebuild
- fix BuildRequires of python-sphinx
- fix deserialization for std::normal_distribution (#2130392,
PR libstdc++/105502)
- initialize std::normal_distribution::_M_saved (PR libstdc++/99536)
- reject std::make_shared (PR libstdc++/99006)
- fix ICE in the vectorizer (RHEL-32886)
- backport PCH tweaks (#2030878)
- fix mangling of lambdas in default args (PR c++/91241, #1981822)
- add a few Provides: bundled
- rebuild for CVE-2020-11023 (RHEL-78274)
- revert upstream PR85873 gcc-8 fix, apply the fix from gcc-9 (#1960701)
- fix 'this' adjustment for devirtualized call (PR c++/100797, #1965951)
- fix for TLSLD references (#2213753)
- fix crash in dynamic_cast<>() on null pointer (PR c++/99074, #2211506)
- adjust a pattern in s390.md (PR target/87723, #2214847)
- when linking against libgcc_s, link libgcc.a too (#2022588)
- Sync libstdc++ pretty printers to latest GTS (RHEL-50290).
- update from Fedora gcc-8.3.1-5 (#1747157)
- use unspec_volatile for darn (PR target/91481, #1760205, CVE-2019-15847)
- avoid IFUNC resolver access to uninitialized data (#1559350, PR libgcc/60790)
- fix typos in manual (#1612514)
- update from Fedora 8.3.1-3 (#1680182)
- remove load and test FP splitter (#1673116)
- fix *movsi_from_df (#1677652)
- add missing headers
- add support for live patching (#1668903)
- retire gcc8-rh1612514.patch, gcc8-rh1652016.patch, gcc8-rh1652929-?.patch
- Fix nop generation in annobin plugin. (#2067150)
- update from GCC 8.4 release (#1946758)
- back out the PR97236 patch
- update from Fedora 8.2.1-3
- update from Fedora 8.1.1-5
- update from Fedora 8.3.1-4 (#1680182)
- drop gcc8-pr60790.patch, gcc8-pr89629.patch, gcc8-rh1668903-4.patch
- don't reuse DEBUG_EXPRs with vector type (PR middle-end/100508, RHEL-79501)
- guard the bit test merging code in if-combine (RHEL-11483)
- enable hardening of binaries (#1624114)
- disable libgccjit on RHEL
- backport the -fuse-ld=lld option (#1670535)
- TLS model fix (#1678555, PR c++/85400)
- two small autoFDO fixes (#1686082)
- libgomp update (#1707568)
- member template redeclaration fix (#1652704, PR c++/86747)
- turn libgcc_s.so into a linker script on i?86, x86_64, ppc64le and also on
ppc and ppc64 for 64-bit multilib (#1708309)
- avoid using unaligned vsx or lxvd2x/stxvd2x for memcpy/memmove inline
expansion (#1666977)
- consider negative edges in cycle detection (#1817991, PR gcov-profile/91601)
- fix Fortran debug info for arrays with descriptors (#1655624,
PR fortran/92775)
- fix wrong code emitted for movv1qi on s390x (#1784758, PR target/92950)
- remove python2 dependecy (#1595385)
- s390x: add support for register arguments preserving (#2168205)
- remove support for demangling GCC 2.x era mangling schemes (#1668394)
- Backport PPC string inlines from trunk which allow for valgrind's
memcheck to work properly (#1652929)
- Backport bugfix for clz pattern on s390 affecting jemalloc (#1652016)
- backport std::regex check for invalid range (#2001788)
- change the default -march on s390x to z13 with tuning for z14 (#1571124)
- use --disable-multilib on s390x
- update from GCC 8.4 release (#1868446)
- remove symlinks to 32-bit versions of these static libraries: libasan.a,
libitm.a, libquadmath.a, libubsan.a, libgfortran.a (#1779597)
- tweak gcc8-rh1668903-1.patch and gcc8-rh1668903-2.patch patches
- fix typo in the cprop_hardreg patch (#2028609)
- new package
- Sync libstdc++ pretty printers to latest GTS (RHEL-82506).
- aarch64: Add -mtune=neoverse-512tvb (#1845932)
- additional fix for the libgomp testsuite (#1707568)
- fix shift count operand printing (#1730380)
- fix tree-outof-ssa.c ICE with vector types (PR middle-end/90139, #1730454)
- fix out-of-ssa with unsupported vector types (PR rtl-optimization/90756,
- fix ICE with template placeholder for TTP (PR c++/86098, #1730454)
libdvdnav-5.0.3-8.el8.x86_64.rpm | - 0:0.1.9-0.fdr.2: incorporated bugzilla suggestions, new release
- use upstream non-autotools buildsystem
- build with external libdvdread for older releases
- fix version.h
- fix soname
- fix lib paths on 64bit
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- update to current snapshot from new upstream
- clean up some specfile cruft
- disable static libs
- drop unnecessary explicit dependency on libdvdread
- Autorebuild for GCC 4.3
- Update to 0.1.10.
- Disable dependency tracking to speed up the build.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- 0:0.1.9-0.fdr.1: initial RPM release
- fix FTBFS due to doc files in the wrong place (#1307717)
- use license macro
- drop unnecessary defattr declarations
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Drop Epoch completely
- update to 5.0.3
- drop obsolete patches
- BR libdvdread 5.0.2
- update to 4.1.3 final
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- backport patches upstream git master to fix several known bugs
(LP #1236939, #570790)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- update to current SVN
- use new external libdvdread
- make sure -devel requires our version of libdvdread-devel
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- fix missing include (bug 428910)
- add dist
- update to 4.1.2
- drop obsolete patches (merged upstream)
- fix multilib conflict, based on a patch by Rex Dieter (rhbz#477684)
- update to SVN r1184
- move TODO to devel docs
- switch to new release field
- drop Epoch
- update to 4.2.1
- drop obsolete/redundant specfile elements
- add upstream URL
- fix segfault when cell is empty, patch by Simo Sorce, bug #902037
- drop obsolete patch
- fix FTBFS (rhbz#1106007)
- switch to new upstream
- libdvdread comes from here now
- apply dvdread udf-related fixes from upstream SVN
- update to 5.0.1
- drop obsolete patches
- fix build with internal libdvdread
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- update to SVN r1226
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- update to 4.1.3rc1
- require libdvdread with fixed API
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- update to 4.2.0
- add missing file to -devel
- update to current SVN (pre-4.1.3)
- macroize
- re-enable parallel make
- update to current snapshot
- specfile cleanups
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
libdvdread-5.0.3-9.el8.x86_64.rpm | - fix missing include (bug 428910)
- fix multilib conflict (#477687)
- Rebuild.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Updated to version 0.9.2
- Spec file cleanup and fixes.
- Added small patch to fix the ldopen of libdvdcss
- Reverted back to using libdvdcss 0.0.3.ogle3 since it works MUCH better
than 1.0.x. Doh!
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Escape macros in %changelog
- We BuildConflicting libdvdcss-devel at build time
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- rebuild for BuildID
- update license tag
- updated to SVN r1226
- dropped obsolete endianness check patch
- updated to SVN r1188 (rhbz#540155)
- Updated to 0.9.7
- Rebuilt against libdvdcss 1.0.0 (added a patch).
- Drop Epoch completely
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- update to 4.1.3rc1
- fix include path
- updated to 4.2.0 release
- Update to 0.9.3.
- updated to SVN r1183
- simplified multilib patch
- fixed endianness issues (rhbz#442508)
- added some docs
- update to 5.0.3
- Rebuilt for Red Hat Linux 9.
- Exclude .la file.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- add dist
- fix hanging on scanning title (patch by John Stebbins)
- Updated to version 0.9.0
- Fix linking with libdl on x86_64.
- Don't ship static libs.
- Build with dependency tracking disabled.
- Convert specfile and docs to UTF-8.
- Improve package descriptions.
- resurrect package from new upstream
- Initial Fedora RPM release.
- 0.9.6.
- Specfile cleanup.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- updated to 4.2.1 release
- drop obsolete/redundant specfile elements
- add upstream URL
- add missing provides for bundled md5 copylib
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuild.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- switch to new release field
- drop Epoch
- Back to using libdvdcss 1.1.1, now it's all merged and fine.
- Rebuilt against Red Hat Linux 7.3.
- Added the %{?_smp_mflags} expansion.
- update to 4.1.3 final
- Own package doc dir, install COPYING as %license
- Split into normal and devel package
- package documentation properly
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- update to 5.0.0 release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- update to 4.9.9 release
- drop obsolete patch
- switch to autotools configure
- fix bogus date in changelog
- Fixed the libdvdcss.so.0/1/2 problem again.
- update to 5.0.2
- use https for source URL
- make build more verbose
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- initial version
- Updated to the latest cvs release.
- Rebuilt for Red Hat Linux 8.0.
- Updated URLs.
- Updated to version 0.9.1
- Update to 0.9.4.
libgfortran-8.5.0-28.el8_10.x86_64.rpm | - Add a plugin-annobin subpackage. (#2067150)
- rebuild
- Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90240)
- add -Wbidi-chars patch (#2008392)
- avoid cycling on certain subreg reloads (PR rtl-optimization/96796, #2028798)
- fix bad use of VMAT_CONTIGUOUS (PR tree-optimization/97236, #1925632)
- backport workaround for broken C/C++ wrappers to LAPACK (#1711346)
- backport aarch64 LSE atomics (#1821994)
- apply cprop_hardreg fix for narrow mode != lowpart targets (#2028609)
- avoid changing PHIs in GIMPLE split_edge (#2117838)
- update from Fedora 8.1.1-1
- require docbook-style-xsl instead of docbook5-style-xsl (#2073888)
- backport Default widths with -fdec-format-defaults patch (#2074614)
- fix strlen range with a flexible member array (#2137448)
- Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-50290).
- enable annobin annotations (#1574936)
- update from Fedora 8.2.1-1
- backport straight-line-speculation mitigation (#2108721)
- update from GCC 8.5 release (#1946758)
- this includes a fix for PR target/87839 (#1958295)
- rebuild
- fix BuildRequires of python-sphinx
- fix deserialization for std::normal_distribution (#2130392,
PR libstdc++/105502)
- initialize std::normal_distribution::_M_saved (PR libstdc++/99536)
- reject std::make_shared (PR libstdc++/99006)
- fix ICE in the vectorizer (RHEL-32886)
- backport PCH tweaks (#2030878)
- fix mangling of lambdas in default args (PR c++/91241, #1981822)
- add a few Provides: bundled
- rebuild for CVE-2020-11023 (RHEL-78274)
- revert upstream PR85873 gcc-8 fix, apply the fix from gcc-9 (#1960701)
- fix 'this' adjustment for devirtualized call (PR c++/100797, #1965951)
- fix for TLSLD references (#2213753)
- fix crash in dynamic_cast<>() on null pointer (PR c++/99074, #2211506)
- adjust a pattern in s390.md (PR target/87723, #2214847)
- when linking against libgcc_s, link libgcc.a too (#2022588)
- Sync libstdc++ pretty printers to latest GTS (RHEL-50290).
- update from Fedora gcc-8.3.1-5 (#1747157)
- use unspec_volatile for darn (PR target/91481, #1760205, CVE-2019-15847)
- avoid IFUNC resolver access to uninitialized data (#1559350, PR libgcc/60790)
- fix typos in manual (#1612514)
- update from Fedora 8.3.1-3 (#1680182)
- remove load and test FP splitter (#1673116)
- fix *movsi_from_df (#1677652)
- add missing headers
- add support for live patching (#1668903)
- retire gcc8-rh1612514.patch, gcc8-rh1652016.patch, gcc8-rh1652929-?.patch
- Fix nop generation in annobin plugin. (#2067150)
- update from GCC 8.4 release (#1946758)
- back out the PR97236 patch
- update from Fedora 8.2.1-3
- update from Fedora 8.1.1-5
- update from Fedora 8.3.1-4 (#1680182)
- drop gcc8-pr60790.patch, gcc8-pr89629.patch, gcc8-rh1668903-4.patch
- don't reuse DEBUG_EXPRs with vector type (PR middle-end/100508, RHEL-79501)
- guard the bit test merging code in if-combine (RHEL-11483)
- enable hardening of binaries (#1624114)
- disable libgccjit on RHEL
- backport the -fuse-ld=lld option (#1670535)
- TLS model fix (#1678555, PR c++/85400)
- two small autoFDO fixes (#1686082)
- libgomp update (#1707568)
- member template redeclaration fix (#1652704, PR c++/86747)
- turn libgcc_s.so into a linker script on i?86, x86_64, ppc64le and also on
ppc and ppc64 for 64-bit multilib (#1708309)
- avoid using unaligned vsx or lxvd2x/stxvd2x for memcpy/memmove inline
expansion (#1666977)
- consider negative edges in cycle detection (#1817991, PR gcov-profile/91601)
- fix Fortran debug info for arrays with descriptors (#1655624,
PR fortran/92775)
- fix wrong code emitted for movv1qi on s390x (#1784758, PR target/92950)
- remove python2 dependecy (#1595385)
- s390x: add support for register arguments preserving (#2168205)
- remove support for demangling GCC 2.x era mangling schemes (#1668394)
- Backport PPC string inlines from trunk which allow for valgrind's
memcheck to work properly (#1652929)
- Backport bugfix for clz pattern on s390 affecting jemalloc (#1652016)
- backport std::regex check for invalid range (#2001788)
- change the default -march on s390x to z13 with tuning for z14 (#1571124)
- use --disable-multilib on s390x
- update from GCC 8.4 release (#1868446)
- remove symlinks to 32-bit versions of these static libraries: libasan.a,
libitm.a, libquadmath.a, libubsan.a, libgfortran.a (#1779597)
- tweak gcc8-rh1668903-1.patch and gcc8-rh1668903-2.patch patches
- fix typo in the cprop_hardreg patch (#2028609)
- new package
- Sync libstdc++ pretty printers to latest GTS (RHEL-82506).
- aarch64: Add -mtune=neoverse-512tvb (#1845932)
- additional fix for the libgomp testsuite (#1707568)
- fix shift count operand printing (#1730380)
- fix tree-outof-ssa.c ICE with vector types (PR middle-end/90139, #1730454)
- fix out-of-ssa with unsupported vector types (PR rtl-optimization/90756,
- fix ICE with template placeholder for TTP (PR c++/86098, #1730454)
libglvnd-gles-1.3.4-2.el8.x86_64.rpm | - Drop 0007-GLX-Add-GLX_SGIX_fbconfig-functions.patch the bug this works
around actually is in mesa
- Fix BuildRequires for /usr/bin/python3
- Resolves: #1615543
- Update to git20160217
- Introduce --with mesa-libglvnd-default build conditional
- Avoid error on make check - testglxqueryversion.sh stil fails in mock
- Filter on provided libGL until glvnd support is in upstream mesa
- Use upstream tarball and use autoreconf
- Update snapshot to 20170620
- Rebuilt without testssuite
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Add another conflict
- Update to 20160106 snapshot
- Remove 10-x11glvnd
- Enable %check for all but ppc64 and s390x, which has known but low-impact
failures
- Simplify %release
- Update snapshot
- Fix EGL crash for KDE/Plasma (rfbz#4303)
- Update snapshot to 20170818
- Fix BuildRequires for python3-devel
Resolves: RHEL-2239
- Bump for 20160115
- Enable make check
- Description improvements
- Enable libglvnd by default
- Enable devel sub-package
- add conflicts
- Update to 2.999 version
- Add EGL
- Restore hardened build
- Remove ExclusiveArch
- Remove some pointless Provides/Obsoletes
- BuildRequires pkgconfig(xext) not pkgconfig(xv)
- Update description to be a bit more confident
- Dump make check errors into the build log
- Update snapshot to 20180226
- Update scriptlets
- Update to 1.1.gitf7fbc4b
- Go back to Requires: mesa-*, the fallout is too great (#1568881 etc)
- Update to today snapshot
- Fix license
- Rebuild due to bug in RPM (RHBZ #1468476)
- asm enabled only for x86 - rhbz#1419944
- Update to 20151121 snapshot
- Avoid conflicts with mesa-libGL{,ES}
- Disable libGLESv1_CM
- Update to 1.0.0 release
- Use Recommends: mesa-* not Requires.
- (Trivially) switch the build to python3
- Fix conditionals for _without_mesa_glvnd_default
- Fix other RHEL-conditionals, too
- Update license
- Fix Obsoletes/Provides to avoid self obsolete
- Update snapshot to 20180327
- Update to today snapshoot
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Initial spec file
- version provides
- Remove patch to enable by default
- Update to 1.3.4 release
- Add another fallback GLX library name
- Epoch:1 to provide upgrade path from negativo17.org rpms
- New snapshot
- Add patches to fix building on ARM (from Rob Clark)
- Add BuildRequires: python
- Add ldconfig scriptlets for library sub-packages
- Don't hide libraries in a subdir (rhbz#1413579)
- Split up libraries to appropriate subpackages
- Make the req/prov filter catch more cases
- Restore libGLESv1 for ABI compliance
- Add the correct License: MIT
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- rename fallback to system
- Own %{_sysconfdir}/egl and %{_datadir}/egl dirs
- conflict
- more conflicts
- Update snapshot to 20170607
- Default to asm and tls when available
- Use the fixed tsd for armhfp and aarch64
fixed in https://github.com/NVIDIA/libglvnd/issues/116
- Update RPM filters for private libraries (includes GLX, fixes RHEL 6).
- Fix GLX_SGIX_fbconfig extension, this fixes games such as "The Binding of
Isaac: Rebirth" and "Crypt of the NecroDancer" from Steam not working
- Update to 1.3.2 release
- Update to lastest snapshot
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- Add eglexternalplatform spec. config dirs to -egl subpackage (rhbz#1415143)
- Update to current snapshot
- Update to current snapshot
- Remove unused dt-auxiliary
- Add support for graphical make test
- Undefine hardened build for xorg
- Update to snapshot 20150901
- Add conditional to disable testsuite, when needed
- libglvnd 1.2.0
- Update snapshot
- Fix EGL crash (rfbz#4303)
- Rebuilt with testsuite again
- Update to latest snapshot, remove upstreamed patches.
- Update release to packaging guidelines format.
- Make sure that for Fedora 24 and RHEL the libraries are always private.
- Update to 20160610 git commit
libjose-10-2.el8_10.3.x86_64.rpm | - Fixes CVE-2023-50967
- Initial package
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- New upstream release
- New upstream release
- New upstream release
- Fix tests on s390x
Related: RHEL-29857
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- New upstream release
- Backport fix for CVE-2024-28176
Resolves: RHEL-28719
- Add a conflicts on old versions of jansson
- Rebuild to pick up new architectures
- Fix build on big-endian platforms (fix already upstream)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- New upstream release
- New upstream release
- New upstream release
libkadm5-1.18.2-32.el8_10.x86_64.rpm | - incorporate upstream patch for remote crash of KDCs which serve multiple
realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800,
- Add recursion limit for ASN.1 indefinite lengths (CVE-2020-28196)
- Resolves: #1906492
- add draft fix from Tom Yu for slc_add_reply() buffer overflow (CAN-2005-0469)
- add draft fix from Tom Yu for env_opt_add() buffer overflow (CAN-2005-0468)
- update to 1.11.3
- drop patch for RT#7605, fixed in this release
- drop patch for CVE-2002-2443, fixed in this release
- drop patch for RT#7369, fixed in this release
- pull upstream fix for breaking t_skew.py by adding the patch for #961221
- add explicit build-time dependency on a version of keyutils that's new
enough to include keyctl_get_persistent() (more of #991148)
- make sure workstation servers are all disabled by default
- clean up krb5server init script
- rework file labeling patch to not depend on fragile preprocessor trickery,
in another attempt at fixing #428355 and friends
- pull in patches from master to not test GSSRPC-over-UDP and to not
depend on the portmapper, which are areas where our build systems
often give us trouble, too
- Explicitly look for python2 in configure.in
- back out buildrequires: keyutils-libs-devel for now
- add LSB-style init script info
- drop not-needed-since-1.8 build dependency on rsh (ssorce)
- build with -fstack-protector-all instead of the default -fstack-protector,
so that we add checking to more functions (i.e., all of them) (#629950)
- also link binaries with -Wl,-z,relro,-z,now (part of #629950)
- Drop DES3 from sample kdc.conf
- Resolves: #1802334
- apply patch to address MITKRB-SA-2006-001 (CVE-2006-3084)
- tweak graceful start/stop logic in post and preun
- fix bug ID in changelog
- patch ksu man page because the -C option never works
- add access() checks and disable debug mode in ksu
- modify default ksu build arguments to specify more directories in CMD_PATH
and to use getusershell()
- Backport soft-pkcs11 testing code
- Resolves: #1734158
- New upstream release (1.16)
- No changes from beta2
- Fix typo of crypto-policies file in previous version
- undo rename from krb5-pkinit-openssl to krb5-pkinit on EL6
- version the Obsoletes: on the krb5-pkinit-openssl to krb5-pkinit rename
- reintroduce the init scripts for non-systemd releases
- forward-port %{?_rawbuild} annotations from EL6 packaging
- incorporate fix for MITKRB5-SA-2014-001 (CVE-2014-4345)
- add buildprereq for autoconf
- correct some configuration file paths which the KDC_DIR patch missed
- fix license handling
- pull up fix for upstream #6745, in which the gssapi library would add the
wrong error table but subsequently attempt to unload the right one
- fix trigger scriptlet's invocation of sed (#1016945)
- attempt to account for UnversionedDocdirs for the -libs subpackage
- rename the krb5 package back to krb5-libs; the previous rename caused
something of an uproar
- update to 1.2.3, which includes the FTP and telnetd fixes
- configure without --enable-dns-for-kdc --enable-dns-for-realm, which now set
the default behavior instead of enabling the feature (the feature is enabled
by --enable-dns, which we still use)
- reenable optimizations on Alpha
- support more encryption types in the default kdc.conf (heads-up from post
to comp.protocols.kerberos by Jason Heiss)
- Replace _kadmin/_kprop with systemd macros
- Remove traces of upstart from fedora package per policy
- Resolves: #1290185
- Use responder for non-preauth AS requests
- Resolves: #1370622
- Set error message on KCM get_princ failure
- remove hesiod dependency at build-time
- mktemp was long obsoleted by coreutils
- add backport of in-development preauth module interface (#208643)
- update to 1.8.3
- drop backports of fixes for gss context expiration and error table
registration/deregistration mismatch
- drop patch for upstream #6750
- ftp: use the correct local filename during mget when the 'case' option is
enabled (#442713)
- make krb5-server-ldap also depend on the same version-release of krb5-libs,
as the other subpackages do, if only to make it clearer than it is when we
just do it through krb5-server
- drop explicit linking with libtinfo for applications that use libss, now
that readline itself links with libtinfo (as of readline-5.2-3, since
fedora 7 or so)
- go back to building without strict aliasing (compiler warnings in gssrpc)
- simplify the man pages patch by only preprocessing the files we care about
and moving shared configure.in logic into a shared function
- catch the case of ftpd printing file sizes using %i, when they might be
bigger than an int now
- add patch from Dhiru Kholia for the AES-NI implementations to allow
libk5crypto to be properly marked as not needing an executable stack
on arches where they're used (#1045699, and so many others)
- add upstream patch to fix freeing an uninitialized pointer and dereferencing
another uninitialized pointer in the KDC (MITKRB5-SA-2012-001, CVE-2012-1014
and CVE-2012-1015, #844779 and #844777)
- fix a thinko in whether or not we mess around with devel .so symlinks on
systems without a separate /usr (sbose)
- fix license tag
- update to 1.11 alpha 1
- drop backported patch for RT #7406
- drop backported patch for RT #7407
- drop backported patch for RT #7408
- the new docs system generates PDFs, so stop including them as sources
- drop backported patch to allow deltat.y to build with the usual
warning flags and the current gcc
- drop backported fix for disabling use of a replay cache when verifying
initial credentials
- drop backported fix for teaching PKINIT clients which trust the KDC's
certificate directly to verify signed-data messages that are signed with
the KDC's certificate, when the blobs don't include a copy of the KDC's
certificate
- drop backported patches to make keytab-based authentication attempts
work better when the client tells the KDC that it supports a particular
cipher, but doesn't have a key for it in the keytab
- drop backported fix for avoiding spurious clock skew when a TGT is
decrypted long after the KDC sent it to the client which decrypts it
- move the cross-referenced HTML docs into the -libs package to avoid
broken internal links
- drop patches to fixup paths in man pages, shouldn't be needed any more
- backport fixes to krb5_copy_context (RT#7807, #1044735/#1044739)
- override the default build rules to not delete temporary y.tab.c files,
so that they can be packaged, allowing debuginfo files which point to them
do so usefully (#729044)
- Move kdbversion info into -server for IPA (so we can rebase)
- Resolves: #1645594
- rebuild
- Backport OID mech fix
- Resolves: #1317609
- Update includedir processing to match upstream
- re-enable large file support, fell out in 1.3-1
- patch rcp to use long long and %lld format specifiers when reporting file
sizes on large files
- incorporate fixes for MITKRB5-SA-2007-006 (CVE-2007-3999, CVE-2007-4000)
- Make krb5-devel depend on libkadm5
- Resolves: #1364487
- Fix string RPC ACLs (RT#7093); CVE-2012-1012
- Don't check for write access on /etc/krb5.conf if SELinux
- Re-provide krb5-kdb-version in -devel as well (IPA wants it)
- Resolves: #1645594
- increase the maximum name length allowed by kuserok() to the higher value
used in development versions
- fix for potentially gzipped man pages
- gssapi: pull in upstream fix for a possible NULL dereference
in spnego (CVE-2014-4344)
- update to 1.6.3, dropping now-integrated patches for CVE-2007-3999
and CVE-2007-4000 (the new pkinit module is built conditionally and goes
into the -pkinit-openssl package, at least for now, to make a buildreq
loop with openssl avoidable)
- rebuilt
- rebuilt with new openssl
- Ignore bad enctypes in krb5_string_to_keysalts()
- Resolves: #1858322
- Make krb5kdc.log not world-readable by default
- Resolves: #1276484
- build shared libraries with partial RELRO support (#723995)
- filter out potentially multiple instances of -Wl,-z,relro from krb5-config
output, now that it's in the buildroot's default LDFLAGS
- pull in a patch to fix losing track of the replay cache FD, from SVN by
way of Kevin Coffman
- install src/krb524/README as README.krb524 in the -servers package,
includes information about converting for AFS principals
- explicitly run the pdf generation script using sh (part of #225974)
- rebuild in new environment
- reenable statglue
- add patch to correct GSSAPI library null pointer dereference which could be
triggered by malformed client requests (CVE-2010-1321, #582466)
- incorporate revised fixes from Tom Yu for CAN-2004-0642, CAN-2004-0644,
CAN-2004-0772
- New upstream beta version
- update to 1.6.1
- drop no-longer-needed patches for CVE-2007-0956,CVE-2007-0957,CVE-2007-1216
- drop patch for sendto bug in 1.6, fixed in 1.6.1
- specify dependencies on the same arch of krb5-libs by using the %{?_isa}
suffix, to avoid dragging 32-bit libraries onto 64-bit systems (#980155)
- Switch to python3-sphinx for docs
- Resolves: #1590928
- pull in fix from master to return a NULL pointer rather than allocating
zero bytes of memory if we read a zero-length input token (RT#7794, part of
- pull in fix from master to ignore an empty token from an acceptor if
we've already finished authenticating (RT#7797, part of #1043962)
- pull in fix from master to avoid a memory leak when a mechanism's
init_sec_context function fails (RT#7803, part of #1043962)
- pull in fix from master to avoid a memory leak in a couple of error
cases which could occur while obtaining acceptor credentials (RT#7805, part
of #1043962)
- Match Heimdal behavior for channel bindings
- Code hygiene + test stability fix included
- Resolves: #1840518
- initial update to 1.6, pre-package-reorg
- move workstation daemons to a new subpackage (#81836, #216356, #217301), and
make the new subpackage require xinetd (#211885)
- update to 1.4
- v1.4 kadmin client requires a v1.4 kadmind on the server, or use the "-O"
flag to specify that it should communicate with the server using the older
protocol
- new libkrb5support library
- v5passwdd and kadmind4 are gone
- versioned symbols
- pick up $KRB5KDC_ARGS from /etc/sysconfig/krb5kdc, if it exists, and pass
it on to krb5kdc
- pick up $KADMIND_ARGS from /etc/sysconfig/kadmin, if it exists, and pass
it on to kadmind
- pick up $KRB524D_ARGS from /etc/sysconfig/krb524, if it exists, and pass
it on to krb524d *instead of* "-m"
- set "forwardable" in [libdefaults] in the default krb5.conf to match the
default setting which we supply for pam_krb5
- set a default of 24h for "ticket_lifetime" in [libdefaults], reflecting the
compiled-in default
- ensure that the gssapi library's been initialized before walking the
internal mechanism list in gss_release_oid(), needed if called from
gss_release_name() right after a gss_import_name() (#198092)
- rebuild
- rename the krb5-libs package to krb5 (naming a subpackage -libs when there
is no main package is silly)
- move defaults for PAM to the appdefaults section of krb5.conf -- this is
the area where the krb5_appdefault_* functions look for settings)
- disable statglue (warning: breaks binary compatibility with previous
packages, but has to be broken at some point to work correctly with
unpatched versions built with newer versions of glibc)
- pull in upstream fix to start treating a KRB5CCNAME value that begins
with DIR:: the same as it would a DIR: value with just one ccache file
in it (RT#7172, #965574)
- fixup URL in a comment
- when built with NSS, require 3.12.10 rather than 3.12.9
- provide docs in PDF format instead of as tex source (Enrico Scholz, #209943)
- convert to systemd
- update to 1.2.7
- disable use of tcl
- update to 1.12.2
- drop patch for RT#7820, fixed in 1.12.2
- drop patch for #231147, fixed as RT#3277 in 1.12.2
- drop patch for RT#7818, fixed in 1.12.2
- drop patch for RT#7836, fixed in 1.12.2
- drop patch for RT#7858, fixed in 1.12.2
- drop patch for RT#7924, fixed in 1.12.2
- drop patch for RT#7926, fixed in 1.12.2
- drop patches for CVE-2014-4341/CVE-2014-4342, included in 1.12.2
- drop patch for CVE-2014-4343, included in 1.12.2
- drop patch for CVE-2014-4344, included in 1.12.2
- drop patch for CVE-2014-4345, included in 1.12.2
- replace older proposed changes for ksu with backports of the changes
after review and merging upstream (#1015559, #1026099, #1118347)
- patch mkdir/rmdir problem in ftpcmd.y
- add condrestart option to init script
- split the server init script into three pieces and add one for kpropd
- tweak statglue.c to fix stat/stat64 aliasing problems
- be cleaner in use of gcc to build shlibs
- Support KDC_ERR_MORE_PREAUTH_DATA_REQUIRED (RT#8063)
- Add pkinit_anchors default value to krb5.conf
- Reindent krb5.conf to not be terrible
- Support PAC with KDC extended signature and without ticket signature
- Resolves: rhbz#2169477
- update to 1.3.3
- debloat
- update to 1.11 beta 1
- Merge krb5-configs back into krb5-libs. The krb5.conf file is marked as
a %config file anyway.
- Make krb5.conf a noreplace config file.
- apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (#218456)
- apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (#218456)
- fix a regression (not labeling a kdb database lock file correctly, #569902)
- correctly use stdargs
- Zap copy of secret in RC4 string-to-key
- kadmind: add upstream patch to fix free() on an invalid pointer (#696343,
MITKRB5-SA-2011-004, CVE-2011-0285)
- apply patch from MITKRB5-SA-2004-001 (#125001)
- add patch to support "ANY" keytab type (i.e.,
"default_keytab_name = ANY:FILE:/etc/krb5.keytab,SRVTAB:/etc/srvtab"
patch from Gerald Britton, #42551)
- build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (#30697)
- patch ftpd to use long long and %lld format specifiers to support the SIZE
command on large files (also #30697)
- don't use LOG_AUTH as an option value when calling openlog() in ksu (#45965)
- implement reload in krb5kdc and kadmind init scripts (#41911)
- lose the krb5server init script (not using it any more)
- incorporate patch to fix double-free in the KDC (CVE-2010-1320, #581922)
- Add support for start_realm cache config
- Resolves: #1901195
- make krb5-config suppress CFLAGS output when called with --libs (#544391)
- add patch included in MITKRB5-SA-2003-003 (CAN-2003-0028)
- Do not block HMAC-MD4/5 in FIPS mode
Resolves: RHEL-86786
- Don't issue RC4 session keys by default (CVE-2025-3576)
Resolves: RHEL-88049
- Add PKINIT paChecksum2 from MS-PKCA v20230920
Resolves: RHEL-82648
- add man pages for kerberos(1), kvno(1), .k5login(5)
- add kvno to -workstation
- update to 1.4.1, incorporating fixes for CAN-2005-0468 and CAN-2005-0469
- when starting the KDC or kadmind, if KRB5REALM is set via the /etc/sysconfig
file for the service, pass it as an argument for the -r flag
- back out this labeling change (dwalsh):
- when building the new label for a file we're about to create, also mix
in the current range, in addition to the current user
- update to 1.2.6
- fix configure stuff for ia64
- fix telnet client environment variable disclosure the same way NetKit's
telnet client did (CAN-2005-0488) (#159305)
- keep apps which call krb5_principal_compare() or krb5_realm_compare() with
malformed or NULL principal structures from crashing outright (Thomas Biege)
(#161475)
- libgssapi_krb5: backport fix for some errors which can occur when
we fail to set up the server half of a context (CVE-2009-0845)
- remove hashless key types from the default kdc.conf, they're not supposed to
be there, noted by Sam Hartman on krbdev
- try to make gss_krb5_copy_ccache() work correctly for spnego (#542868)
- Depend on crypto-policies which provides /etc/krb5.conf.d (#1225792)
- pull a fix from SVN to try to avoid triggering a PTR lookup in getaddrinfo()
during krb5_sname_to_principal(), and to let getaddrinfo() decide whether or
not to ask for an IPv6 address based on the set of configured interfaces
(#717378, RT#6922)
- pull a fix from SVN to use AI_ADDRCONFIG more often (RT#6923)
- incorporate upstream patch to fix uninitialized pointer crash in the KDC's
authorization data handling (CVE-2010-1322, #636335)
- Use openssl's PRNG in FIPS mode
- Resolves: #1663571
- allocate space for the nul-terminator in the local pathname when looking up
a file context, and properly free a previous context (Jose Plans, #426085)
- fix for CVE-2014-5355 (#1193939) "krb5: unauthenticated
denial of service in recvauth_common() and others"
- pass absolute path to kadm5.keytab if/when extracting keys at startup
- switch to the simplified version of the patch for #1029110 (RT#7764)
- Omit KDC indicator check for S4U2Self requests
- Resolves: #1802334
- ftp: add patch to fix "runique on" case when globbing fixes applied
- stop adding a redundant but harmless call to initialize the gssapi internals
- fix a typo in a ksu error message (Marek Mahut)
- "rev" works the way the test suite expects now, so don't disable tests
that use it
- actually pull up the patch for RT#7063, and not some other ticket (#773496)
- Fix kprop for propagating dump files larger than 4GB
- Resolves: #2026462
- apply fixes from draft of MIT-KRB5-SA-2005-002 (CAN-2005-1174,CAN-2005-1175)
(#157104)
- apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (#159755)
- Fix problem with ccache_name logic in previous build
- Fix arch name (ppc64le, not ppc64el)
- Related-to: #1464381
- fix 32/64-bit bug storing and retrieving the issue_date in v4 credentials
- Use standard trigger logic for krb5 snippet
- Address some optimized-out memset() calls
- Resolves: #1663503
- apply kpasswd bug fixes from David Wragg
- fix bug in krb5.csh which would cause the path check to always succeed
- Fix a leak in the previous commit
- Restore dist macro that was accidentally removed
- Resolves: #1540939
- fix reading of keyUsage extensions when attempting to select pkinit client
certs (part of #629022, RT#6775)
- fix selection of pkinit client certs when one or more don't include a
subjectAltName extension (part of #629022, RT#6774)
- Fix backward check in kprop.service
- move to using pregenerated PDF docs to cure multilib conflicts (#222721)
- temporarily back out %post changes, fix for #143289 for security update
- add preliminary patch to correct unauthorized access via krb5-aware telnet
- fix globbing patch port mode (#139075)
- Allow verification of attributes on krb5.conf
- fix a logic bug in computing key expiration times (RT#6762, #627022)
- include profile.d scriptlets in krb5-devel so that krb5-config will be in
the path if krb5-workstation isn't installed, reported by Kir Kolyshkin
- Correct copyright: it's exportable now, provided the proper paperwork is
filed with the government.
- backed out ncurses and makeshlib patches
- update for krb5-1.1
- add KDC rotation to rc.boot, based on ideas from Michael's C version
- update to beta2
- drop obsolete backports for storing KDC time offsets and expiration times
in keyring credential caches
- fix bug in patch to make rlogind start login with a clean environment a la
netkit rlogin, spotted and fixed by Scott McClung
- Disable dns_canonicalize_hostname. This may break some setups.
- automated rebuild
- patch to handle truncated dns responses
- pull in upstream patch for RT#6952, confusion following referrals for
cross-realm auth (#734341)
- pull in build-time deps for the tests
- revert that last change for a bit while sorting out execstack when we
use AES-NI (#1045699)
- Eliminate preprocessor-disabled dead code
- rebuild
- on EL6, conflict with libsmbclient before 3.5.10-124, which is when it
stopped linking with a symbol which we no longer export (#771687)
- pull up patch for RT#7063, in which not noticing a prompt for a long
time throws the client library's idea of the time difference between it
and the KDC really far out of whack (#773496)
- add a backport of more patches to set the client's list of supported enctypes
when using a keytab to be the list of types of keys in the keytab, plus the
list of other types the client supports but for which it doesn't have keys,
in that order, so that KDCs have a better chance of being able to issue
tickets with session keys of types that the client can use (#837855)
- Patch CVE-2015-2698
- rebuilt
- include .so.* symlinks as well as .so.*.*
- rebuild in new environment
- update to 1.9 final
- pull up the change to make kpasswd's behavior better match the docs
when there's no ccache (#563431)
- Process included directories in alphabetical order
- krb5_get_init_creds_password: check opte->flags instead of options->flags
when checking whether or not we get to use the prompter callback (#555875)
- Don't enable the server by default.
- Compress info pages.
- Add defaults for the PAM module to krb5.conf
- fix for CVE-2014-5352 (#1179856) "gss_process_context_token()
incorrectly frees context (MITKRB5-SA-2015-001)"
- fix for CVE-2014-9421 (#1179857) "kadmind doubly frees partial
deserialization results (MITKRB5-SA-2015-001)"
- fix for CVE-2014-9422 (#1179861) "kadmind incorrectly
validates server principal name (MITKRB5-SA-2015-001)"
- fix for CVE-2014-9423 (#1179863) "libgssrpc server applications
leak uninitialized bytes (MITKRB5-SA-2015-001)"
- backport the callback to use the libkrb5 prompter when we can't load PEM
files for PKINIT (RT#7590, includes part of #965721/#1016690)
- extract the rest of the fix #965721/#1016690 from the changes for RT#7680
- update to 1.6.2
- add "buildrequires: texinfo-tex" to get texi2pdf
- spnego: pull in patch from master to restore preserving the OID of the
mechanism the initiator requested when we have multiple OIDs for the same
mechanism, so that we reply using the same mechanism OID and the initiator
doesn't get confused (#1066000, RT#7858)
- update to 1.4.3
- make ksu setuid again (#137934, others)
- when testing the RPC library, treat denials from the local portmapper the
same as a portmapper-not-running situation, to allow other library tests
to be run while building the package
- add patch based on one from Filip Krska to not call poll() with a negative
timeout when the caller's intent is for us to just stop calling it (#838548)
- Work around KDC client prinicipal in referrals issue (#1259844)
- update to beta 1
- Patch build by disabling failing test; will fix properly soon
- move the package changelog to the end to match the usual style (jdennis)
- scrub out references to $RPM_SOURCE_DIR (jdennis)
- include a symlink to the readme with the name LICENSE so that people can
find it more easily (jdennis)
- Use SHA-256 instead of MD5 for audit ticket IDs
- run kadmin.local correctly at startup
- automated rebuild
- rename krb5.sh and krb5.csh so that they don't overlap (#210623)
- way-late application of added error info in kadmind.init (#65853)
- Bump 1%{?dist} to 2%{?dist} to workaround RPM sort issue
which would lead yum updates to treat the last alpha as newer
than the final version.
- Use the correct patches this time.
- Resolves: #1321135
- Fix incorrect recv() size calculation in libkrad
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- update backport of the preauth module interface
- add proposed patches 4566, 4567
- add proposed edata reporting interface for KDC
- add temporary placeholder for module global context fixes
- Rebuilt for gcc bug 634757
- Set error message on KCM get_princ failure
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- drop a patch we weren't not applying (build tooling)
- wrap kadmind and kpropd in scripts which check for the presence/absence
of files which dictate particular exit codes before exec'ing the actual
binaries, instead of trying to use ConditionPathExists in the unit files
to accomplish that, so that we exit with failure properly when what we
expect isn't actually in effect on the system (#800343)
- Add patch to fix Redhat Bug #1227542 ("[SELinux] AVC denials may appear
when kadmind starts"). The issue was caused by an unneeded |htons()|
which triggered SELinux AVC denials due to the "random" port usage.
- move man pages that live in the -libs subpackage into the regular
%{_mandir} tree where they'll still be found if that package is the
only one installed (#529319)
- drop krshd patch for now
- handle releases where texlive packaging wasn't yet as complicated as it
is in Fedora 18
- fix an uninitialized-variable error building one of the test programs
- fix link flags and permissions on shared libraries (ausil)
- merge security fixes from RHSA-2007:0095
- add missing shebang headers to krsh and krlogin wrapper scripts (#209238)
- add an xinetd configuration file for encryption-only telnetd, parallelling
the kshell/ekshell pair (#167535)
- Backport fix for GSSAPI fallback realm
- Full FIPS compliance
- Resolves: #1754690
- New upstream version (1.18.1)
- Resolves: #1802334
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- update to 1.5
- fix deadlock during file transfer via rsync/krsh
- thanks goes to James Antill for hint
- rebuild
- add patch from Mark Cox for exploitable bugs in ftp client
- rebuilt
- Backport fix for chrome crash in spnego_gss_inquire_context
- Resolves: #1295893
- backport fix for not being able to verify the list of transited realms
in GSS acceptors (RT#7639, #959685)
- backport fix for not being able to pass an empty password to the
get-init-creds APIs and have them actually use it (RT#7642, #960001)
- add backported proposed fix to use the unauthenticated server time
as the basis for computing the requested credential expiration times,
rather than the client's idea of the current time, which could be
significantly incorrect (#961221)
- Add free hook to KDB; increments KDB version
- Add KDB version flag
- fix for CVE-2014-5353 (#1174543) "Fix LDAP misused policy
name crash"
- switch to the upstream patch for #727829
- Fix use of KKDCPP with SNI
- Resolves: #1365027
- add upstream patches to fix standalone kpropd exiting if the per-client
child process exits with an error (MITKRB5-SA-2011-001), a hang or crash
in the KDC when using the LDAP kdb backend, and an uninitialized pointer
use in the KDC (MITKRB5-SA-2011-002) (CVE-2010-4022, #664009,
CVE-2011-0281, #668719, CVE-2011-0282, #668726, CVE-2011-0283, #676126)
- make use of install-info more failsafe (Ville Skyttä, #223704)
- preserve timestamps on shell scriptlets at %install-time
- update to 1.13 alpha1
- drop upstreamed and backported patches
- pull in fix to store KDC time offsets in keyring credential caches (RT#7768,
- pull in fix to set expiration times on credentials stored in keyring
credential caches (RT#7769, #1031724)
- add documentation for the ticket_lifetime option (#561174)
- Fix memory leak in GSSAPI interface
Resolves: RHEL-27250
- Fix memory leak in PMAP RPC interface
Resolves: RHEL-27244
- Make TCP waiting time configurable
Resolves: RHEL-17131
- Fix leaks in gss_inquire_cred_by_oid()
- automatic rebuild
- pull up patch to get the client libraries to correctly perform password
changes over IPv6 (Sumit Bose, RT#6661)
- fix the kpropd init script
- Remove "-nodes" option from make-certs scripts
- Be more careful asking for AS key in SPAKE client
- disable servers by default to keep linuxconf from thinking they need to be
started when they don't
- move the rather large pile of html and pdf docs to -workstation, so
that just having something that links to the libraries won't drag
them onto a system, and we avoid having to sort out hard-coded paths
that include %{_libdir} showing up in docs in multilib packages
- actually create %{_var}/kerberos/kdc/user, so that it can be packaged
- correct the list of packaged man pages
- don't dummy up required tex stylesheets, require them
- require pdflatex and makeindex
- bump again for double-long bug on ppc(64)
- Fix leak of default credentials in gss_inquire_cred()
Resolves: RHEL-32258
- Backport kdc policy plugin, but this time with dependencies
- add in glue code to make sure that libkrb5 continues to provide a
weak copy of stat()
- if the init script fails to start krb5kdc/kadmind/kpropd because it's already
running (according to status()), return 0 (part of #521772)
- rebuild
- fix conditional for future RHEL
- krb5kdc init script: prototype some changes to do a quick spot-check
of the TGS and kadmind keys and warn if there aren't any non-weak keys
on file for them (to flush out parts of #651466)
- tweak configuration files used during tests to try to reduce the number
of conflicts encountered when builds for multiple arches land on the same
builder
- add upstream patch for KDC crash during referral processing (CVE-2009-3295),
via Tom Yu (#545002)
- prefer the kdc which last replied to a request when sending requests to kdcs
- pull the changing of the compiled-in default ccache location to
DIR:/run/user/%{uid}/krb5cc back into F19, in line with SSSD and
the most recent pam_krb5 build
- Fix some broken tests for Python 3
- use PICFLAGS when building code from the ktany patch
- fix an uninitialized length value which could cause a crash when parsing
key data coming from a directory server
- correct a typo in the krb5.conf man page ("ldap_server"->"ldap_servers")
- Use system nss_wrapper and socket_wrapper for testing.
Patch by Andreas Schneider
- removed rpath
- give a little bit more information to the user when kinit gets the catch-all
I/O error (#180175)
- Fix RC4 blocking in FIPS mode
- Resolves: #1660222
- throw in a not-applied-by-default patch to try to make pkinit debugging
into a run-time boolean option named "pkinit_debug"
- Backport upstream certauth EKU fixes
- broke out configuration files
- add patch for buffer overflow in kadmind4 (not used by default)
- libkrad: implement support for Message-Authenticator (CVE-2024-3596)
Resolves: RHEL-50253
- Remove RSA protocol for PKINIT
Resolves: RHEL-17616
- change a LINE_MAX to 1024, fix from Ken Raeburn
- add fix for login vulnerability in case anyone rebuilds without krb4 compat
- add tweaks for byte-swapping macros in krb.h, also from Ken
- add xinetd config files
- make rsh and rlogin quieter
- build with debug to fix credential forwarding
- add rsh as a build-time req because the configure scripts look for it to
determine paths
- rebuild with OpenSSL 1.1.0, added backported upstream patch
- Tom Yu's patch to fix compatibility between 1.2 kadmin and 1.1.1 kadmind
- pull out 6.2 options in the spec file (sonames changing in 1.2 means it's not
compatible with other stuff in 6.2, so no need)
- pull in patch from master to move the default directory which the KDC uses
when computing the socket path for a local OTP daemon from the database
directory (/var/kerberos/krb5kdc) to the newly-added run directory
(/run/krb5kdc), in line with what we're expecting in 1.13 (RT#7859, more
of #1040056 as #1063905)
- add a tmpfiles.d configuration file to have /run/krb5kdc created at
boot-time
- own /var/run/krb5kdc
- gssapi: pull in proposed fix for a double free in initiators (David
Woodhouse, CVE-2014-4343, #1117963)
- and put it back in
- update to 1.2.5
- disable statglue
- remove rc4-hmac:norealm and rc4-hmac:onlyrealm from the default list of
supported keytypes in kdc.conf -- they produce exactly the same keys as
rc4-hmac:normal because rc4 string-to-key ignores salts
- nuke kdcrotate -- there are better ways to balance the load on KDCs, and
the SELinux policy for it would have been scary-looking
- update to 1.3.5, mainly to include MITKRB5SA 2004-002 and 2004-003
- apply second set of buffer overflow fixes from Tom Yu
- fix from Dirk Husung for a bug in buffer cleanups in the test suite
- work around possibly broken rev binary in running test suite
- move default realm configs from /var/kerberos to %{_var}/kerberos
- add preliminary patch to fix buffer overflow in krb5kdc and kadmind
(#231528, CVE-2007-0957)
- add preliminary patch to fix double-free in kadmind (#231537, CVE-2007-1216)
- don't let comments intended for one scriptlet become part of the "script"
that gets passed to ldconfig as part of another one (Mattias Ellert, #1005675)
- Explicitly require python2 packages
- Add upstream lookaside cache behavior fix (RT#7082)
- apply Mike Friedman's patch to fix format string problems
- don't strip off argv[0] when invoking regular rsh/rlogin
- Include fixes for previous commit
- Resolves: #1433083
- Skip test suite on ppc64el
- Related-to: #1464381
- Fix integer overflows in PAC parsing (CVE-2022-42898)
- Resolves: rhbz#2140968
- Fix FTBFS by no longer working around bug in nss_wrapper
- move initscript back
- enable patch for key-expiration reporting
- enable patch to make kpasswd fall back to TCP if UDP fails (#251206)
- enable patch to make kpasswd use the right sequence number on retransmit
- enable patch to allow mech-specific creds delegated under spnego to be found
when searching for creds
- Turn OFD locks back on with glibc workaround
- Resolves: #1274922
- fix indexing error in server sorting patch (#127336)
- move /etc/pam.d/ksu from krb5-workstation-servers to krb5-workstation,
where it's actually needed (#538703)
- add currently-proposed changes to teach ksu about credential cache
collections and the default_ccache_name setting (#1015559,#1026099)
- make proper use of pam_loginuid and pam_selinux in rshd and ftpd
- rebuild in new environment
- fix a type mismatch in krb5_copy_error_message()
- ftp: fix some odd use of strlen()
- selinux labeling: use selabel_open() family of functions rather than
matchpathcon(), bail on it if attempting to get the mutex lock fails
- go back to not messing with library file paths on Fedora 17: it breaks
file path dependencies in other packages, and since Fedora 17 is already
released, breaking that is our fault
- pass -Wl,--warn-shared-textrel to the compiler when we're creating shared
libraries
- create and own /etc/gss (#1019937)
- force -fPIC
- CVE-2024-37370 CVE-2024-37371
Fix vulnerabilities in GSS message token handling
Resolves: RHEL-45398 RHEL-45386
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Backport getrandom() support
- Remove patch numbering
- Update tmpfiles dropin to use /run instead of /var/run
- Resolves: #1945679
- Make klogind pass a clean environment to children, like NetKit's rlogind does.
- add some comments to the ksu patches for the curious
- re-enable optimization on alphas
- Support config snippets in /etc/krb5.conf.d/ and /usr/share/krb5.conf.d/
(#1225792, #1146370, #1145808)
- Fix CVE-2015-8629, CVE-2015-8630, CVE-2015-8631
- update to 1.11 release
- drop patch to suppress key expiration warnings sent from the KDC in
the last-req field, as the KDC is expected to just be configured to either
send them or not as a particular key approaches expiration (#556495)
- pkinit: when verifying signed data, use the CMS APIs for better
interoperability (#636985, RT#6851)
- change /usr/dict/words to /usr/share/dict/words in default kdc.conf (#20000)
- only remove old krb5server init script links if the init script is there
- turn on NSS as the backend for libk5crypto, adding nss-devel as a build
dependency when that switch is flipped
- add patch from Tom Yu to fix ftpd overflows (#37731)
- Add libverto-devel requires for krb5-devel
- Add otp support
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- ksu: move session management calls to before we drop privileges, like
su does (#596887), and don't skip the PAM account check for root or the
same user (more of #540769)
- fix a memory leak when acquiring credentials using a keytab (RT#7586, #911110)
- Add German translation
- move the default acl_file, dict_file, and admin_keytab settings to
the part of the default/example kdc.conf where they'll actually have
an effect (#236417)
- start moving to 1.9 with beta 1
- drop patches for RT#5755, RT#6762, RT#6774, RT#6775
- drop no-longer-needed backport patch for #539423
- drop no-longer-needed patch for CVE-2010-1322
- if WITH_NSS is set, built with --with-crypto-impl=nss (requires NSS 3.12.9)
- don't forget the README
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- rebuilt
- add patch to fix server-side crashes when principals have no
components (CAN-2003-0072)
- started changelog (previous package from zedz.net)
- updated existing 1.0.5 RPM from Eos Linux to krb5 1.0.6
- added --force to makeinfo commands to skip errors during build
- Backport KCM performance enablements
- Resolves: #1956388
- add some minimal description to the top of the wrapper scripts we use
when starting krb5kdc and kadmind to describe why they exist (tooling)
- update to 1.9.1:
- drop no-longer-needed patches for CVE-2010-4022, CVE-2011-0281,
CVE-2011-0282, CVE-2011-0283, CVE-2011-0284, CVE-2011-0285
- Re-enable test suite on ppc64le (no other changes)
- catch krb4 send_to_kdc cases in kdc preference patch
- prereq chkconfig for the server subpackage
- Update otp backport patches (libk5radius => libkrad)
- Use "new" systemd macros for service handling. (Thanks vpavlin!)
- Resolves: #850399
- set SS_LIB at configure-time so that libss-using apps get working readline
support (#197044)
- revise previous patch to initialize one more element
- add patch to correct unauthorized access via krb5-aware telnet
daemon (#229782, CVE-2007-0956)
- add patch to fix buffer overflow in krb5kdc and kadmind
(#231528, CVE-2007-0957)
- add patch to fix double-free in kadmind (#231537, CVE-2007-1216)
- pass some structures by address instead of on the stack in krb5kdc
- update to latest patch kit for MITKRB5-SA-2003-004
- New upstream beta version
- selinux: hang on to the list of selinux contexts, freeing and reloading
it only when the file we read it from is modified, freeing it when the
shared library is being unloaded (#845125)
- fix output of kprop's init script's "status" and "reload" commands (#588222)
- create and own /var/kerberos/krb5/user instead of /var/kerberos/kdc/user,
since that's what the libraries actually look for
- add buildrequires on nss-myhostname, in an attempt to get more of the tests
to run properly during builds
- pull in Simo's patch to recognize "client_keytab" as a key type which can
be passed in to gss_acquire_cred_from() (RT#7598)
- when iterating over lists of interfaces which are "up" from getifaddrs(),
skip over those which have no address (#113347)
- Separate out the kadm5 libs
- add LDCOMBINE=-lc to configure invocation to use libc versioning (bug #10653)
- change Requires: for/in subpackages to include %{version}
- Fix KDC null deref on TGS inner body null server (CVE-2021-37750)
- Resolves: #1997601
- rebuilt
- switch to the updated patch for MITKRB-SA-2006-001
- Add kprop service env config file
- update to 1.12 final
- stop exporting kadmin keys to a keytab file when kadmind starts -- the
daemon's been able to use the database directly for a long long time now
- belatedly add aes128,aes256 to the default set of supported key types
- tag a couple of other patches which we still need to be applied during
%{?_rawbuild} builds (zmraz)
- change cleanup code in post to not tickle chkconfig
- add grep as a Prereq: for -libs
- Add SPAKE support
- Improve protections on internal sensitive buffers
- Improve internal hex encoding/decoding
- Rebuilt for glibc bug#747377
- update to 1.8
- temporarily bundling the krb5-appl package (split upstream as of 1.8)
until its package review is complete
- profile.d scriptlets are now only needed by -workstation-clients
- adjust paths in init scripts
- drop upstreamed fix for KDC denial of service (CVE-2010-0283)
- drop patch to check the user's password correctly using crypt(), which
isn't a code path we hit when we're using PAM
- Fix configuration of default ccache name to match file indentation
- rebuild
- Fix leak in KERB_AP_OPTIONS_CBT server support
- Resolves: #1860831
- Add hostname-based ccselect module
- Resolves: #1463665
- Document -k option in kvno(1) synopsis
- Resolves: #1869055
- use %{_lib} for the sake of multilib systems
- fix for kinit -C loops (#1184629, MIT/krb5 issue 243, "Do not
loop on principal unknown errors").
- Added "python-sphinx-latex" to the build requirements
to fix build failures on F22 machines.
- own the directories which are created for each package (#26342)
- update to 1.2.1
- back out Tom Yu's patch, which is a big chunk of the 1.2 -> 1.2.1 update
- start using the official source tarball instead of its contents
- TEMPORARILY disable usage of OFD locks as a workaround for x86
- rebuild
- disable optimizations on the alpha again
- change back dns_lookup_kdc to the default setting (Stef Walter, #805318)
- comment out example.com examples in default krb5.conf (Stef Walter, #805320)
- put the conditional back for the -devel subpackage
- back down to the earlier version of the patch for #551764; the backported
alternate version was incomplete
- FIPS: disable 3DES and ed25519
- Resolves: #1616326
- Add BuildRequires on python2 so we can run tests at build-time
- build without -g3, which gives us large static libraries in -devel
- Backport my interposer fixes from upstream
- Supersedes krb5-mechglue_inqure_attrs.patch
- Add build dependency on gcc
- add yasm as a build requirement for AES-NI support, on arches that have
yasm and AES-NI
- New upstream release
- Update names and numbers to match external git
- make ksu and v4rcp owned by root
- prevent spurious EBADF in krshd when stdin is closed by the client while
the command is running (#151111)
- update to 1.7
- no need to work around build issues with ASN1BUF_OMIT_INLINE_FUNCS
- configure recognizes --enable/--disable-pkinit now
- configure can take --disable-rpath now
- no more libdes425, krb524d, krb425.info
- kadmin/k5srvutil/ktutil are user commands now
- new kproplog
- FAST encrypted-challenge plugin is new
- drop static build logic
- drop pam_krb5-specific configuration from the default krb5.conf
- drop only-use-v5 flags being passed to various things started by xinetd
- put %{krb5prefix}/sbin in everyone's path, too (#504525)
- fix combination of --with-netlib and --enable-dns (#82176)
- add upstream patch for integer underflow during AES and RC4 decryption
(CVE-2009-4212), via Tom Yu (#545015)
- update to 1.11.2
- drop pulled in patch for RT#7586, included in this release
- drop pulled in patch for RT#7592, included in this release
- pull in fix for keeping track of the message type when parsing FAST requests
in the KDC (RT#7605, #951843) (also #951965)
- try to merge and clean up all the large file support for ftp and rcp
- ftpd no longer prints a negative length when sending a large file
from a 32-bit host
- pull up fix for UDP ping-pong flaw in kpasswd service (CVE-2002-2443,
- silence compiler warning in kprop by using an in-memory ccache with a fixed
name instead of an on-disk ccache with a name generated by tmpnam()
- don't break during %check when the session keyring is revoked
- rebuild
- Gain FIPS awareness
- Resolves: #1660222
- New upstream release - 1.16.1
- Backport certauth plugin and related pkinit changes
- incorporate Simo's updated backport of his updated persistent-keyring changes
(more of #991148)
- rebuild
- Fix network service dependencies
- Resolves: #1525230
- Add PKINIT KDC support for freshness token
- update to 1.2.4
- update to 1.9 beta 3
- Log when non-root ksu authorization fails
- Resolves: #1575771
- Allow to make AD-SIGNEDPATH optional
Resolves: RHEL-10514
- rebuild
- fix a version comparison to expect newer texlive build requirements when
%{_rhel} > 6 rather than when it's > 7
- don't bail from the KDC init script if there's no database, it may be in
a different location than the default (fenlason)
- remove the [kdc] section from the default krb5.conf -- doesn't seem to have
been applicable for a while
- Ensure pwsize is initialized in chpass_util.c
- fix config_subpackage logic
- pull up changes to allow GSSAPI modules to provide more functions
(RT#7682, #986564/#986565)
- some init script cleanups
- drop unquoted check and silent exit for "$NETWORKING" (#426852, #242502)
- krb524: don't barf on missing database if it looks like we're using kldap,
same as for kadmin
- return non-zero status for missing files which cause startup to
fail (#242502)
- update to 1.12.1
- drop patch for RT#7794, included now
- drop patch for RT#7797, included now
- drop patch for RT#7803, included now
- drop patch for RT#7805, included now
- drop patch for RT#7807, included now
- drop patch for RT#7045, included now
- drop patches for RT#7813 and RT#7815, included now
- add patch to always retrieve the KDC time offsets from keyring caches,
so that we don't mistakenly interpret creds as expired before their
time when our clock is ahead of the KDC's (RT#7820, #1030607)
- cover more cases in labeling files on creation
- add missing gawk build dependency
- drop a hunk from the dnsparse patch which is actually redundant (thanks to
Tom Yu)
- back that last change out
- Remove outdated note in krb5kdc man page
- remove libdefault ticket_lifetime option from the default krb5.conf, it is
ignored by libkrb5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- take another stab at accounting for UnversionedDocdirs for the -libs
subpackage (spotted by ssorce)
- switch to just the snapshot of nss_wrapper we were using, since we
no longer need to carry anything that isn't in the cwrap.org repository
(ssorce)
- Up-port a bunch of stuff from the el-7.3 cycle
- Resolves: #1255450, #1314989
- pull down patches from trunk to implement k5login_authoritative and
k5login_directory settings for krb5.conf (#539423)
- rebuild
- Hammer refresh around transient rawhide issue
- pull fix for non-compliant encoding of salt field in etype-info2 preauth
data from 1.3.1 beta 1, until 1.3.1 is released.
- update to 1.8.1
- no longer need patches for #555875, #561174, #563431, RT#6661, CVE-2010-0628
- replace buildrequires on tetex-latex with one on texlive-latex, which is
the package that provides it now
- Fix argument order on strlcpy() in enctype_name()
- Resolves: #1754369
- incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772
(MITKRB5-SA-2004-002, #130732)
- incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, #130732)
- rebuild to compress man pages.
- if we successfully change the user's password during an attempt to get
initial credentials, but then fail to get initial creds from a non-master
using the new password, retry against the master (#432334)
- Restrict pre-authentication fallback cases
- Fix KCM client time offset propagation
- Resolves: #1738553
- update to 1.4.2, incorporating the fixes for MIT-KRB5-SA-2005-002 and
MIT-KRB5-SA-2005-003
- kadmind.init: drop the attempt to detect no-database-present errors (#723723),
which is too fragile in cases where the database has been manually moved or
is accessed through another kdb plugin
- rebuild
- update to 1.3
- Automatically add includedir where not present
- Try removing sleep statement to see if it is still needed
- Resolves: #1433083
- reintroduce ld.so.conf munging in the -libs %post
- handle an assertion failure that starts cropping up when the patch for
using poll (#701446) meets servers that aren't running KDCs or against
which the connection fails for other reasons (#727829, #734172)
- Backport interposer fix (#1284985)
- Drop workaround pwsize initialization patch (gcc has been fixed)
- Explicitly use openssl rather than builtin crypto
- Resolves: #1570910
- fix info page insertions
- Fix krb5kdf support and add proper openssl version requirements
- Resolves: #1754690
- configure --without-krb5-config so that we don't pull in the old default
ccache name when we want to stop setting a default ccache name at configure-
time
- pull the newer F21 defaults back to F20 (sgallagh)
- update backport of the preauth module interface (part of #194654)
- initial update to alpha1
- drop backport of persistent keyring support
- drop backport for RT#7689
- drop obsolete patch for fixing a use-before-init in a test program
- drop obsolete patch teaching config.guess/config.sub about aarch64-linux
- drop backport for RT#7598
- drop backport for RT#7172
- drop backport for RT#7642
- drop backport for RT#7643
- drop patches from master to not test GSSRPC-over-UDP and to not
depend on the portmapper, which are areas where our build systems
often give us trouble, too; obsolete
- drop backports for RT#7682
- drop backport for RT#7709
- drop backport for RT#7590 and partial backport for RT#7680
- drop OTP backport
- drop backports for RT#7656 and RT#7657
- BuildRequires: libedit-devel to prefer it
- BuildRequires: pkgconfig, since configure uses it
- OpenSSL has an epoch, apparently
- Resolves: #1754690
- rebase to master
- update to beta1
- drop obsolete backport of fix for RT#7706
- further munge krb5-config so that 'libdir=/usr/lib' is given even on 64-bit
architectures, to avoid multilib conflicts; other changes will conspire to
strip out the -L flag which uses this, so it should be harmless (#192692)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- apply the fix for CVE-2007-4000 instead of the experimental patch for
setting ok-as-delegate flags
- adjust the patch which removes the use of rpath to also produce a
krb5-config which is okay in multilib environments (#190118)
- make the name-of-the-tempfile comment which compile_et adds to error code
headers always list the same file to avoid conflicts on multilib installations
- strip SIZEOF_LONG out of krb5.h so that it doesn't conflict on multilib boxes
- strip GSS_SIZEOF_LONG out of gssapi.h so that it doesn't conflict on mulitlib
boxes
- Fix KDC null deref on bad encrypted challenge (CVE-2021-36222)
- Resolves: #1983729
- add patches from patchkit from MITKRB5-SA-2003-004 (CAN-2003-0138 and
CAN-2003-0139)
- login: don't truncate passwords before passing them into crypt(), in
case they're significant (#149476)
- switch to the upstream patch for #707145
- kpropd hasn't bothered with -S since 1.11; stop trying to use that flag
in the systemd unit file
- when removing -workstation, remove our files from the info index while
the file is still there, in %preun, rather than %postun, and use the
compressed file's name (#801035)
- kdc.conf: default to listening for TCP clients, too (#248415)
- New upstream release (1.18.2)
- Resolves: #1802334
- rebuild
- fix pid path in krb5kdc.service
- rebuild
- hardcode pid file as option in krb5kdc.service
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- backport fixes to teach libkrb5 to use descriptors higher than FD_SETSIZE
to talk to a KDC by using poll() if it's detected at compile-time (#701446,
RT#6905)
- Fix hex conversion of PKINIT certid strings
- rebuilt
- check more thoroughly for errors when resolving KEYRING ccache names of type
"persistent", which should only have a numeric UID as the next part of the
name (#1029110)
- pull up Simo's patch to mark the correct mechanism on imported GSSAPI
contexts (RT#7592)
- go back to using reconf to run autoconf and autoheader (part of #925640)
- add temporary patch to use newer config.guess/config.sub (more of #925640)
- special-case /run/user/0, attempting to create it when resolving a
directory cache below it fails due to ENOENT and we find that it doesn't
already exist, either, before attempting to create the directory cache
(maybe helping, maybe just making things more confusing for #961235)
- make krb5.conf %verify(not md5 size mtime) in addition to
%config(noreplace), like /etc/nsswitch.conf (#329811)
- turn off NSS as the backend for libk5crypto for now to work around its
DES string2key not working (#679012)
- add revised upstream patch to fix double-free in KDC while returning
typed-data with errors (MITKRB5-SA-2011-003, CVE-2011-0284, #674325)
- add patches for read overflow and null pointer dereference in the
implementation of the SPNEGO mechanism (CVE-2009-0844, CVE-2009-0845)
- add patch for attempt to free uninitialized pointer in libkrb5
(CVE-2009-0846)
- add patch to fix length validation bug in libkrb5 (CVE-2009-0847)
- put the krb5-user .info file into just -workstation and not also
-workstation-clients
- add missing dependency on newer keyutils-libs (#1012034)
- update to 1.10 final
- Fix CVE-2016-3119 (NULL deref in LDAP module)
- Patch CVE-2015-2697, CVE-2015-2696, CVE-2015-2695
- bump release number and rebuild
- Add fix for RedHat Bug #1164304 ("Upstream unit tests loads
the installed shared libraries instead the ones from the build")
- clean up quoting of command-line arguments passed to the krsh/krlogin
wrapper scripts
- patch around TIOCGTLC defined on alpha and remove warnings from libpty.h
- add installation of info docs
- remove krb4 compat patch because it doesn't fix workstation-side servers
- added krb5.csh and krb5.sh to /etc/profile.d
- rebuild
- Remove incorrect KDC assertion
- Resolves: #1673016
- test update to 1.3 beta 4
- ditch statglue build option
- krb5-devel requires e2fsprogs-devel, which now provides libss and libcom_err
- In FIPS mode, add plaintext fallback for RC4 usages and taint
- mark %{krb5prefix}/man so that files which are packaged within it are
flagged as %doc (#168163)
- incorporate fixes for MITKRB5-SA-2007-004 (CVE-2007-2442,CVE-2007-2443)
and MITKRB5-SA-2007-005 (CVE-2007-2798)
- Update from krb5-1.13-alpha1 to final krb5-1.13
- Removed patch for CVE-2014-5351 (#1145425) "krb5: current
keys returned when randomizing the keys for a service principal" -
now part of upstream sources
- Use patch for glibc |eventfd()| prototype mismatch (#1147887) only
for Fedora > 20
- apply upstream patch to fix a null pointer dereference with the LDAP kdb
backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb
backends (CVE-2011-1528), and a null pointer dereference with multiple kdb
backends (CVE-2011-1529) (#737711)
- pull in fix from master to make reporting of errors encountered by
the SPNEGO mechanism work better (RT#7045, part of #1043962)
- update to 1.10.2
- when building the new label for a file we're about to create, also mix
in the current range, in addition to the current user
- also package the PDF format admin, user, and install guides
- drop some PDFs that no longer get built right
- add a backport of Stef's patch to set the client's list of supported
enctypes to match the types of keys that we have when we are using a
keytab to try to get initial credentials, so that a KDC won't send us
an AS reply that we can't encrypt (RT#2131, #748528)
- don't shuffle around any shared libraries on releases with no-separate-/usr,
since /usr/lib is the same place as /lib
- add explicit buildrequires: on 'hostname', for the tests, on systems where
it's in its own package, and require net-tools, which used to provide the
command, everywhere
- fix a null pointer dereference and crash introduced in our PAM patch that
would happen if ftpd was given the name of a user who wasn't known to the
local system, limited to being triggerable by gssapi-authenticated clients by
the default xinetd config (Olivier Fourdan, #569472)
- build
- incorporate Simo's backport of his persistent-keyring changes (#991148)
- restore build-time default DEFCCNAME on Fedora 21 and later and EL, and
instead set default_ccache_name in the default krb5.conf's [libdefaults]
section (#991148)
- on releases where we expect krb5.conf to be configured with a
default_ccache_name, add it whenever we upgrade from an older version of
the package that wouldn't have included it in its default configuration
file (#991148)
- Remove duplication between subpackages
- Resolves: #1250228
- use portreserve correctly -- portrelease takes the basename of the file
whose entries should be released, so we need three files, not one
- update to 1.3.2
- use gcc to build shared libraries
- Fix dependicy on binfmt.service
- update to 1.9 beta 2
- Fix formatting typo in kinit.1 (krb5-kinit-man-typo.patch)
- Prevent overflow when calculating ulog block size (CVE-2025-24528)
Resolves: RHEL-78248
- kdb5_util: fix DB entry flags on modification
Resolves: RHEL-56060
- Restore accidentally dropped patch
- Resolves: #1754690
- Backport fix of memory use after free during libkrad cleanup
- Backport support for larger RADIUS attributes in libkrad
- Resolves: rhbz#2103125
- tweak server init script to automatically extract kadm5 keys if
/var/kerberos/krb5kdc/kadm5.keytab doesn't exist yet
- adjust package descriptions
- Fix SPAKE memory leak
- Fix custom build with -DDEBUG
- New upstream version (1.17)
- Resolves: #1645594
- pull in fix for denial of service by injection of malformed GSSAPI tokens
(CVE-2014-4341, CVE-2014-4342, #1116181)
- Convert Python tests to Python 3
- fix for CVE-2015-2694 (#1216133) "requires_preauth bypass
in PKINIT-enabled KDC".
In MIT krb5 1.12 and later, when the KDC is configured with
PKINIT support, an unauthenticated remote attacker can
bypass the requires_preauth flag on a client principal and
obtain a ciphertext encrypted in the principal's long-term
key. This ciphertext could be used to conduct an off-line
dictionary attack against the user's password.
- Fix setting of AS key in OTP preauth failure
- Ensure we can build with the new CFLAGS
- Remove the git versioning in patches
- update to 1.11.1
- drop patch for noticing negative timeouts being passed to the poll()
wrapper in the client transmit functions
- Enable MD5 override for FIPS RADIUS
- Resolves: #1872689
- use (a bundled, for now, copy of) nss_wrapper to let us run some of the
self-tests at build-time in more places than we could previously (#978756)
- cover inconsistencies in whether or not there's a local caching nameserver
that's willing to answer when the build environment doesn't have a
resolver configuration, so that nss_wrapper's faking of the local
hostname can be complete
- added -lncurses to telnet and telnetd makefiles
- rebuild with keyutils 1.5.8 (part of #1012043)
- fix for CVE-2014-5354 (#1174546) "krb5: NULL pointer
dereference when using keyless entries"
- Remove "python-sphinx-latex" and "tar" from the build requirements
to fix build failures on F22 machines.
- Minor spec cleanup
- gcc 3.3 doesn't implement varargs.h, include stdarg.h instead
- Remove dependency on systemd-sysv which is no longer needed for fedora > 20
This also fixes a fail-to-build issue.
- Miscalaneous spec cleanup fixes
- add patch to accept keytab entries with vno==0 as matches when we're
searching for an entry with a specific name/kvno (#230382/#782211,RT#3349)
- rebuild to pick up the current forms of various patches
- update to 1.10 alpha 1
- on newer releases where we can assume NSS >= 3.13, configure PKINIT to build
using NSS
- on newer releases where we build PKINIT using NSS, configure libk5crypto to
build using NSS
- rename krb5-pkinit-openssl to krb5-pkinit on newer releases where we're
expecting to build PKINIT using NSS instead
- during %check, run check in the library and kdc subdirectories, which
should be able to run inside of the build system without issue
- add and own %{_libdir}/krb5/plugins/authdata
- cut down the number of times we load SELinux labeling configuration from
a minimum of two times to actually one (more of #845125)
- tighten up default permissions on kdc.conf and kadm5.acl (#558343)
- Fix gitignore problem with previous patchset
- compile with %{?_smp_mflags} (Steve Grubb)
- drop the bit where we munge part of the error table header, as it's not
needed any more
- build with -fno-strict-aliasing, which is needed because the library
triggers these warnings
- don't forget to label principal database lock files
- fix the labeling patch so that it doesn't break bootstrapping
- disable kshell and eklogin by default
- New upstream prerelease (1.16-beta2)
- klist: don't trip over referral entries when invoked with -s (#707145,
RT#6915)
- fix the problem where the %license file has been a dangling symlink
- pull in upstream fix for an incorrect check on the value returned by a
strdup() call (#1132062)
- update to 1.10.3, rolling in the fixes from MITKRB5-SA-2012-001
- Fix use of enterprise principals with forwarding
- move condrestarts to postun
- make xinetd configs noreplace
- add descriptions to xinetd configs
- add /etc/init.d as a prereq for the -server package
- patch to properly truncate $TERM in krlogind
- Actually bump kdbversion like I was supposed to
- fix credential forwarding problem in klogind (goof in KRB5CCNAME handling)
(#11588)
- fix heap corruption bug in FTP client (#14301)
- add fixes from MITKRB5-SA-2008-001 for use of null or dangling pointer
when v4 compatibility is enabled on the KDC (CVE-2008-0062, CVE-2008-0063,
- add fixes from MITKRB5-SA-2008-002 for array out-of-bounds accesses when
high-numbered descriptors are used (CVE-2008-0947, #433596)
- add backport bug fix for an attempt to free non-heap memory in
libgssapi_krb5 (CVE-2007-5901, #415321)
- add backport bug fix for a double-free in out-of-memory situations in
libgssapi_krb5 (CVE-2007-5971, #415351)
- apply patch from upstream to fix KDC denial of service (CVE-2010-0283,
- rebuild
- don't discard the error code from an error message received in response
to a change-password request (#658871, RT#6893)
- switch buildrequires: and requires: on e2fsprogs-devel into
buildrequires: and requires: on libss-devel, libcom_err-devel, per
sandeen on fedora-devel-list
- Enable building with bad system /etc/krb5.conf
- Update backports of certauth and corresponding test
- Remove Zanata test glue and related workarounds
- Bug #1234292 ("IPA server cannot be run in container due to incorrect /usr/sbin/_kadmind")
- Bug #1234326 ("krb5-server introduces new rpm dependency on ksh")
- also perform PAM session and credential management when ftpd accepts a
client using strong authentication, missed earlier
- also label kadmind log files and files created by the db2 plugin
- Bump release + rebuild.
- update to 1.3.1
- update to alpha 2
- drop a couple of patches which were integrated for alpha 2
- in login, allow PAM to interact with the user when they've been strongly
authenticated
- in login, signal PAM when we're changing an expired password that it's an
expired password, so that when cracklib flags a password as being weak it's
treated as an error even if we're running as root
- rebuild properly when pthread_mutexattr_setrobust_np() is defined but not
declared, such as with recent glibc when _GNU_SOURCE isn't being used
- add patch to document the reject-bad-transited option in kdc.conf
- suppress warnings of impending password expiration if expiration is more than
seven days away when the KDC reports it via the last-req field, just as we
already do when it reports expiration via the key-expiration field (#556495)
- link with libtinfo rather than libncurses, when we can, in future RHEL
- gettextize init scripts
- move the compiled-in default ccache location from the previous default of
FILE:/tmp/krb5cc_%{uid} to DIR:/run/user/%{uid}/krb5cc (part of #949588)
- Try harder to avoid password change replay errors
- Resolves: #2077563
- update to the 1.2 release
- ditch a lot of our patches which went upstream
- enable use of DNS to look up things at build-time
- disable use of DNS to look up things at run-time in default krb5.conf
- change ownership of the convert-config-files script to root.root
- compress PS docs
- fix some typos in the kinit man page
- run condrestart in server post, and shut down in preun
- Bump release number
- Include more test suite changes from upstream
- Resolves: #1464381
- update backport of the preauth module interface
- Adjust dependency on crypto-polices to be just the file we want
- Patch courtesy of lslebodn
- Resolves: #1308984
- pull in multiple changes to allow replay caches to be added to a GSS
credential store as "rcache"-type credentials (RT#7818/#7819/#7836,
- Fix CVE-2016-3120
- Resolves: #1361051
- incorporate a fix to teach the file labeling bits about when replay caches
are expunged (#576093)
- change the default configured encryption type for KDC databases to the
compiled-in default of des3-hmac-sha1 (#57847)
- ksu: move account management checks to before we drop privileges, like
su does (#540769)
- selinux: set the user part of file creation contexts to match the current
context instead of what we looked up
- configure with --enable-dns-for-realm instead of --enable-dns, which isn't
recognized any more
- Backport usage of SHA-256 instead of SHA-1 for PKINIT CMS digest
- Resolves: #2066316
- fix build failure caused by change of prototype for glibc
|eventfd()| (#1147887)
- Start using crypto-policies
- New upstream version (1.18)
- Resolves: #1802334
- Resolves: #1820311
- Resolves: #1791062
- Resolves: #1784655
- Add temporay workaround for RH bug #1204646 ("krb5-config
returns wrong -specs path") which modifies krb5-config post
build so that development of krb5 dependicies gets unstuck.
This MUST be removed before rawhide becomes F23 ...
- rebuild
- rebuild
- New upstream release - 1.15.1
- update to 1.10.1
- drop the KDC crash fix
- drop the KDC lookaside cache fix
- drop the fix for kadmind RPC ACLs (CVE-2012-1012)
- properly advertise that the kpropd init script now supports force-reload
(Zbysek Mraz, #630587)
- fix a typo in kerberos.ldif
- fix double-free of enc_part2 in krb524d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- override INSTALL_SETUID at build-time so that ksu is installed into
the buildroot with the right permissions (part of #225974)
- when building with our bundled copy of libverto, package it in with -libs
rather than with -server (#886049)
- update to 1.2.7-beta2 (internal only, not for release), dropping dnsparse
and kadmind4 fixes
- remove patch to set TERM in klogind which, combined with the upstream fix in
1.3.1, actually produces the bug now (#114762)
- Backport fix for change password requests when using FAST (RT#7868)
- Fix k5test prompts for Python 3
- have -server require /usr/share/dict/words, which we set as the default
dict_file in kdc.conf (#817089)
- don't include into the telnet client when we're not using curses
- move the db2 kdb plugin from -server to -libs, because a multilib libkdb
might need it
- patch to avoid depending on to define NI_MAXHOST and NI_MAXSERV
- Exit with status 0 from kadmind
- add patch from Tom Yu for exploitable bugs in rpc code used in kadmind
- fix predictable-tempfile-name bug in krb5-send-pr (CAN-2004-0971, #140036)
- pull patch from svn to undo unintentional chattiness in ftp
- pull patch from svn to handle NULL krb5_get_init_creds_opt structures
better in a couple of places where they're expected
- Update to krb5-1.13.2
- drop patch for krb5-1.13.2-CVE_2015_2694_requires_preauth_bypass_in_PKINIT_enabled_KDC, fixed in krb5-1.13.2
- drop patch for krb5-1.12.1-CVE_2014_5355_fix_krb5_read_message_handling, fixed in krb5-1.13.2
- Add script processing for upcoming Zanata l10n support
- Minor spec cleanup
- make PAM support for ksu also set PAM_RUSER
- fixed server package so that it works now
- drop netdb patch
- kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that
the DISALLOW_ALL_TIX flag is set on an entry, for better interop with Fedora,
Netscape, Red Hat Directory Server (Simo Sorce)
- rebuild on 1.1.1
- pull in fix for building against tcl 8.6 (#1107061)
- rebuild
- fix double-close in keytab handling
- add port of fixes for CAN-2004-0175 to krb5-aware rcp (#151612)
- fix comments in krb5-configs
- pull up fix for not calling a kdb plugin's check-transited-path
method before calling the library's default version, which only knows
how to read what's in the configuration file (RT#7709, #1013664)
- clear fuzz out of patches, dropping a man page patch which is no longer
necessary
- quote %{__cc} where needed because it includes whitespace now
- define ASN1BUF_OMIT_INLINE_FUNCS at compile-time (for now) to keep building
- make profile.d scriptlets mode 644 instead of 755 (part of #225974)
- backport change from SVN to fix a computed-value-not-used warning in
kpropd (#684065)
- pull in changes from upstream which add processing of the contents of
/etc/gss/mech.d/*.conf when loading GSS modules (#1102839)
- work around a compile problem with new openssl
- Fix KDC null dereference on large TGS replies
- update to 1.3.4 final
- always #include to access errno, never do it directly
- enable LFS on a bunch of other 32-bit arches
- update to 1.8.2
- drop patches for CVE-2010-1320, CVE-2010-1321
- New rawhide, new upstream version
- Drop CVE patches
- Rename fix_interposer.patch to acquire_cred_interposer.patch
- Update acquire_cred_interposer.patch to apply to new source
- update to 1.7.1
- don't trip AD lockout on wrong password (#542687, #554351)
- incorporates fixes for CVE-2009-4212 and CVE-2009-3295
- fixes gss_krb5_copy_ccache() when SPNEGO is used
- move sim_client/sim_server, gss-client/gss-server, uuclient/uuserver to
the devel subpackage, better lining up with the expected krb5/krb5-appl
split in 1.8
- drop kvno,kadmin,k5srvutil,ktutil from -workstation-servers, as it already
depends on -workstation which also includes them
- refresh nss_wrapper and add socket_wrapper to the %check environment
- pull in patch for RT#7046: tag a ccache containing credentials obtained via
S4U2Proxy with the principal name of the proxying principal (part of #761317)
so that the default principal name can be set to that of the client for which
it is proxying, which results in the ccache looking more normal to consumers
of the ccache that don't care that there's proxying going on
- pull in patch for RT#7047: allow tickets obtained via S4U2Proxy to be cached
(more of #761317)
- pull in patch for RT#7048: allow PAC verification to only bother trying to
verify the signature with keys that it's given (still more of #761317)
- omit dependent libraries from the krb5-config --libs output, as using
shared libraries (no more static libraries) makes them unnecessary and
they're not part of the libkrb5 interface (patch by Rex Dieter, #240220)
(strips out libkeyutils, libresolv, libdl)
- add more etypes (arcfour) to the default enctype list in kdc.conf
- don't apply previous patch, refused upstream
- fix segfault in telnet due to incorrect checking of gethostbyname_r result
codes (#129059)
- Fix pkinit_anchors path
- Resolves: #1661339
- Fix KDC return code and set prompt types for OTP client preauth
- Resolves: #1370072
- only apply the patch to autocreate /run/user/0 when we're hard-wiring the
default ccache location to be under it; otherwise it's unnecessary
- Make docs build python3-compatible
- Resolves: #1590928
- update to 1.2.8
- Save other programs from worrying about CVE-2017-11462
- Resolves: #1488873
- Resolves: #1488874
- Merge duplicate subsections in profile library
- New upstream release
- Update selinux with RHEL hygene
- Resolves: #1314096
- Drop dependency on pax, ksh
- Remove support for fedora < 20
- Fix log file permissions patch with our selinux
- Resolves: #1309421
- Make krb5kdc -p affect TCP ports
- label all files at creation-time according to the SELinux policy (#228157)
- New upstream release
- pam_rhosts_auth.so's been gone, use pam_rhosts.so instead
- add bison as a BuildPrereq (#20091)
- rebuild
- backport patch to disable replay detection in krb5_verify_init_creds()
while reading the AP-REQ that's generated in the same function (RT#7229)
- update the PIC patch for iaesx86.s to not use ELF relocations to the version
that landed upstream (RT#7815, #1045699)
- back out setting default_ccache_name to the new default for now, resetting
it to the old default while the kernel/keyutils bits get sorted (sgallagh)
- use portreserve to make sure the KDC can always bind to the kerberos-iv
port, kpropd can always bind to the krb5_prop port, and that kadmind can
always bind to the kerberos-adm port (#555279)
- correct inadvertent use of macros in the changelog (rpmlint)
- Fix source URLs in spec file
- Resolves: #1755959
- switch to the version of persistent-keyring that was just merged to
master (RT#7711), along with related changes to kinit (RT#7689)
- go back to setting default_ccache_name to a KEYRING type
- don't forget to set the SELinux label when creating the directory for
a DIR: ccache
- pull in proposed fix for attempts to get initial creds, which end up
following referrals, incorrectly trying to always use master KDCs if
they talked to a master at any point (should fix RT#7650)
- Put KDB authdata first
- Resolves: #1800575
- Move krb5-kdb-version provides from -libs to -devel
- Fix upstream URLs in spec file
- Resolves: #1868039
- Pass gss_localname() through SPNEGO
- Resolves: #1802334
- Display an error message if ocsp pkinit is requested
- add buildrequires: on keyutils-libs-devel to enable use of keyring ccaches,
dragging keyutils-libs in as a dependency
- move /usr/kerberos/bin to end of PATH
- install kadmin header files
- update a test wrapper to properly handle things that the new libkrad does,
and add python-pyrad as a build requirement so that we can run its tests
- New upstream version 1.14.3
- Update to krb5-1.13.1
- drop patch for CVE_2014_5353_fix_LDAP_misused_policy_name_crash, fixed in krb5-1.13.1
- drop patch for kinit -C loops (MIT/krb5 bug #243), fixed in krb5-1.13.1
- drop patch for CVEs { 2014-9421, 2014-9422, 2014-9423, 2014-5352 }, fixed in krb5-1.13.1
- Minor spec cleanup
- Drop dependency on python2-pyrad (dead upstream, broken with new python)
- Switch to using autosetup macro.
- Patches come from git, so it is easiest to just make a git repo
- fixup some int/pointer varargs wackiness
- update to 1.3.6, which includes the previous fix
- build even libdb.a with -fPIC and $RPM_OPT_FLAGS.
- apply upstream patch by way of Burt Holzman to fall back to a non-referral
method in cases where we might be derailed by a KDC that rejects the
canonicalize option (for example, those from the RHEL 2.1 or 3 era) (#715074)
- build alpha with -O0 for now
- Fix flaws in LDAP DN checking
- CVE-2018-5729, CVE-2018-5730
- add some conditional logic to simplify building on older Fedora releases
- turn off krb4 support (it won't be part of the 1.7 release, but do it now)
- use triggeruns to properly shut down and disable krb524d when -server and
-workstation-servers gets upgraded, because it's gone now
- move the libraries to /%{_lib}, but leave --libdir alone so that plugins
get installed and are searched for in the same locations (#473333)
- clean up buildprereq/prereqs, explicit mktemp requires, and add the
ldconfig for the -server-ldap subpackage (part of #225974)
- escape possible macros in the changelog (part of #225974)
- fixup summary texts (part of #225974)
- take the execute bit off of the protocol docs (part of #225974)
- unflag init scripts as configuration files (part of #225974)
- make the kpropd init script treat 'reload' as 'restart' (part of #225974)
- update to 1.3.4 beta1
- remove MITKRB5-SA-2004-001, included in 1.3.4
- Backport patch to fix mechglue for gss_inqure_attrs_for_mech()
- respin with updated version of patch for RT#7650 (#969331)
- pull up latest revision of patch to reduce lockups in rsh/rshd
- drop patch to add additional access() checks to ksu - they add to breakage
when non-FILE: caches are in use (#1026099), shouldn't be resulting in any
benefit, and clash with proposed changes to fix its cache handling
- add deadlock patch, removed old patch
- fix for CVE-2014-5351 (#1145425) "krb5: current keys returned when
randomizing the keys for a service principal"
- fix buffer underrun in unparsing certain principals (CAN-2003-0082)
- New upstream release - krb5-1.15.2
- Adjust patches as appropriate
- Properly close krad sockets
- Resolves: #1380836
- switch man pages to being generated with the right paths in them
- drop old, incomplete SELinux patch
- add patch from Greg Hudson to make srvtab routines report missing-file errors
at same point that keytab routines do (#241805)
- update to 1.2.2, which fixes some bugs relating to empty ETYPE-INFO
- re-enable optimization on Alpha
- use %global instead of %define
- pull up proposed patch for creating previously-not-there lock files for
kdb databases when 'kdb5_util' is called to 'load' (#551764)
- Nix /usr/share/krb5.conf.d to reduce complexity
- update to 1.11.4
- drop patch for RT#7650, obsoleted
- drop patch for RT#7706, obsoleted as RT#7723
- drop patch for CVE-2013-1418/CVE-2013-6800, included in 1.11.4
- fix double-free in the kdc (patch merged into MIT tree)
- include convert-config-files script as a documentation file
- Fix CVE-2017-15088 (Buffer overflow in get_matching_data())
- extend PAM support to ksu: perform account and session management for the
target user
- pull up and merge James Leddy's changes to also set PAM_RHOST in PAM-aware
network-facing services
- incorporate updated fix for CVE-2007-3999 (CVE-2007-4743)
- fix incorrect call to "test" in the kadmin init script (#252322,#287291)
- add patch to fix telnetd vulnerability
- Clean up etype display on KDC
- Resolves: #1664157
- Log preauth names in trace output
- Misc bugfixes from upstream
- Add APIs for marshalling credentials
- Resolves: #1964619
- prebuild PDF docs to reduce multilib differences (internal tooling, #884065)
- drop the kerberos-iv portreserve file, and drop the rest on systemd systems
- escape uses of macros in comments (more of #884065)
- tell krb5kdc and kadmind to create pid files, since they can
- add logrotate configuration files for krb5kdc and kadmind (#462658)
- fix parsing of the pidfile option in the KDC (upstream #6750)
- specify the location of the subsystem lock when using the status() function
in the kadmind and kpropd init scripts, so that we get the right error when
we're dead but have a lock file - requires initscripts 8.99 (#521772)
- remove the krb5-appl bits (the -workstation-clients and -workstation-servers
subpackages) now that krb5-appl is its own package
- replace our patch for #563431 (kpasswd doesn't fall back to guessing your
principal name using your user name if you don't have a ccache) with the
one upstream uses
- backport a fix to allow a PKINIT client to handle SignedData from a KDC
that's signed with a certificate that isn't in the SignedData, but which
is available as an anchor or intermediate on the client (RT#7183)
- pull in keyutils as a build requirement to get the "KEYRING:" ccache type,
because we've merged
- remove setuid bit on v4rcp and ksu in case the checks previously added
don't close all of the problems in ksu
- apply patches from Jeffrey Schiller to fix overruns Chris Evans found
- reintroduce configs subpackage for use in the errata
- add PreReq: sh-utils
- update to 1.11 beta 2
- refresh patch for #542868 from trunk
- Add support to query the SSF of a context
- Pick up rename of perl dependency
- generate src/include/krb5/krb5.h before building
- fix conditional for sparcv9
- Switch to %ldconfig_scriptlets
- mark profile.d config files noreplace (Laurent Rineau, #196447)
- fix krb5-send-pr (#18932) and move it from -server to -workstation
- buildprereq libtermcap-devel
- temporariliy disable optimization on alphas
- gettextize init scripts
- build alpha with -O0 for now
- own %{_var}/kerberos
- Zap data when freeing krb5_spake_factor
- fix broken dependency on awk (should be gawk, rdieter)
- libgssapi: pull in patch from svn to stop returning context-expired errors
when the ticket which was used to set up the context expires (#605366,
upstream #6739)
- kadmin.service: fix #723723 again
- kadmin.service,krb5kdc.service: remove optional use of $KRB5REALM in command
lines, because systemd parsing doesn't handle alternate value shell variable
syntax
- kprop.service: add missing Type=forking so that systemd doesn't assume simple
- kprop.service: expect the ACL configuration to be there, not absent
- handle a harder-to-trigger assertion failure that starts cropping up when we
exit the transmit loop on time (#739853)
- Add flag to disable encrypted timestamp on client
- rebuild
- New upstream prerelease (1.16-beta1)
- apply upstream patch to fix a null pointer dereference when processing
TGS requests (CVE-2011-1530, #753748)
- Remove WITH_NSS macro (always false)
- Remove WITH_SYSTEMD macro (always true)
- Remove WITH_LDAP macro (always true)
- Remove WITH_OPENSSL macro (always true)
- fix summaries and descriptions
- switched the default transfer protocol from PORT to PASV as proposed on
bugzilla (#16134), and to match the regular ftp package's behavior
- Add send/receive sendto_kdc hooks and corresponding tests
- Resolves: #1321135
- clean up init script for server, verify that it works [jlkatz]
- clean up rotation script so that rc likes it better
- add clean stanza
- add patch to build semi-useful static libraries, but don't apply it unless
we need them
- Continue after KRB5_CC_END in KCM cache iteration
- Fix capaths "." values on client
- Resolves: 1551099
- rebuild
- grab a more-commented version of the most recent patch from upstream
master
- make a guess at making the 32-bit AES-NI implementation sufficiently
position-independent to not require execmod permissions for libk5crypto
(more of #1045699)
- make krb5-libs obsolete the old krb5-configs package (#18351)
- don't quit from the kpropd init script if there's no principal database so
that you can propagate the first time without running kpropd manually
- don't complain if /etc/ld.so.conf doesn't exist in the -libs %post
- use %{_infodir} to better comply with FHS
- move .so files to -devel subpackage
- tweak xinetd config files (bugs #11833, #11835, #11836, #11840)
- fix package descriptions again
- apply fix from Tom Yu for MITKRB5-SA-2004-004 (CAN-2004-1189)
- Upstream release. No actual change from beta, just version bump
- Clean up unused parts of spec file
- Fix CVE-2017-11368 (remote triggerable assertion failure)
- fix a compile error in the SELinux labeling patch when -DDEBUG is used (Sumit
Bose)
- Put openssl runtime requirement in the right place this time
- Resolves: #1754690
- Backport kdcpolicy interface
- amend the PIC patch for iaesx86.s to also save/restore ebx in the
functions where we modify it, because the ELF spec says we need to
- Backport certauth eku security fix
- pull in patch from trunk to rename krb5int_pac_sign() to krb5_pac_sign() and
make it public (#745533)
- pull a fix from SVN to get libgssrpc clients (e.g. kadmin) authenticating
using the old protocol over IPv4 again (RT#6920)
- Add krb5_db_register_keytab
- Resolves: #1376812
- correct a bug in the fix for #754001 so that the file creation context is
consistently reset
- Add upstream crashfix patch (RT#7081)
- skip the setfscreatecon() if fopen() is passed "rb" as the open mode (part
of #819115)
- rebuild
- Guess Samba client mutual flag using ap_option
- Resolves: #1370980
- pull up fix for importing previously-exported credential caches in the
gssapi library (RT# 7706, #1019420)
- modify the deltat grammar to also tell gcc (4.7) to suppress
"maybe-uninitialized" warnings in addition to the "uninitialized" warnings
it's already being told to suppress (RT#7080)
- Unify kvno option documentation
- Resolves: #1869055
- Update otp patches
- Merge otp patches into a single patch
- Add keycheck patch
- libgssapi_krb5: properly export the acceptor subkey when creating a lucid
context (Kevin Coffman, via the nfs4 mailing list)
- Use full paths in krb5.sh to avoid path lookups
- set "rdns = false" in the default krb5.conf (#908323,#908324)
- New upstream release
- add an auth stack to ksu's PAM configuration so that pam_setcred() calls
won't just fail
- reintroduce missing %postun for the non-split_workstation case
- add missing pam-devel build requirement, force selinux-or-fail build
- kadmind.init: don't fail outright if the default principal database
isn't there if it looks like we might be using the kldap plugin
- kadmind.init: attempt to extract the key for the host-specific kadmin
service when we try to create the keytab
- Remove downloadable source signature file
- Resolves: rhbz#2219654
- apply updated patch from MITKRB5-SA-2004-001 (revision 2004-06-02)
- add upstream fix for denial-of-service in SPNEGO (CVE-2010-0628, #576325)
- kdc.conf: no more need to suggest keeping keys with v4-compatible salting
libogg-1.3.2-10.el8.x86_64.rpm | - libogg 1.3.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Fixed warnings in shipped m4 file.
- libogg 1.1.4
- remove unpackaged files from the buildroot
- Some more small specfile cleanups for merge review (bz 226035)
- Rebuild for PPC toolchain bug
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Update to 1.1.3
- doc/ogg changed to doc/libogg
- Use '|' instead of '/' as pattern delimiter in sed expressions (Fix FTBFS).
- fixing multilib conflict (#831414)
- fixed libogg-devel-docs (BZ #510608) (By Edward Sheldrake)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- rebuilt for new gcc4.1 snapshot and glibc changes
- one-dot-oh
- update to 1.0rc1
- beta4
- add explicit epoch's where needed.
- Fix epoch.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- rebuilt
- Upgrading to 1.3.2
- Cleaning the spec
- Fixing bogus dates in the changelog
- rebuild for gcc 4.0
- rebuilt
- libogg 1.2.2
- Autorebuild for GCC 4.3
- libogg 1.1.4rc1
- split devel docs to noarch subpackage
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Update to 1.1.2
- Delete upstreamed libogg-1.1-64bit.patch
- Delete upstreamed libogg-underquoted.patch
- update CVS
- fix bogus group
- update to 1.0rc2
- Package review cleanups
- Don't ship a static library
- aarch64 support (#925834)
- minor spec cleaning
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- rebuilt
- rebuilt
- rebuilt
- Some small specfile cleanups
- Add smpflags to make invocation (bz 226035)
- fix ogg.m4
- update to 1.1
- rebuild because of broken fileutils
- bump again for double-long bug on ppc(64)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- automated rebuild
- Fix 202280
- update to 1.0rc3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuild for pkgconfig provides
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- rebuild
- automated rebuild
- automated rebuild
- Switch to %ldconfig_scriptlets
- libogg 1.2.0
- Require automake in the -devel package
- initial spec file created
- clean up specfile slightly
- own %{_includedir}/ogg
- Don't install Makefile's as %doc, avoiding a multilib conflict (bz 342281)
- rebuilt
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- update CVS in prep for beta4
- build for RHEL
libquadmath-8.5.0-28.el8_10.x86_64.rpm | - Add a plugin-annobin subpackage. (#2067150)
- rebuild
- Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90240)
- add -Wbidi-chars patch (#2008392)
- avoid cycling on certain subreg reloads (PR rtl-optimization/96796, #2028798)
- fix bad use of VMAT_CONTIGUOUS (PR tree-optimization/97236, #1925632)
- backport workaround for broken C/C++ wrappers to LAPACK (#1711346)
- backport aarch64 LSE atomics (#1821994)
- apply cprop_hardreg fix for narrow mode != lowpart targets (#2028609)
- avoid changing PHIs in GIMPLE split_edge (#2117838)
- update from Fedora 8.1.1-1
- require docbook-style-xsl instead of docbook5-style-xsl (#2073888)
- backport Default widths with -fdec-format-defaults patch (#2074614)
- fix strlen range with a flexible member array (#2137448)
- Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-50290).
- enable annobin annotations (#1574936)
- update from Fedora 8.2.1-1
- backport straight-line-speculation mitigation (#2108721)
- update from GCC 8.5 release (#1946758)
- this includes a fix for PR target/87839 (#1958295)
- rebuild
- fix BuildRequires of python-sphinx
- fix deserialization for std::normal_distribution (#2130392,
PR libstdc++/105502)
- initialize std::normal_distribution::_M_saved (PR libstdc++/99536)
- reject std::make_shared (PR libstdc++/99006)
- fix ICE in the vectorizer (RHEL-32886)
- backport PCH tweaks (#2030878)
- fix mangling of lambdas in default args (PR c++/91241, #1981822)
- add a few Provides: bundled
- rebuild for CVE-2020-11023 (RHEL-78274)
- revert upstream PR85873 gcc-8 fix, apply the fix from gcc-9 (#1960701)
- fix 'this' adjustment for devirtualized call (PR c++/100797, #1965951)
- fix for TLSLD references (#2213753)
- fix crash in dynamic_cast<>() on null pointer (PR c++/99074, #2211506)
- adjust a pattern in s390.md (PR target/87723, #2214847)
- when linking against libgcc_s, link libgcc.a too (#2022588)
- Sync libstdc++ pretty printers to latest GTS (RHEL-50290).
- update from Fedora gcc-8.3.1-5 (#1747157)
- use unspec_volatile for darn (PR target/91481, #1760205, CVE-2019-15847)
- avoid IFUNC resolver access to uninitialized data (#1559350, PR libgcc/60790)
- fix typos in manual (#1612514)
- update from Fedora 8.3.1-3 (#1680182)
- remove load and test FP splitter (#1673116)
- fix *movsi_from_df (#1677652)
- add missing headers
- add support for live patching (#1668903)
- retire gcc8-rh1612514.patch, gcc8-rh1652016.patch, gcc8-rh1652929-?.patch
- Fix nop generation in annobin plugin. (#2067150)
- update from GCC 8.4 release (#1946758)
- back out the PR97236 patch
- update from Fedora 8.2.1-3
- update from Fedora 8.1.1-5
- update from Fedora 8.3.1-4 (#1680182)
- drop gcc8-pr60790.patch, gcc8-pr89629.patch, gcc8-rh1668903-4.patch
- don't reuse DEBUG_EXPRs with vector type (PR middle-end/100508, RHEL-79501)
- guard the bit test merging code in if-combine (RHEL-11483)
- enable hardening of binaries (#1624114)
- disable libgccjit on RHEL
- backport the -fuse-ld=lld option (#1670535)
- TLS model fix (#1678555, PR c++/85400)
- two small autoFDO fixes (#1686082)
- libgomp update (#1707568)
- member template redeclaration fix (#1652704, PR c++/86747)
- turn libgcc_s.so into a linker script on i?86, x86_64, ppc64le and also on
ppc and ppc64 for 64-bit multilib (#1708309)
- avoid using unaligned vsx or lxvd2x/stxvd2x for memcpy/memmove inline
expansion (#1666977)
- consider negative edges in cycle detection (#1817991, PR gcov-profile/91601)
- fix Fortran debug info for arrays with descriptors (#1655624,
PR fortran/92775)
- fix wrong code emitted for movv1qi on s390x (#1784758, PR target/92950)
- remove python2 dependecy (#1595385)
- s390x: add support for register arguments preserving (#2168205)
- remove support for demangling GCC 2.x era mangling schemes (#1668394)
- Backport PPC string inlines from trunk which allow for valgrind's
memcheck to work properly (#1652929)
- Backport bugfix for clz pattern on s390 affecting jemalloc (#1652016)
- backport std::regex check for invalid range (#2001788)
- change the default -march on s390x to z13 with tuning for z14 (#1571124)
- use --disable-multilib on s390x
- update from GCC 8.4 release (#1868446)
- remove symlinks to 32-bit versions of these static libraries: libasan.a,
libitm.a, libquadmath.a, libubsan.a, libgfortran.a (#1779597)
- tweak gcc8-rh1668903-1.patch and gcc8-rh1668903-2.patch patches
- fix typo in the cprop_hardreg patch (#2028609)
- new package
- Sync libstdc++ pretty printers to latest GTS (RHEL-82506).
- aarch64: Add -mtune=neoverse-512tvb (#1845932)
- additional fix for the libgomp testsuite (#1707568)
- fix shift count operand printing (#1730380)
- fix tree-outof-ssa.c ICE with vector types (PR middle-end/90139, #1730454)
- fix out-of-ssa with unsupported vector types (PR rtl-optimization/90756,
- fix ICE with template placeholder for TTP (PR c++/86098, #1730454)
librsvg2-2.42.7-5.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Update to 2.42.6
- Use bundled rust deps
- Add missing scriptlets for librsvg3
- Fix requires for librsvg3-devel package
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to 2.14.3
- Update to 2.40.3
- Update to 2.37.0
- Add GTK3 port of the libraries
- Update to 2.39.0
- Update dependencies (now cairo only, not libart)
- update version
- Buildrequire libcroco
- Update to 2.40.16
- Update to 2.7.2
- Fix up changelog section
- Update to 2.40.11
- Drop ancient librsvg3 obsoletes
- Update to 2.15.90
- Plug memory leaks
- update to 2.6.1
- Fix libcroco in link line. Fixes #107875.
- Properly require libgsf and libcroco
- Update to 2.32.1
- Update to 2.26.0
- Update to 2.40.17
- Remove lib64 rpaths
- Rebuild with the current rust-toolset
- Update to 2.20.0
- rebuilt
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Split rsvg-view-3 and rsvg-convert to a -tools subpackage (#915403)
- Rebuild against new libpng
- Update to 2.18.2
- Autorebuild for GCC 4.3
- Update to 2.42.7
- Convert specfile to UTF-8.
- rebuild to get new gtk bin age
- automated rebuild
- Rebuild for build ID
- Add a patch that moves the includes to librsvg-1/librsvg
- in preparation for a later librsvg 2 library.
- update to 2.1.3
- Switch to %ldconfig_scriptlets
- Update to 2.14.0
- Update to 2.16.0
- Require pkgconfig in the -devel package
- Rebuilt on new gcc
- New upstream version
- build requires gnome-libs-devel, #49509
- Merge-review cleanup (#226040)
- Update to 2.22.0
- Rely on gdk-pixbuf2 file triggers
- Add manpage
- Update to 2.40.7
- Use license macro for COPYING and COPYING.LIB
- Use pkgconfig for BuildRequires
- Add URL
- own includedir/librsvg-2
- Update to 2.40.5
- Update to 2.40.13
- Fix bogus date in changelog
- Update to 2.2.1, fixes crash
- Removed temporary manpage hack
- 1.0.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Fix multilib issues
- rebuilt
- Build gobject-introspection bindings
- bump to 2.4.0
- new version for GNOME 2.4
- put .la file back in package
- BuildRequires libtool, libgnomeui-devel, there may be more
- -devel req libcroco-devel
- Update to 2.40.18
- Rebuild against new GTK+
- Require GTK+ 2.9.0
- rebuilt
- remove libtool, automake14 buildreqs
- Fix rawhide upgrade path with librsvg3
- Update to 2.16.1
- Update to 2.13.93
- Require gtk2 2.2.0 for the pixbuf loader (#80857)
- Update to 2.40.15
- New upstream version
- Update to 2.18.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Update to 2.32.0
- Update to a git snapshot that builds against standalone gdk-pixbuf
- Drop librsvg3 package
- Drop svg theme engine
- Must use the same rpm macro for the host triplet as the
gtk2 package, otherwise things can fall apart. (#137676)
- Update to 2.40.9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Update to 2.14.2
- 1.1.6
- Resolves: RHEL-635 Upgrade to procedural-masquerade 0.1.7 to fix FTBFS with newer Rust
- Resolves: RHEL-636 librsvg2 is missing Provides: bundled()
- Resolves: RHEL-637 Add git-core as a BR for autosetup
- Update to 2.36.4
- Update to 2.35.2
- fix bad libart dep
- rebuild
- change to separate Requires(post/postun) lines
- Update to 2.2.0
- new CVS snap 1.1.0.91
- remove automake/autoconf calls
- use system libtool (#88339)
- Update to 2.26.1
- Move docs to rpm docdir
- fix crash in rsvg-gobject.c:instance_dispose function
(https://bugzilla.gnome.org/show_bug.cgi?id=623383)
- Update to 2.13.3
- convert to librsvg2 RPM
- Update to 2.36.1
- Removed unrecognized configure options
- Include the man page in the rpm
- update to 2.6.4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Don't use the epoch, thats implicitly zero and not defined
- Update to 2.40.10
- Update to 2.1.2
- rebuild in different environment
- own /usr/include/librsvg
- Resolves: rhbz#1804519 Add patch for CVE-2019-20446
- Fix including rsvg.h always causing a deprecated warning, as this breaks
apps compiling with -Werror
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update to 2.42.1
- PreReq gtk2 instead of just requiring it (#90697)
- rebuilt
- Update to 2.40.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Update to 2.40.12
- Don't package gdk-pixbuf.loaders, it gets generated
in the %post
- New upstream version
- fixed the linefeed problem in multibyte environment. (Bug#49310)
- Update to 2.34.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Update license field
- Update to 2.36.3
- Package the librsvg Vala bindings
- Properly handle updating of arch-dependent config
files. (#124483)
- Update to 2.40.8
- Plug a memory leak
- Update to 2.40.4
- Tighten subpackage deps with the _isa macro
- Update to 2.31.0
- Update to 2.40.20
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Fix usage of "%{_bindir}/update-gdk-pixbuf-loaders %{_host}"
to point to right place and architecture
- Put into Red Hat Build system
- Update to 2.35.1
- Update to 2.22.3
- Update to 2.42.2
- New upstream version
- 2.2.3
- Moved engine and loaders from devel package
- Update to 2.42.3
- Fix the .pc file to require gdk-pixbuf-2.0
- Update to 2.13.5
- Fix libtool
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- automated rebuild
- Update to 2.22.2
- Update to 2.2.2.1, crash fixes
- BuildReq libcroco-devel, seems this _can_ get picked up
- Fix a crash (#603183)
- rebuilt
- Update to 2.40.19
- rebuild
- BR vala instead of obsolete vala-tools subpackage
- Update to 2.13.92
- Update to 2.40.6
- Rebuilt for gobject-introspection 1.41.4
- Update to 2.34.0
- Update to 2.26.2
- Put changelog at the end
- Move .so files to devel subpackage
- Don't mess with ld.so.conf
- Don't use %{prefix}, this isn't a relocatable package
- Don't define a bad docdir
- Add BuildRequires
- Use %{_tmppath}
- Don't define name, version etc. on top of the file (why
do so many do that?)
- s/Copyright/License/
- Update to 2.36.0
- rebuild in different environment
- Update to 2.14.1
- bump again for double-long bug on ppc(64)
- BuildRequire libgsf-devel
- Add missing libs
- Rebuild with gcc4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Don't let scriptlets fail (#243185)
- Update to 2.26.3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- created this thing
- Update to 2.40.2
- Manpage were installed in the wrong place
- Update to 2.18.0
- Update to 2.15.0
- Don't ship static libs
- Update to 2.40.1
- automated rebuild
- full version in -devel requires (#102063)
- update to 2.9.5
- Update to 1.1.3
- update to 2.8.1
- removed obsoletes from sub packages and added mozilla and
trilobite subpackages
- Newer upstream version
- Compile with svgz support
- Update to 2.22.1
- Update to 2.35.0
- 2.0.1
libsndfile-1.0.28-16.el8_10.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Updated to 1.0.14
- Dropped patch0
- fix prerequisit patch (#RHEL-65093)
- fix incomplete patch for CVE-2015-7805
- Initial build.
- Autorebuild for GCC 4.3
- Fix format string bug (#149863).
- Drop explicit Epoch 0.
- Update to 10.0.22
- Update to 10.0.21
- Do not include the static library in the package (RHBZ#556074)
- Remove BR on jack since sndfile-jackplay is not provided anymore
- Adding FLAC support to libsndfile courtesy of gentoo, #237575
- Fixing CVE-2007-4974. Thanks to the gentoo people for the patch, #296221
- Update to 1.0.24
- fix CVE-2014-9496: 2 buffer overruns in sd2_parse_rsrc_fork (#1178840)
- division by zero leading to denial of service in psf_fwrite (#1177254)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- rebuild (#2118285)
- updated to 1.0.27
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Split utils into a subpackage
- Modernise spec
- Generic 32/64bit platform detection
- fix flac and pcm buffer overflows (CVE-2017-8361,CVE-2017-8362,CVE-2017-8363,CVE-2017-8365)
- a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985028)
- heap-based Buffer Overflow in psf_binheader_writef function (#1483140, CVE-2017-12562)
- Update to 1.0.25
- fixes integer overflow by processing certain PAF audio files (#721240)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- fix CVE-2015-7805: Heap overflow vulnerability when parsing specially
crafted AIFF header
- fix license tag
- Add FLAC/Ogg/Vorbis support (BR: libvorbis-devel)
- Make build verbose
- Remove rpath
- Fix ChangeLog encoding
- Move the big Changelog to the devel package
- fix buffer overflow in aiff (CVE-2017-6892,rhbz#1463328)
- Updated to 1.0.16
- fix heap buffer overflow in flac (#2030507)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Update to 10.0.23
- fix crash in ogg vorbis (#RHEL-65093) (CVE-2024-50612)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Fix up previous commit
- Use __isa_bits macro instead of list of 64-bit architectures
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Rebuilt against libtool 2.2
- Updated to 1.0.17
- Fixed multilib conflict. #342401
- Made flac support actually work correctly.
- fix support for aarch64 (#925887)
- fix coverity scan found issues (#1602592)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- updated to 1.0.28
- fix possible buffer overflow when parsing crafted ID3 tags (#1440758, CVE-2017-7586)
- fix possible buffer overflow when parsing crafted flac file (#1440756, CVE-2017-7585)
- fix integer overflows causing CVE-2022-33065 (#RHEL-3750)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- fix CVE-2018-13139 - stack-based buffer overflow in sndfile-deinterleave utility (#1598482)
- Update to 1.0.10, update URLs, include ALSA support.
- Disable dependency tracking to speed up the build.
- Add missing ldconfig invocations.
- Make -devel require pkgconfig.
- Include developer docs in -devel.
- Provide -octave in main package, own more related dirs.
- Bring specfile up to date with current spec templates.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- fix support for aarch64, another part (#969831)
- Patch to use system libgsm instead of a bundled copy.
- Make main package dep in -devel ISA qualified.
- Drop -octave Provides (not actually built with octave > 3.0).
- Don't build throwaway static lib.
- Run test suite during build.
- fix ppc64le build (#1051639)
- fix CVE-2018-19661 and CVE-2018-19662 - buffer over-read in the function
i2alaw_array in alaw (#1673085)
- rebuilt
- Fix FTBFS
- Use %license
- Do not build against Jack on RHEL
- Fix the Source0: URL
- Fix the licence tag
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Updated to 1.0.15
- Update to 1.0.11.
- Updated to 1.0.20
- Removed spurious #endif in the libsndfile.h wrapper. Thx to Edward
Sheldrake for finding it. Fixes #468508.
- Fix build for autoconf-2.63
libsrtp-1.5.4-8.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- initial package
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Port to openssl 1.1.0
- Build against openssl
- Resolves: rhbz#1618747
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- use upstream provided .pc file (bz1313590)
- rename internal functions to avoid conflicts (bz 956340)
- Don't use '-z noexecstack' option for linker on PPC64 (EL6)
- update to 1.5.4
- fix MIPS name collision (bz1305950 ) Thanks to Michal Toman
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- update the config.h header aarch64 is a 64 bit arch though there is no multilib
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- api changes between 1.4.4 and 1.5.0, bump sover to 1.0.0
- fix linking issue to make proper libsrtp.so.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- use __PPC64__, not __ppc64__ which is undefined on PPC64 arch
- handle config.h multilib (bz787537)
- apply fix for CVE-2013-2139 from https://github.com/cisco/libsrtp/pull/27
- fix library linking typo
- fix shared lib generation to silence ldconfig
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update for 1.5.0 release.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
libtheora-1.1.1-21.el8.x86_64.rpm | - Fix FTBFS due to underlinked examples
- rebuild with gcc 4.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Add patch to fix FTBFS with libpng-1.6
- Update to 1.0rc1
- bump again for double-long bug on ppc(64)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- 1.1alpha2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- libtheora 1.1.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Update config.guess/sub for new architecture support
- rebuilt for new gcc4.1 snapshot and glibc changes
- libtheora 1.1alpha1. Woo Thusnelda!
- Fix libtheoraenc getting build but not installed
- Add Epoch dependencies for future Epoch increment safety measure
- Apply patch to fix include path, thanks to Thomas Vander Stichele
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Remove no longer needed autoreconf call, %configure from redhat-rpm-config
>= 9.1.0-42 updates config.guess and config.sub for new architecture support
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Put development documentation in its own subpackage to fix multilib
conflicts (rh 477290)
- New upstream release 1.0beta3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Add BuildRequires on libvorbis-devel (134664)
- Fix Source0 URL
- 1.1beta1
- Autorebuild for GCC 4.3
- Rebuild for new libpng
- 1.1beta2
- Update png2theora to latest svn version (bz 401681)
- support and enable bootstrap mode (ie, no docs)
- Use xz compressed upstream tarball.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Fix a directory ownership issue (#233872)
- Small spec cleanups
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- rebuild
- run autoreconf for aarch64 support (#925898)
- add a patch from upstream fixing a crash when compiled with gcc-4.8 (#959001)
- cleanup spec-file
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to 1.0alpha7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- New upstream release 1.0beta1 (bz 307571)
- 1.0 final release
- need epoch because we were not using the special pre-release
version-release scheme used now a days in Fedora :(
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- disable bootstrap
- Make -devel-docs noarch
- Fix textrelocations on i386 (bz 253591)
- Fix build on x86_64
- Switch to %ldconfig_scriptlets
- Update to 1.0alpha5
- Update to 1.0alpha8 svn (revision 13393) snapshot
- Initial build
- Put Obsoletes/Provides theora-exp-devel in the -devel package instead of in
the -tools package (oops)
- Install png2theora (bz 349951)
- New upstream version 1.0alpha4
- Remove upstreamed patch libtheora-1.0alpha3-include.patch
- Use Theora_I_spec.pdf for spec
- Add in .pc file (yay! another library sees the light)
- Add api docs to the -devel package
- New upstream bugfix release 1.0beta2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- libtheora 1.1.1
- rebuilt
- 1.1beta3
- rebuild
libvisual-0.4.0-25.el8.x86_64.rpm | - bump release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- fix dependency for modular X
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- fix build for GCC4
- version 0.1.7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Initial RPM release.
- defining inline causes problems trying to build against libvisual headers,
e.g. libvisual-plugins
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- 0.5.0 beta was a bad idea. nothing else supports it.
- fix format-security issue
- Fix epoch use
- rebuild for FC5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Apply Adrian Reber's suggestions in bug 2182
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- rebuild
- use dist tag for all-arch-rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Fix multilib conflicts in lvconfig.h
- Resolves: #1853155
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- version 0.4.0
- drop Patch0 (applied upstream)
- Fix bogus #if where #ifdef was meant
- version 0.2.0
- drop patch
- Better Altivec detection, code from David Woodhouse
- rebuilt
- rebuild
- Autorebuild for GCC 4.3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- fix license tag
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- spec file cleanups
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
libvorbis-1.3.6-2.el8.x86_64.rpm | - libvorbis 1.3.1. Fixes surround.
- Fixed warnings in shipped m4 file.
- add epochs to dependencies, to avoid 1.0rc3 >= 1.0 miscomparisons
(#79374)
- fix vorbis.m4
- Nuke -mcpu=750 from cflags for PPC, that plus -mcpu=power7 confuses gcc.
- Fix doc subpackage build (#540634)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- libvorbis 1.3.3 (#787635)
- Fix #81026 by updating libvorbis-1.0-m4.patch
- fix CVE-2008-1420, CVE-2008-1419, CVE-2008-1423 (#446344)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Update to 1.1.0
- Remove upstreamed patch libvorbis-underquoted.patch
- Update to 1.1.1
- libvorbis-1.2.2-svn16228.patch: Backport a fix from pre-1.2.3 to hopefully
fix small sound file playback. (#505610)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Fix patch fuzz build failure
- Switch to %ldconfig_scriptlets
- rebuild with gcc 4.0
- rebuilt
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- rebuilt
- Run test suite during build.
- Fix doc file permissions and duplicate doc dir ownership.
- rpmlint warning fixes.
- bump again for double-long bug on ppc(64)
- rebuilt for new gcc4.1 snapshot and glibc changes
- rebuilt
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- libvorbis 1.2.2rc1
- rebuilt
- libvorbis 1.3.4
- Install docs to %{_pkgdocdir} where available (#993967).
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Don't include Makefile's in %doc, avoiding a multilib conflict (bz 342481)
- rebuilt
- remove unpackaged files from the buildroot
- tell configure where ogg libs are
- lib64'ize
- Fix build for https://fedoraproject.org/wiki/Changes/Harden_All_Packages
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- ship documentation only in -doc subpackage and only license
in -devel (#540634) - thanks to Edward Sheldrake
- -devel-doc subpackage requires -devel
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuild for build ID
- Autorebuild for GCC 4.3
- libvorbis 1.2.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- libvorbis-1.2.3-add-needed.patch: Fix FTBFS from --no-add-needed
- Package review cleanups
- Don't ship static libraries
- Include COPYING in base package too.
- Update to 1.1.2
- rebuilt
- libvorbis 1.3.2
- Fix typos in %description (#245471)
- libvorbis 1.2.3
- link to .pdf spec rather than ship redundant copy
- spec cleanups
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Update to 1.3.5 (#1197923)
- Use license macro for COPYING
- Tighten subpackage dependencies
- Use make_install and make_build macros
- Use pkgconfig for BuildRequires
- Remove unnecessary Requires from devel subpackage
- Remove obsolete Obsoletes
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Update to 1.2.0
- Resolves: #250115
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- libvorbis 1.3.6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- rebuild
- Sync with git for CVE-2017-14160, CVE-2018-10392, CVE-2018-10393
- rebuilt
- backport patches to fix CVE-2009-3379 (#531765) from upstream
- rebuild to get provides pkgconfig(vorbisenc)
- update to 1.0.1
libwebp-1.0.0-11.el8_10.x86_64.rpm | - Add BuildRequires: freeglut-devel to build vwebp
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Added fixes for rhbz#1956853, rhbz#1956856, rhbz#1956868, rhbz#1956917
- Use frename-registers cflag to fix FTBFS on aarch64
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Use Requires: java-headless rebuild (#1067528)
- upstream release 0.4.2
- Update to 0.6.0
- new upstream release 0.2.1
- rebuild due to "jpeg8-ABI" feature drop
- rebuild against new libjpeg
- upstream release 0.5.1
- upstream release 0.4.4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Bump the release to "9" to accommodate the 9.1.0.z release bumps as
libwebp-1.0.0-8.el9 < libwebp-1.0.0-8.el8_7
- Added fix for CVE-2023-4863
- Update to 0.6.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- upstream release 0.4.3
- Update to 1.0.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Fix LDFLAGS not passed when building libwebp_jni.so (#1548718)
- More big-endian fixes
- upstream release 0.3.0
- enable gif2webp
- add build requires on giflib-devel and libtiff-devel
- use make_install and hardened macros
- list binaries explicitly
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- upstream release 0.3.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- upstream release 0.5.0
- Fixing endian checks (#962091)
- Fixing FTPBS caused by rpath presence
- enable webpdemux
- Several spec improvements by Scott Tsai
- Initial spec. Based on openSUSE one
- Added fixes for rhbz#1956829, rhbz#1956843, rhbz#1956919
- Rebuild a package for shipping libwebp-tools in CRB
- Resolves: RHEL-86884
- Update to 0.5.2
- Switch to %ldconfig_scriptlets
- upstream release 0.4.1
- upstream release 0.4.0
- Backport upstream big-endian fix
- Rebuild (giflib)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Add fix for mzbz#1819244
- Fix tools subpackage dependency
- Bump the release to "8" to accommodate the 8.7.0.z release bumps
- Backport e2affacc35f1df6cc3b1a9fa0ceff5ce2d0cce83 (CVE-2016-9085, rhbz#1389338)
- Backport another big-endian fix
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
libxkbcommon-x11-0.9.1-1.el8.x86_64.rpm | - xkbcommon 0.6.1
- xkbcommon 0.4.2 (#1000497)
- own %{_includedir}/xkbcommon/
- -x11: +ldconfig scriptlets
- -devel: don't include xkbcommon-x11.h
- run reautoconf in %prep (instead of %build)
- tighten subpkg deps via %_isa
- .spec cleanup, remove deprecated stuff
- BR: pkgconfig(xcb-xkb) >= 1.10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- xkbcommon 0.7.1
- inital import
- Update to 0.4.3
- xkbcommon 0.3.0
- BuildRequire xkeyboard-config-devel to get the right XKB target path (#799717)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- libxkbcommon 0.8.2 (#1619541)
- libxkbcommon 0.8.0
- always build the x11 subpackage
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Switch to %ldconfig_scriptlets
- Require xkeyboard-config (#1145260)
- Add patch from upstream adding XF86Keyboard and XF86RFKill keysyms
- make -x11 support conditional (f21+, #1000497)
- --disable-silent-rules
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- libxkbcommon 0.9.1 (#1728801)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Today's git snapshot
- Update to 0.5.0 (#1154574)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Bump release to 2 to avoid confusion with non official non scratch 0.4.2-1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- xkbcommon 0.7.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Today's git snapshot
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- xkbcommon 0.2.0
- xkbcommon 0.4.0
- Add new xkbcommon-x11 and xkbcommon-x11-devel subpackages
- Today's git snap
- xkbcommon 0.3.1
net-snmp-5.8-32.el8_10.x86_64.rpm | - fix sparc handling in /usr/include/net-snmp/net-snmp-config-sparc.h
- rebuilt in new environment
- implement force-reload command in initscripts (#523126)
- New prereq for net-snmp-devel
- lelf check removed from configure.in (#128748)
- fixed snmpd coredump when sent SIGHUP (#127314)
- updated to net-snmp-5.7
- fix to use libwrap in distro
- add buildprereq: tcp_wrappers
- introduce /etc/sysconfig/snmptrapd. Use it to specify snmptrapd command
line options. /etc/snmp/snmptrapd.options is not used anymore (#540799)
- build-in ipAddressPrefixTable, ipDefaultRouterTable, ipv6ScopeZoneIndexTable,
ipIfStatsTable, SCTP-MIB, RMON-MIB and Etherlike-MIBs
- remove ucd5820stat helper script, it depends on get5820stats, which is not
available in Fedora
- move sample services ipf-mod.pl to documentation
- remove logrotate config, snmpd logs into syslog
- Fixed permission for net-snmp-config in net-snmp-devel
- update to release candidate 4
- Added ucd5820stat to the files section.
- Updated to latest version (4.2.4.pre3)
- ucd-snmpd.init: start daemon w/o -f.
- use net.ipv6.neigh.lo.retrans_time_ms (#186546)
- net-snmp-5.2, patch clean-up
- Updated the old libtool rpath patch.
- rebuilt for new python again...
- Hacked an ugly perl hack to get rid of perl RPATH problems.
- Fixed 64bit patch and applied it. ;-)
- bumped release and rebuilt.
- Added patch to increase SMUXMAXSTRLEN.
- fix double free or corruption error when freeing security context (#1809077)
- remove deprecated CFLAG
- net-snmp.redhat.conf: update default configuration to conform to the best practices (#1359123)
- nmp_transport.c: use strtok_r for strtok to avoid a race condition (#1366282)
- rc2 prebuilt
- add all relevant rpm scalars to host resources mib.
- Updated to latest version (4.2.4.pre2)
- allow compiling without tcp_wrappers
- fix occasional segfaults when snmpd starts
- proxied OIDs unspecified in proxy statement in snmpd.conf (#1658134)
- UCD-SNMP-MIB::dskTable doesn't update dynamically (#1658185)
- expand SNMPCONFPATH variable (#1660146)
- remove file with Apple license (#1690936)
- log meningful message on duplicate IP address (#1692286)
- memory reporting adjustment (#1695497 and #1766521)
- fix typos in man page (#1700262)
- speedup ipAddressTable loading(#1700391)
- fix memory leak when shut down librpm (#1763008)
- services starts after network-online.target (#1775304)
- add missing part of memory leak patch (#1829860)
- add support for AES192 and AES256 (#1846252)
- document various legacy options in this spec file
- CAN-2005-1740 net-snmp insecure temporary file usage (#158770)
- patch from suse.de
- allow disman/event-mib
- rebuilt
- move initscript and add condrestart magic
- add missing IETF MIB license text (BSD)
- Added Kaj J. Niemi that fixes ipAdEntIfIndex problem (#119106)
- Added Kaj J. Niemi to shut up memshared message for 2.6 kernel (#119203)
- Quite a bit of specfile cleanup from Marius FERARU.
- fix invalid access to memory in tcpListenerTable (#551030)
- Removed the check for dbFOO as we don't want to add another requirement.
- Fixed smux compilation problems (#41452)
- Fixed wrong paths displayed in manpages (#43053)
- fix compilation of the python module
- enabled MySQL support in snmptrapd
- re-introduced /etc/sysconfig files (#752821)
- fix use after free issue (RHEL-64696)
- add tcp-mib (#194856)
- add patch so that only four bytes are returned for IP addresses on ia64 (#32244)
- fix init script, read .options files from /etc/snmp (#195702)
- fix read problem on stream sockets (net-snmp bz#1337534)
- CVE-2018-1000116 Heap corruption in snmp_pdu_parse (#1552844)
- fix double free or corruption error (#1726373)
- restored rpath in net-snmp-config output - SNMP subagent won't link
with libsnmpagent.so without it, linker needs to know location
of libperl.so
- fixed check section to make tests pass on machine without DNS
- upgrade to 5.2.2 final
- fixing ipNetToMediaNetAddress to show IP address (#432780)
- Added bzip2-devel to BuildPreReq (#76086, #70199).
- actually apply ipv6 patch
- upgrade to 3.6.1, fix configuration file stuff.
- Updated to 5.7.2
- Updated to latest upstream version 5.0.8 (bug #88580)
- default config was broken (from Wes Hardaker) (#9752)
- rebuild (missing alpha packages)
- Fixed a server segfault for snmpset operation (#53640). Thanks to Josh Giles
and Wes Hardaker for the patch.
- fix parsing of /proc/diskstats
- fix disman monitor crash
- fix perl vendor name
- fix OID lookup fail
- fix lib version
- Added the snmptrapd init script as per request (#49205)
- Fixed the again broken rpm query stuff (#57444)
- Removed all old and none-used db related stuff (libs and header checks/files)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- snmpd crash with 'interfaces' directives in snmpd.conf fixed #139010
- rather dirty patch fixing conf directory for net-snmp-config
- net-snmp properly deals with large partitions (#153101)
- fix daemon crash on resend request (#1694047)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Added missing BuildPrereq to openssl-devel (#61525)
- updated to net-snmp-5.6
- enable smux to listen only on LOCAL by default (#181667)
- use correct answer adrress
- another multilib fix. Fix also net-snmp-config script
- fix rpm ownership of all created directories (#473582)
- Removed tkmib from the package once again as we don't ship the Tk.pm CPAN
perl module required to run it (#49363)
- Added missing Provides for the .so.0 libraries as rpm doesn't seem to find
those during the build anymore (it used to) (#46388)
- Updated to latest released version.
- Added some missing files to the %files section.
- fix segfault with error on subcontainer (#2051370)
- add support of lm_sensors v3
- added procps to build dependencies (#380321)
- removed beecrypt from dependencies
- fixed crash on reading xen interfaces (#386611)
- change %postun to %preun
- Reverted removal of _includir redefiniton due to php-snmp dependancy.
- Remove SO_BSDCOMPAT setsockopt() call, deprecated.
- Fixed permission problem for debuginfo (#101456)
- add version to buildroot
- rebuilt with new libraries
- stateless access to rpm database.
- Perl 5.16 rebuild
- release candidate 3 of net-snmp-5.2.2
- Fixed buffer overflow in ICMP-MIB (#1071753)
- rebuilt against tcp_wrappers-devel
- Fixed build problems on ppc64
- Fixed double packaged manpages (#102075).
- re-create /var/run/net-snmp on boot using tmpfiles.d (#656637)
- move snmp-bridge-mib and net-snmp-cert utilities to net-snmp-perl
subpackage, net-snmp-utils subpackage does not depend on Perl now
- rebuilt
- rebuild for new perl
- Bump version to rebuild against new RPM in Rawhide.
- turn off SMUX support (#110931)
- add dist tag
- another release candidate
- Perl 5.18 rebuild
- fix various flaws (CVE-2008-2292 CVE-2008-0960)
- require perl(:MODULE_COMPAT_5.10.x) because the package links against
libperl.so
- automatic rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- fix dependency on lm_sensors-devel (#229109)
- spec file cleanups
- properly fix failing tests on ppc/s390 (#655731)
- moved agentxtrap utility to net-snmp subpackage,
it needs libraries provided by net-snmp-agent-libs.
- Don't ship tkmib, since we don't ship the perl modules needed to run it.
(Bug #4881)
- Added --enable-ucd-snmp-compatibility for compatibility with older version
and fixed installation thereof.
- Got rid of the perl(Tk) dependancy by removing snmpcheck.
- Include /usr/include/ucd-snmp in the filelist.
- Fixed a problem with the ucd-snmp/version.h file.
- Fixed the libdir problem.
- SMUX support is still needed .. will disappear later!
- static libs should be in devel not libs (#203571)
- fix lm_sensors issues
- prepare the .spec file for review
- run automatic regression suite after the compilation of the package
to check for obvious regressions
- remove unnecessary package dependencies
- fix dereferencing null pointer (#2021403)
- auto rebuild in the new build environment (release 3)
- Extended the libwrap and bsdcompat patches
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- added btrfs support to hrFSTable (#965348)
- rebuilt for new gcj
- Moved net-snmp-config into devel package (#103927)
- fix syntax error that crept in with condrestart
- fix default snmptrapd.conf
- Due to rpm-devel we need elfutils-devel, too (#103982).
- Removed snmpcheck again, needs perl(Tk) which we don't ship (#111194).
- Fixed getopt definition in include file (#111209).
- Included Kaj J. Niemi's patch for broken perl module (#111319).
- Included Kaj J. Niemi's patch for broken async getnext perl call (#111479).
- Included Kaj J. Niemi's patch for broken hr_storage (#111502).
- Moved tmpfiles.d config file to /usr/lib
- fixed truncation of sysObjectID (#640848)
- Fixed snmpd description (#52366)
- rebuilt
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- fix issue with flood messages (#1719350)
- Included BuildPrereq on lm_sensors-devel on x86 archs (#110616).
- Fixed deprecated initscript options (#110618).
- Updated net-snmp to build against Perl 5.24
- session free fixed, agentx modules build fine (#157851)
- fixed dependency for net-snmp libs (#156932)
- Fixed snmpstatus crashing when receiving invalid response (#1233738)
- Added direct dependency on perl-devel with architectute in
net-snmp-devel package to pull proper dependencies.
- added aarch64 to multilib architectures.
- Updated to 4.2.1. Removed 2 obsolete patches (fromcvs and #18153)
- Include /usr/share/snmp/snmpconf in %files
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Add support for new version of OpenSSL library (#1423984)
- new release, fixing several issues
- pointer needs to be inicialized (#146417)
- Enabled IPv6 support (RFE #47764)
- Hopefully final fix of snmpwalk problem (#42153). Thanks to Douglas Warzecha
for the patch and Matt Domsch for reporting the problem.
- disable failing test on s390(x) (#680697)
- Rebuild for fixed rpm (#473420)
- move initscript back
- Fixed problem with perl option (#102420).
- Added patch for libwrap fix (#77926).
- move ldconfig post/postun to libs subrpm
- remove tcp_wrapper (#1518768)
- use mariadb-connector instead of mysql-devel (#1339272)
- configure with --enable-reentrant and added "smux" and "agentx" to
--with-mib-modules= argument (#29626)
- Edit fix of issue with undefined symbol my_progname when try to load
NetSNMP::TrapReceiver in perl script (#1470004)
- switching to a different 64bit patch, hopefully 64bit problems are gone for a while
- Included 64bit fix from Mark Langsdorf (#114645).
- Included the Axioma Security Research fix for snmpnetstat from bugtraq.
- Perl mass rebuild
- fixed temporary filename generation in snmptrapd (#616347)
- prepare for new rpm version
- return a usable RETVAL when running "service snmpd status" (#33571)
- backport MemAvailable report from upstream (RHEL-21780)
- updated to 5.7.1:
- Fixed the mib-parsing-bug introduced shortly before 5.7
- fixed rounding errors for disk percentage calculations
- Many other miscellaneous minor bug fixes
- add openssl-devel to the list of netsnmp-devel deps
- Switch to latest stable version, 5.0
- Renamed the packate to net-snmp and obsoleted ucd-snmp.
- Switch to %ldconfig_scriptlets
- fix snmptrapd hostname logging (#238587)
- fix udpEndpointProcess remote IP address (#236551)
- fix -M option of net-snmp-utils (#244784)
- default snmptrapd.conf added (#243536)
- fix crash when multiple exec statements have the same name
(#243536)
- fix ugly error message when more interfaces share
one IP address (#209861)
- fix endian issues for addresses
- License: field fixed to "BSD and CMU"
- compressed man pages.
- add Requires for versioned perl (libperl.so)
- get rid of silly file Requires
- Fixed problem with reload in initscript (#63526).
- Rebuild for Python 2.6
- fixed missing requires for devel package (#155221)
- Rebuild
- fix wrong systemd patch (#1545946)
- Fixed small bug in snmptrapd initscript (#126000).
- update to release candidate 4
- fix lib dependencies on 64bit archs
- supress perl build
- Recompile with -Wformat (#1242766)
- rebuild for autoconf
- Perl 5.24 rebuild
- explicitly require the right version and release of net-snmp and
net-snmp-libs
- update to net-snmp-5.4.2.1 to fix CVE-2008-4309
- rebuild for new rpm
- Fixed build problems for net-snmp-perl.
- Updated to net-snmp-5.0.7. Fixed especially the performance problem with
limited trees.
- Final bcm5820 fix. Last one was broken.
- Fixed bugzilla bug (#51960) where the binaries contained rpath references.
- Patch fixing uninitalized stack variable in smux_trap_process (#130179)
- Perl 5.20 rebuild
- compile against Python3
- add gcc requirement
- remove rm buildroot
- fix tmpfiles path (#1710784)
- Fix issue with undefined symbol my_progname when try to load NetSNMP::TrapReceiver in perl script. (#1470004)
- fix address assigning for IPv6 clientaddr option (#1672668)
- fix crash on s390x and ppc64
- Injected new description and group.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- fix lm_sensors-devel Requires (#229109)
- remove file due licensing issues (#1690936)
- fix build on s390x which has no libsensors
- rebuilt
- rebuilt
- 64bit needed some changes, was causing timeouts on 64bit archs!?
- affects bugs #125432 and #132058
- fix for s390x counter32 overflow (sachinp@in.ibm.com)
- Perl 5.26 rebuild
- Rebuilt after RPM update (№ 3)
- swith to new disman implementation
- remove README* that do not apply to Linux
- trim massive ChangeLog
- Update to 5.1.2
- Removed net-snmp-5.0.1-initializer patch, included upstream
- update to Net-SNMP 5.5
- remove static libraries from -devel subpackage
- update to 4.1.1
- Updated to 5.0.1
- Dropped --enable-reentrant as it's currently broken
- i18nize initscript
- Split out libs package for multilib compatibility
- Remove .la file from net-snmp-libs (#172618)
- grab new openssl
- Perl mass rebuild
- backport two memory leaks from upstream (#2134635)
- revert permission of config files to 600 (#1601060)
- fix error message when the address specified by clientaddr option
is wrong or cannot be bound (#1877375)
- log error with /proc/net/if_inet6 only when IPv6 is enabled (#1824367)
- fix issue with quoting empty passphrase (#1817225)
- perl dependency renamed to perl-interpreter
- add missing include files from util_funcs directory (#603243)
- Python 2 binary package renamed to python2-net-snmp
See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
- fixed patch related to bug #35016 (Dell)
- remove backup file to fix perl dependencies
- add missing struct.h header file (#603243)
- update to 4.2.4 final
- fix rtnetlink.h/if_addr.h
- update to another prerelease (fixes perl agents)
- Fixed net-snmp dependency on net-snmp-agent-libs.
- init scripts made LSB compliant
- Fixed problem with RUNTESTS script.
- fix tcp_wrappers integration (CVE-2008-6123)
- rebuilt for unwind info generation, broken in gcc-4.1.1-21
- Disable sysvinit subpackage on F23+
- rebuilt
- Perl 5.20 rebuild
- fix net-snmp-config strange values for --libs (#228588)
- Updated to latest net-snmp-5.1 upstream version.
- Tons of specfile and patch cleanup.
- Cleaned up perl stuff (mib2c etc, see #107707).
- Added lm_sensors support patch for x86 archs from Kaj J. Niemi (#107618).
- Added support for custom mib paths and mibs to snmptrapd initscript (#102762)
- Rebuild against newer rpm
- fix trapsink port issue (#1677192)
- Fixed ro/rw problem with v2 and v3 request (#89612)
- add fix for -DUCD_COMPATIBLE (#77405)
- Rebuilt for new rpm
- Update to 5.7.3
- rebuilt
- rebuild against perl 5.10.1
- fix default configuration file (#1589480 and #1594147)
- modify permissions for config files (#1601060)
- fix ipaddr return type on 64bit machines
- temporarily disable a test failing on ppc/s390 arches
- report gigabit Ethernet speeds using Ethtool (#152480)
- set permissions of snmpd.conf and snmptrapd conf to 0600 to prevent
users from reading passwords and community strings.
- update to 5.3.1 final version, fix version number
- upgrade to 5.3
- fix for lm_Senors, the max is no longer a fixed value
- parsing fixed for /proc/net/if_inet6
- store temporary files in /var/run/net-snmp instead of /tmp -
SELinux does not like it.
- explicitly require lm_sensor > 3 for build (#442718)
- create multilib net-snmp-config on multilib architectures only
- rebuilt
- Added support for ppc64le architecture (#1052431)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Rebuilt for RPM soname bump
- Move /var/lib/net-snmp from net-snmp to net-snmp-libs (#822508)
- remove Group tag
- remove sysvinit package and init files (no longer needed)
- fix python2 references and dependencies in spec file
- fixed unexpected length for type ASN_UNSIGNED (#151892)
- fixed uptime problems on ia64
- rebuilt to fix broken deps
- remove files from the buildroot that we don't want to ship
- fixed c++ guards in net-snmp header files (#650219)
- add math library in LDFLAGS (#1846252)
- Updated nolibelf patch and activated it again.
- Rebuild against newer mysql
- Rebuild (again) against newer rpm, now with proper rpm-4.9 detection
- supported lm_sensors on ppc64 (#249255)
- snmpconf generates config files with proper selinux context
(#247462)
- fix leak in udp transport (#247771)
- add alpha to supported archs in net-snmp-config (#246825)
- fix hrSWInst (#250237)
- rebuild for new librpm
- Fixed 64bit build problems when 32bit popt lib is installed.
- update to 3.5.3.
- don't include snmpcheck until perl-SNMP is packaged.
- Perl 5.22 rebuild
- moved agentxtrap utility to net-snmp-utils subpackage,
it's an utility, not a daemon.
- Remove rpath from net-snmp-config output (#554747)
- Security fix. Bug granting write access to read-only users
or communities which were configured using the "rocommunity"
or "rouser" snmpd.conf tokens fixed
- upgrade to 5.4
- patch cleanup
- snmpd uses /var/run/snmpd.pid (#211264)
- disable failing test on sparc64
- restore host resources mib
- simplified config file
- rebuild for 6.0.
- Fix build with MariaDB 10.2
- update to 3.6.2 (#3219,#3259).
- add missing man pages (#3057).
- License: field changed to MIT
- 5.4.1 integrated
- patch adding ipv6 support to ip system stats
- fix deprecated syscall base_reachable_time (#207273)
- fix sparc handling in /usr/bin/net-snmp-config
- Rebuilt for switch to libxcrypt
- update to 4.1.2.
- FHS packaging.
- patch for rpm 4.0.
- fix missing IF-MIB::ifNumber.0 (#189007)
- Update to latest upstream version 5.1.1
- Included updated patches from Kaj J. Niemi (#118580).
- do not link against -lelf
- fix issue with parsing of long traps (#1912242)
- modify fix for #1877375
- include these tables: ip-mib/ipv4InterfaceTable
ip-mib/ipv6InterfaceTable, ip-mib/ipAddressPrefixTable
- fix Requires of net-snmp-devel to include lmsensors-devel on supported
architectures
- fix crash when configured as proxy - issue 82 (RHEL-14454)
- log once truncating issue (RHEL-13597)
- fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808,
CVE-2022-24809 and CVE-2022-24810 (RHEL-26650)
- fixed net-snmp-create-v3-user to have the same content on all architectures
- /var/lib/net-snmp/mib_indexes and cert_indexes added to net-snmp-libs
(#906761)
- rebuilt for new gcc4.1 snapshot and glibc changes
- fixed initscript, for reload and restart it was start then stop,
fixed. (#28477)
- rebuilt with new openssl
- Reworked the perl filelist stuff (Thanks to marius feraru).
- agentx double free error fix
- integrated with systemd (#718183)
- update to 4.0.1.
- fix udpTable indexes on big-endian systems (#543352)
- fix snmptrapd init script to survive with empty /etc/sysconfig/snmptrapd
- lower the default log level of snmpd to get rid of the debug messages
- strip binaries
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- rebuild
- Updated to latest upstream version net-snmp-5.0.9
- Added patch to fix net-snmp-perl problems (#105842).
- BR: perl(ExtUtils::Embed)
- Rebuilt for RPM soname bump
- rebuild in new environment
- Add Provides for the old name without %_isa
- Agentx failed to send trap, fixed (#130752, #122338)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- introduce /etc/sysconfig/snmpd. Use it to specify snmpd command line options.
/etc/snmp/snmpd.options is not used anymore (#431391)
- added autoreconf to be able to build on aarch64 (#926223)
- fix crash with interfaces without broadcast addresses (like OpenVPN's tun0)
(#544849)
- better patch for depreciated sysctl call
- fix IPv4/IPv6 address presentation (#200255)
- all but config (especially SNMPv2p) ready for prime time
-sparc multilib handling
- implement suggestions from Wes Hardaker.
- Fixed a couple of security issues:
o /tmp race and setgroups() privilege problem
o Various buffer overflow and format string issues.
o One signedness problem in ASN handling.
- Fixed an important RFE to support bcm5820 cards. (#51125)
- rebuilt
- clean up deinstallation (#34168)
- gawk added to build dependencies
- Fixed file list for latest build.
- net-snmp-cert gencert create SHA512 (#1908331)
- Mass rebuild with perl-5.12.0
- updated to net-snmp-5.6.1
- fix engine order of evaluation (RHEL-116089)
- move mib2c-update from net-snmp-utils to net-snmp-perl, where
mib2c is located
- add tkmib to net-snmp-gui package (#167933)
- update to 3.5.
- update for 4.2
- Temporarily disable T200snmpv2cwalkall_simple test on ppc(64) until
bug 814829 is fixed
- remove python package and update to the last upstream version (#1584510)
- enabled pie (snmpd, snmptrapd) - postponed for ia64
- added --with-pic to configure call
- fix CVE-2020-15862 (#1875497)
- fix bulk responses for invalid PID (#1817190)
- Rebuild for new rpm
- Python: fixed IPADDRESS size on 64-bit systems (#895357)
- add net-snmp-python
- add explicit format for syslog call (#18153).
- Change gcc Requires to BuildRequires (#1625189)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- tkmib doco had #!/usr/bin/perl55
- include snmpcheck and tkmib again (still needs some CPAN module, however).
- don't start snmpd unless requested
- start snmpd after pcmcia.
- fix memleaks in ip-addr and tcpConn
- redistribute the perl scripts to the net-snmp package,
net-snmp-utils doesn't depend on perl now (#462484)
- Perl mass rebuild
- Included generation of perl stuff. Thanks to Harald Hoyer.
- Fixed problem with new proc output (#98619, #89960).
- add mibII/mta_sendmail (#207909)
- created the package... possibly replace cmu-snmp with this.
- fix discovered issues from coverity scan (#1602630)
- Hardcoded the ETC_MNTTAB to point to "/etc/mtab".
- rebuild for new perl
- prevent parsing IP address twice (#1768908)
- add support for digests detected from ECC certs (#1919714)
- fix broken ErrorMsg at ucd-snmp (#1933150)
- add support for intermediate certs (#1914656)
- fix crash of certs with longer extension (#1908718)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Fixed systemd support (#875632).
- don't depend on /etc/init.d so that package will work with 6.2.
- perl path fiddles no longer needed.
- rely on brp-compress frpm rpm to compress man pages.
- patch from ucd-snmp CVS (Wes Hardaker).
- configure.in needs to check for rpm libraries correctly (#23033).
- add simple logrotate script (#21399).
- add options to create pidfile and log with syslog with addresses (#23476).
- fix Source0 location.
- fix the snmpd.conf file to use real community names.
- fix ethtool extension (#222268)
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- rebuilt
- patch from CVS - kill extra carriage return (#144917)
- removed patch for interface indexing - doesn't show virtual interfaces
- add Requires for tcp_wrappers-devel for -devel
- update to 5.3.1.pre2
- fix multilib issues (#192736)
On system with /usr/lib64 use net-snmp-config64 and net-snmp-config64.h
- Trim net-snmp-config --cflags output (#1309080)
- bump again for double-long bug on ppc(64)
- update to net-snmp-5.4.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- update to rc6, snmpnetstat changes due to license problems
- persistent files in directory defined by snmp.conf persistentDir are
loaded at startup
- fix %attr on man pages
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Updated RPM scriplets with latest systemd-rpm macros (#850403).
- Fixed fedora-review tool complaints.
- check for header files in configure
- patch for SNMPv3 traps / session user creation (net-snmp bz#1374087)
- move the perl(:MODULE_COMPAT_5.10.x) require to net-snmp-libs
- Perl 5.14 mass rebuild
- initscript munging
- fix memory leak due of proc file creating (#2105957)
- fix CVE-2022-44792 and CVE-2022-44793 (#2141901) and (#2141905)
- fix memory leak when ipv6 disable set to 1 (#2151537)
- fix proxy timeout issue (#2160723)
- make the default configuration less noisy, i.e. do not print "Connection from
UDP:" and "Received SNMP packet(s) from UDP:" messages on each connection.
(#509055)
- package cleanup, remove unnecessary patches
- move local state file from /var/net-snmp/ to /var/lib/net-snmp
- added ucd-snmp-4.2-null.patch to correcly handle a NULL value (#35016)
- rebuild with openssl-0.9.7e
- package for Red Hat 7.1.
- Another bump required. Some more specfile changes.
- lm_sensors-devel only where avaliable
- add a *new* patch for IP address return sizes
- fix annocheck distro flag failures (#1624151)
- Prevent post script failure on fresh installs
- Update to 4.2.3 final.
- Fixed libtool/rpath buildroot pollution problem.
- Fixed library naming problem.
- fixed perl linking (#742678)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- update engineTime when sending traps (#1973252)
- Added sample config to make net-snmp RFC 1213 compliant.
- fix divison-by-zero in cpu statistics (#501210)
- Droped obsolete lm-sensors patch and enabled lmSensors module
- Marked several patches to be removed for 5.1.3
- Fixed snmpd crashing when AgentX subagent disconnects in the middle of
request processing (#1038011)
- exit snmpd after snmpd -h command (#1634811)
- better upstream patch for byteorder
- add epoch to corespond with upstream versioning
- default config permits RO access to system group only (Wed Hardaker).
- Fixed invalid SMUX packet (#83487).
- Fix strstr() crash when looking for RPM Group tag
- Fix wrong usage of structure iterator
- Fix issue with statistics from autofs
- fix sendmsg error code for new kernel (#2185787)
- rebuild per Trond's request.
- Logrotate support added (#125004)
- another attempt to fix multilib issue. Generate dummy net-snmp-config.h file
- rebuild for openssl soname bump
- added new net-snmp-agent-libs subpackage with agent libraries
-> net-snmp-libs do not need perl and lm_sensors libs
- removed libsnmp.so, it's not used in Fedora (#729811)
- added README.systemd
- added new net-snmp-sysvinit subpackage with legacy init scripts
(#718183)
- enable libwrap (#253)
- enable host module (rpm queries over SNMP!).
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Fixed ucd-snmp.redhat.conf (#78391).
- Fixed snmpwalk examples in config file.
- rebuild with new openssl
- fix perl SNMP::Session::set (#452131)
- Hack to make it build on 64bit platforms with /usr/lib64 correctly.
- Fixed bug #85071 (leak of open descriptors for ipv6).
- Add APSL 2.0 license to COPYING file
- Fixed CVE-2014-3565
- Fixed net-snmp-cert tool, now it does not depend on net-snmp-devel (#1134475)
- further tune up the distribution of files among subpackages
and dependencies
- CAN-2005-2177 new upstream version fixing DoS (#162908)
- fix overly verbose log message (#221911)
- few minor tweaks for review - still not perfect
- fix linking with lcrypto (#231805)
- Bumped release and rebuilt.
- Removed all dbFOO cruft again.
- fix lib dirs in configure (#197684)
oddjob-0.34.7-3.el8.x86_64.rpm | - Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- use newer systemd macros (#857375)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- tweak initialization so that we set up for providing our D-Bus APIs before we
register our names with the bus, so that we can handle any requests that
arrive before the acknowledgement of that registration, which should make
system activation a viable option
- use %systemd_postun_with_restart instead of plain old %systemd_postun,
because we can be restarted in the %postun
- add man(5) pages for the configuration files that we include which get
included by others, just to be tidy (#884552)
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- try to SIGHUP the messagebus daemon at first install so that it'll
let us claim our service name if it isn't restarted before we are
first started (same as #636876)
- prefer BuildRequires: to BuildPrereq (#176452)
- require /sbin/service at uninstall-time, because we use it (#176452)
- be more specific about when we require /sbin/chkconfig (#176452)
- stop overriding the system-wide UMASK default in our default
oddjobd-mkhomedir.conf file (#995097)
- make the init script exit with status 2 when given an unknown command, rather
than with status 1 (#674534)
- Rebuild against RHEL 8.4.0
Resolves: rhbz#1886433
- fix some path mismatches in the sample configuration files
- don't try to set a reconnect timeout until after we've connected
- build fixes
- rebuild with new libxml2
- configure with --disable-dependency-tracking (Ville Skyttä, #228928)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- split off python subpackage, make -devel depend on -libs, let autodeps
provide the main package's dependency on -libs (#228377)
- update to 0.26-1:
- don't get confused when ACL entries for introspection show up in the
configuration before we add the handlers for them
- export $ODDJOB_CALLING_USER to helpers
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- add missing requires(post) on killall, which we use to poke the message
bus daemon to get it to reload its configuration, spotted by rcritten
- drop the shared library and python bindings, which so far as i can tell
weren't being used, obsoleting them to avoid a mess on upgrades
- move the mkhomedir helper from %{_libdir}/%{name} to
%{_libexecdir}/%{name} to make the multilib configuration files agree
(#559232)
- use %global instead of %define
- Support HOME_MODE from /etc/login.defs
Resolves: rhbz#1886433
- add some missing build-time requirements
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- unmark the init script as a %config file (part of #197182)
- documentation tweaks for man pages
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- rebuild
- fix the location for the sample D-BUS configuration doc file
- own more created directories
- rebuild
- add recommended dependency on pkgconfig in the -devel subpackage
- Always set the home directory permissions according to HOME_MODE
- Resolves: rhbz#2135793
- rebuild
- show that we implement force-reload and try-restart in the init script's
help message (#522131)
- require dbus-x11 so that the tests can use dbus-launch
- try to read the default umask from /etc/login.defs (more of #666418)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- explicitly require "dbus" at the package level (#1085450)
- Rebuild for Python 2.6
- update to 0.20
- break shared libraries and modules for PAM and python into a subpackage
for better behavior on multilib boxes
- if we're not building a sample subpackage, include the sample files in
the right locations as %doc files
- catch calls to the method invocation helper function that mistakenly
didn't include the newly-required timeout value (#1089655,#1089656)
- update to 0.25:
- add introspection for parents of objects specified in the configuration
- oddjobd can reload its configuration now
- add -u (umask) and -s (skeldir) flags to the mkhomedir helper (#246681)
- also tell the system message bus to reload its configuration when we install
a subpackage with a new service in it
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- fix a crasher in pam_oddjob_mkhomedir.so: remove an initialization step that
should have been removed when the module was modified to accept larger
replies (#1236970)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Upstream release 0.34.5
- Resolves: rhbz#1833289 - Rebase oddjob to 0.34.5
- Resolves: rhbz#1833052 - CVE-2020-10737
oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack
- rebuild
- Upstream release 0.34.7
- Force LC_ALL=C.UTF-8 in oddjobd systemd service environment
- Resolves: rhbz#1907481 - oddjob locale issue
- Resolves: rhbz#1907541 - rebase oddjob to 0.34.7
- open a connection to the bus for every service we're serving, instead of
using just one for the lot of them, so that we can tell which service a
client was attempting to contact if it sends a message to our unique
connection address instead of a well-known name, like dbus-python does
- tweak the logic for guessing which interface name is right when a request
doesn't include one, so that it has a better chance of finding the right one
- increase the initial size of the buffer that we pass to getpwnam_r in the
pam_oddjob_mkhomedir module (#1198812)
- rebuild
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- split off mkhomedir bits into a subpackage (#236820)
- take a pass at new-init-ifying the init script (#247005)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- rebuild
- update to 0.27-1:
- don't attempt to subscribe to all possible messages -- the message bus
will already route to us messages addressed to us, and if we try for
more than that we may run afoul of SELinux policy, generating spewage
- add a build dependency on pkgconfig, for the sake of FC3
- update docs and comments because D-BUS is now called D-Bus
- Autorebuild for GCC 4.3
- rebuild
- fix compilation against older versions of D-BUS if the
GetConnectionSELinuxSecurityContext method turns out to be available
- rebuild
- Add gating tests using idm:DL1 module stream and upstream tests
Resolves: rhbz#1682457
- update to 0.24, fixing some build errors against D-BUS 0.30-0.33
- require xmlto, because the generated HTML differs depending on whether
or not we know how to enforce ACLs which include SELinux context info
- build with DocBook 4.3
- rebuild
- add a -t flag to oddjob_request to allow its timeout to be
customized (#1085491)
- make that last change dependent on which release we're building for
- when we install the mkhomedir subpackage, if there's a running oddjobd, ask
it to reload its configuration
- fix missing bits from the namespace changes in configuration files
- restart the service in %postun
- don't try to "close" our shared connection to the bus when the bus
hangs up on us -- at some point libdbus started abort()ing when we try
that (#634356)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
- Add a non-default option to revert behavior for CVE-2020-10737 fix
- Resolved: rhbz#2050079
- add that dependency to the right subpackage
- when "prepend_user_name" is used, the user name is now added to the helper's
command line after arguments that were specified in the helper "exec"
attribute
- resync with Fedora packaging
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- rebuild
- refer to $local_fs instead of $localfs in the init script (#802719)
- install a systemd unit file instead of an init script on still-in-development
releases (#820137,818963)
- build binaries position-independent and marked for earliest-possible symbol
resolution (#852800)
- don't worry about moving things from /usr to / when they're the same (#852800)
- rebuild
- Rebuilt for gcc bug 634757
- rebuild
- Drop Python 2 build-time dependency, which hasn't been used since we turned
off building the python bindings years ago (#1595853, #1642502).
- add an [Install] section containing WantedBy=sysinit.target to the systemd
unit file (#963722), allowing it to actually be "enabled"
- move helpers to libexecdir, keeping pkglibdir around in the package (#237207)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- when the mkhomedir helper has to create intermediate directories, don't
apply a umask that might have been supplied on its command line (#666418)
- Update dbus-send dependency for new dbus (#1170584)
- rebuild
oddjob-mkhomedir-0.34.7-3.el8.x86_64.rpm | - Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- use newer systemd macros (#857375)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- tweak initialization so that we set up for providing our D-Bus APIs before we
register our names with the bus, so that we can handle any requests that
arrive before the acknowledgement of that registration, which should make
system activation a viable option
- use %systemd_postun_with_restart instead of plain old %systemd_postun,
because we can be restarted in the %postun
- add man(5) pages for the configuration files that we include which get
included by others, just to be tidy (#884552)
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- try to SIGHUP the messagebus daemon at first install so that it'll
let us claim our service name if it isn't restarted before we are
first started (same as #636876)
- prefer BuildRequires: to BuildPrereq (#176452)
- require /sbin/service at uninstall-time, because we use it (#176452)
- be more specific about when we require /sbin/chkconfig (#176452)
- stop overriding the system-wide UMASK default in our default
oddjobd-mkhomedir.conf file (#995097)
- make the init script exit with status 2 when given an unknown command, rather
than with status 1 (#674534)
- Rebuild against RHEL 8.4.0
Resolves: rhbz#1886433
- fix some path mismatches in the sample configuration files
- don't try to set a reconnect timeout until after we've connected
- build fixes
- rebuild with new libxml2
- configure with --disable-dependency-tracking (Ville Skyttä, #228928)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- split off python subpackage, make -devel depend on -libs, let autodeps
provide the main package's dependency on -libs (#228377)
- update to 0.26-1:
- don't get confused when ACL entries for introspection show up in the
configuration before we add the handlers for them
- export $ODDJOB_CALLING_USER to helpers
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- add missing requires(post) on killall, which we use to poke the message
bus daemon to get it to reload its configuration, spotted by rcritten
- drop the shared library and python bindings, which so far as i can tell
weren't being used, obsoleting them to avoid a mess on upgrades
- move the mkhomedir helper from %{_libdir}/%{name} to
%{_libexecdir}/%{name} to make the multilib configuration files agree
(#559232)
- use %global instead of %define
- Support HOME_MODE from /etc/login.defs
Resolves: rhbz#1886433
- add some missing build-time requirements
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- unmark the init script as a %config file (part of #197182)
- documentation tweaks for man pages
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- rebuild
- fix the location for the sample D-BUS configuration doc file
- own more created directories
- rebuild
- add recommended dependency on pkgconfig in the -devel subpackage
- Always set the home directory permissions according to HOME_MODE
- Resolves: rhbz#2135793
- rebuild
- show that we implement force-reload and try-restart in the init script's
help message (#522131)
- require dbus-x11 so that the tests can use dbus-launch
- try to read the default umask from /etc/login.defs (more of #666418)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- explicitly require "dbus" at the package level (#1085450)
- Rebuild for Python 2.6
- update to 0.20
- break shared libraries and modules for PAM and python into a subpackage
for better behavior on multilib boxes
- if we're not building a sample subpackage, include the sample files in
the right locations as %doc files
- catch calls to the method invocation helper function that mistakenly
didn't include the newly-required timeout value (#1089655,#1089656)
- update to 0.25:
- add introspection for parents of objects specified in the configuration
- oddjobd can reload its configuration now
- add -u (umask) and -s (skeldir) flags to the mkhomedir helper (#246681)
- also tell the system message bus to reload its configuration when we install
a subpackage with a new service in it
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- fix a crasher in pam_oddjob_mkhomedir.so: remove an initialization step that
should have been removed when the module was modified to accept larger
replies (#1236970)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Upstream release 0.34.5
- Resolves: rhbz#1833289 - Rebase oddjob to 0.34.5
- Resolves: rhbz#1833052 - CVE-2020-10737
oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack
- rebuild
- Upstream release 0.34.7
- Force LC_ALL=C.UTF-8 in oddjobd systemd service environment
- Resolves: rhbz#1907481 - oddjob locale issue
- Resolves: rhbz#1907541 - rebase oddjob to 0.34.7
- open a connection to the bus for every service we're serving, instead of
using just one for the lot of them, so that we can tell which service a
client was attempting to contact if it sends a message to our unique
connection address instead of a well-known name, like dbus-python does
- tweak the logic for guessing which interface name is right when a request
doesn't include one, so that it has a better chance of finding the right one
- increase the initial size of the buffer that we pass to getpwnam_r in the
pam_oddjob_mkhomedir module (#1198812)
- rebuild
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- split off mkhomedir bits into a subpackage (#236820)
- take a pass at new-init-ifying the init script (#247005)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- rebuild
- update to 0.27-1:
- don't attempt to subscribe to all possible messages -- the message bus
will already route to us messages addressed to us, and if we try for
more than that we may run afoul of SELinux policy, generating spewage
- add a build dependency on pkgconfig, for the sake of FC3
- update docs and comments because D-BUS is now called D-Bus
- Autorebuild for GCC 4.3
- rebuild
- fix compilation against older versions of D-BUS if the
GetConnectionSELinuxSecurityContext method turns out to be available
- rebuild
- Add gating tests using idm:DL1 module stream and upstream tests
Resolves: rhbz#1682457
- update to 0.24, fixing some build errors against D-BUS 0.30-0.33
- require xmlto, because the generated HTML differs depending on whether
or not we know how to enforce ACLs which include SELinux context info
- build with DocBook 4.3
- rebuild
- add a -t flag to oddjob_request to allow its timeout to be
customized (#1085491)
- make that last change dependent on which release we're building for
- when we install the mkhomedir subpackage, if there's a running oddjobd, ask
it to reload its configuration
- fix missing bits from the namespace changes in configuration files
- restart the service in %postun
- don't try to "close" our shared connection to the bus when the bus
hangs up on us -- at some point libdbus started abort()ing when we try
that (#634356)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
- Add a non-default option to revert behavior for CVE-2020-10737 fix
- Resolved: rhbz#2050079
- add that dependency to the right subpackage
- when "prepend_user_name" is used, the user name is now added to the helper's
command line after arguments that were specified in the helper "exec"
attribute
- resync with Fedora packaging
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- rebuild
- refer to $local_fs instead of $localfs in the init script (#802719)
- install a systemd unit file instead of an init script on still-in-development
releases (#820137,818963)
- build binaries position-independent and marked for earliest-possible symbol
resolution (#852800)
- don't worry about moving things from /usr to / when they're the same (#852800)
- rebuild
- Rebuilt for gcc bug 634757
- rebuild
- Drop Python 2 build-time dependency, which hasn't been used since we turned
off building the python bindings years ago (#1595853, #1642502).
- add an [Install] section containing WantedBy=sysinit.target to the systemd
unit file (#963722), allowing it to actually be "enabled"
- move helpers to libexecdir, keeping pkglibdir around in the package (#237207)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- when the mkhomedir helper has to create intermediate directories, don't
apply a umask that might have been supplied on its command line (#666418)
- Update dbus-send dependency for new dbus (#1170584)
- rebuild
openal-soft-1.18.2-7.el8.x86_64.rpm | - Initial release for Fedora
- New upstream release
- Fixed small spec verion info.
- Fixed version info
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Updatet to an newer git version because of some pulseaudio fixes.
- New upstream release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Updatet to an newer git version because of some pulseaudio fixes.
- I hope it fix bug 533501
- Only enable examples using SDL_sound on fedora (#1596651)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Remove fluidsynth and and portaudio dependencies
- Update to 1.9.563 + some fixes from git
- This fixes:
- Not having any sound in chromium-bsu
- Various openal using programs hanging on exit
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Build against FluidSynth.
- New upstream release
- Add BR: qt5-devel + SDL_sound-devel
- Add -examples subpackage
- Check for arm_neon.h only on 32bit ARM
- Add the -qt subpackage to host the alsoft-config tool
- Switch to %ldconfig_scriptlets
- the used fpu control bits are x86 specific
- 1.13-1
- version upgrade
- spec cleanup
- Added Obsoletes: openal <= 0.0.9 and remove Conflicts: openal-devel
- Fixed Bug 567870
- New upstream release
- Move bsincgen to -devel and altonegen to -examples
- New upstream release
- Fixed license and pkgconfig problem thx goes to Christoph Wickert
- 1.14-1
- version upgrade (rhbz#808968)
- spec cleanup
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Allow pulseaudio to move openal-soft output streams (rhbz#1544381)
- Fix release -4 not building (rhbz#1544012)
- Drop unnecessary qt-devel BuildRequires (we also BuildRequire qt5-devel)
- Update the SPEC and SRPM file because openal-soft-devel conflicts with
openal-devel
- Own the hrtf dir
- Rebuilt for GCC 5 C++11 ABI change
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Newer git version that fix more problems with pulseaudio.
- Newer git version with more Pulseaudio fixes. Have fun.
- Fix FTBFS on ARM (rhbz#1307818)
- New upstream release
- Fixed broken upgrade paths.
- Fixed bug 517721. Added upstream.patch
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- New Upstream Release
- New upstream release
- Fixed bug 517973
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Fixed Version Number
- remove support for no longer supported Fedora versions (<=25)
- fix: add %{_libdir}/cmake/OpenAL directory to devel
- fix: s/_datarootdir/_datadir/ as this package does not uses datarootdir
but datadir
- fix: add %{_datadir}/openal to main package as well and to %exclude
%{_datadir}/openal/{alsoftrc.sample,presets/presets.txt} as those files
are not needed
- removed Group fields
(https://fedoraproject.org/wiki/Packaging:Guidelines#Tags_and_Sections)
- add use more macros (%autosetup, %make_build, %make_install)
- add default config
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Fixed all warnings of rpmlint
- New upstream release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Fixed Obsoletes: and Provides: sections
openblas-0.3.15-6.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Add version to bundled lapack provide.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Update to 0.2.7.
- Use OpenBLAS versions of LAPACK functions, as they seem to be
working now.
- Use %__global_ldflags instead of %build_ldflags that doesn't work on
all distributions.
- Bump spec due to LAPACK rebuild.
- Enable armv7hl and ppc64le architectures.
- Build versions of the 64-bit libraries with an additional suffix
(BZ #1287541).
- Fix macro used in LAPACKE_zgesvdq
related: #1847435
- Update to 0.2.10.
- Honor Fedora linker flags (BZ #1548750).
- Update to 0.2.8.
- add generic s390x support (#1442048)
- Disable LAPACKE support on distributions where it is not available due to
a too old version of lapack.
- Rebuilt for GCC-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- update for aarch64
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebase to version 0.3.10
resolves: #1847435
- Actually use 8-bit integers in 64-bit interfaces (BZ #1382916).
- Update to 0.2.20.
- Rebase to version 0.3.3
resolves: #1627890
- Update to 0.2.17
- Need to use -frecursive to make LAPACK thread safe.
- Fix izamax on s390x
resolves: #1752241
- Enable ppc64 and ppc64p7 architectures
based on Dan Horák's patch (BZ #1356189).
- Supply proper make flags to the tests.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Set proper CFLAGS also for Rblas
related: #1624156
- Fix linkage of OpenMP libraries (BZ #1391491).
- Don't use reference LAPACK functions that have optimized implementation.
- Increase maximum amount of cores from 32 to 128.
- Add 64-bit interface support. (BZ #1088256)
- Update to 0.2.9. (BZ #1043083)
- Allow conditional build with or without system lapack, default to without
- Fix detection of generic ARMv8 CPUs
- Get rid of executable stack in libRblas.so
related: #1624156
- aarch64 has execstack in Fedora
- Minor spec cleanups
- Rebase to version 0.3.15
- Use gcc-toolset-11 to benefit from POWER 10 optimizations
resolves: #1983218
- Add tests and enable gating
related: #1752241
- Upgrade Patch4 to hopefully fully fix the issues on PPC64LE
- Run ldconfig on 64 builds too
- Drop arch-dependent buildrequires (BZ #1545201); no changes to package
(only affects packages custom built with --with system_lapack).
- Remove optimization pragmas on ppc64le
related: #1624156
- Fix build on s390x (#1615557)
- Simplify spec, dropping extra lib arguments.
- Force preprocessing of Fortran sources to make annobin record proper flags
- Enable optimizations for all LAPACK sources
resolves: #1624156
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update to 0.2.13.
- Fixed 32-bit build, and build on EPEL 5.
- Rebuild for GCC 8
- Fix out-of-bounds read in *larrv
- Resolves: CVE-2021-4048
- Update to 0.2.16.
- Update to 0.2.11.
- Disable CPU affinity unintentionally enabled upstream (BZ #1558091).
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Detect POWER9 as POWER8
related: #1752241
- Update to 0.2.5.
- Fix build on RHEL5 and ppc architecture.
- Due to long standing bug, replace all OpenBLAS LAPACK functions with
generic ones, so that package can finally be released in stable.
- Include deprecated LAPACK functions.
- Fix missing header files in openblas-devel subpackage by enabling
gcc-toolset-11 in %install as well
related: #1983218
- Update to 0.2.19.
- Move openblas-srpm-macros to separate package
- Added LAPACKE include files.
- Disable dynamic CPU detection on aarch64
- Use gcc-toolset-12
- Resolves: #2170398
- Enable dynamic cpu detection on all supported architectures
related: #1983218
- Add Patch4 to fix register clobbers (BZ #1417385)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Update to 0.2.12.
- Rebase to version 0.3.12
related: #1847435
- Use system version of LAPACK.
- Update to 0.2.14.
- Update to 0.2.18.
- Added documentation.
- First release.
- Fix library suffix on ppc64le.
- Use new execstack (#1247795)
- Review fixes.
- Fix i686-x86_64 multilib difference
related: #1627890
- Include openblas.pc
- Resolves: #2115722
- Update to 0.2.15.
- Clean up obsolete conditionals for 64 bit builds in spec file.
- Revert "minor spec cleanups" by Peter Robinson.
- Drop openblas-srpm-macros version requirement
- build a copy of openblas that thinks it is Rblas
There are no code changes, except for libname and soname, it is identical to libopenblas.so.0
Unfortunately, while R itself is fine using a symlink from libopenblas.so.0 to libRblas.so
the larger R ecosystem becomes unhappy in this scenario.
- Define %openblas_arches for dependent packages to use
- Ensure object files built from assembler sources are annotated
related: #1624156
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
openblas-threads-0.3.15-6.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Add version to bundled lapack provide.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Update to 0.2.7.
- Use OpenBLAS versions of LAPACK functions, as they seem to be
working now.
- Use %__global_ldflags instead of %build_ldflags that doesn't work on
all distributions.
- Bump spec due to LAPACK rebuild.
- Enable armv7hl and ppc64le architectures.
- Build versions of the 64-bit libraries with an additional suffix
(BZ #1287541).
- Fix macro used in LAPACKE_zgesvdq
related: #1847435
- Update to 0.2.10.
- Honor Fedora linker flags (BZ #1548750).
- Update to 0.2.8.
- add generic s390x support (#1442048)
- Disable LAPACKE support on distributions where it is not available due to
a too old version of lapack.
- Rebuilt for GCC-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- update for aarch64
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebase to version 0.3.10
resolves: #1847435
- Actually use 8-bit integers in 64-bit interfaces (BZ #1382916).
- Update to 0.2.20.
- Rebase to version 0.3.3
resolves: #1627890
- Update to 0.2.17
- Need to use -frecursive to make LAPACK thread safe.
- Fix izamax on s390x
resolves: #1752241
- Enable ppc64 and ppc64p7 architectures
based on Dan Horák's patch (BZ #1356189).
- Supply proper make flags to the tests.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Set proper CFLAGS also for Rblas
related: #1624156
- Fix linkage of OpenMP libraries (BZ #1391491).
- Don't use reference LAPACK functions that have optimized implementation.
- Increase maximum amount of cores from 32 to 128.
- Add 64-bit interface support. (BZ #1088256)
- Update to 0.2.9. (BZ #1043083)
- Allow conditional build with or without system lapack, default to without
- Fix detection of generic ARMv8 CPUs
- Get rid of executable stack in libRblas.so
related: #1624156
- aarch64 has execstack in Fedora
- Minor spec cleanups
- Rebase to version 0.3.15
- Use gcc-toolset-11 to benefit from POWER 10 optimizations
resolves: #1983218
- Add tests and enable gating
related: #1752241
- Upgrade Patch4 to hopefully fully fix the issues on PPC64LE
- Run ldconfig on 64 builds too
- Drop arch-dependent buildrequires (BZ #1545201); no changes to package
(only affects packages custom built with --with system_lapack).
- Remove optimization pragmas on ppc64le
related: #1624156
- Fix build on s390x (#1615557)
- Simplify spec, dropping extra lib arguments.
- Force preprocessing of Fortran sources to make annobin record proper flags
- Enable optimizations for all LAPACK sources
resolves: #1624156
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update to 0.2.13.
- Fixed 32-bit build, and build on EPEL 5.
- Rebuild for GCC 8
- Fix out-of-bounds read in *larrv
- Resolves: CVE-2021-4048
- Update to 0.2.16.
- Update to 0.2.11.
- Disable CPU affinity unintentionally enabled upstream (BZ #1558091).
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Detect POWER9 as POWER8
related: #1752241
- Update to 0.2.5.
- Fix build on RHEL5 and ppc architecture.
- Due to long standing bug, replace all OpenBLAS LAPACK functions with
generic ones, so that package can finally be released in stable.
- Include deprecated LAPACK functions.
- Fix missing header files in openblas-devel subpackage by enabling
gcc-toolset-11 in %install as well
related: #1983218
- Update to 0.2.19.
- Move openblas-srpm-macros to separate package
- Added LAPACKE include files.
- Disable dynamic CPU detection on aarch64
- Use gcc-toolset-12
- Resolves: #2170398
- Enable dynamic cpu detection on all supported architectures
related: #1983218
- Add Patch4 to fix register clobbers (BZ #1417385)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Update to 0.2.12.
- Rebase to version 0.3.12
related: #1847435
- Use system version of LAPACK.
- Update to 0.2.14.
- Update to 0.2.18.
- Added documentation.
- First release.
- Fix library suffix on ppc64le.
- Use new execstack (#1247795)
- Review fixes.
- Fix i686-x86_64 multilib difference
related: #1627890
- Include openblas.pc
- Resolves: #2115722
- Update to 0.2.15.
- Clean up obsolete conditionals for 64 bit builds in spec file.
- Revert "minor spec cleanups" by Peter Robinson.
- Drop openblas-srpm-macros version requirement
- build a copy of openblas that thinks it is Rblas
There are no code changes, except for libname and soname, it is identical to libopenblas.so.0
Unfortunately, while R itself is fine using a symlink from libopenblas.so.0 to libRblas.so
the larger R ecosystem becomes unhappy in this scenario.
- Define %openblas_arches for dependent packages to use
- Ensure object files built from assembler sources are annotated
related: #1624156
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
opus-1.3-0.4.beta.el8.x86_64.rpm | - Update to 1.2.1
- Update to 1.1-rc
- Update to 1.2.0 Alpha
- Install html docs in devel package
- Update to 1.2.0 Beta
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Official 1.0.2 release
- Update to 1.0.1rc3
- Update to 0.9.14
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Update to 1.3 beta
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Add make check - fixes RHBZ # 821128
- Use %license
- Update 1.1.1 GA
- Update to 1.2.0 RC1
- Add gcc BR
- Update to 1.0.0rc1
- Build developer docs
- Update to 0.9.10
- Initial packaging
- 1.0.3 release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Update 1.1.2 GA
- Update to 1.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Switch to %ldconfig_scriptlets
- 1.1 release
- Update to 1.1-rc2
- Update to 1.1.1 RC (further ARM optimisations)
- Update 1.1.3 GA
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update to 1.1.1 beta (SSE, ARM, MIPS optimisations)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Update to 0.9.8
- Enable extra custom modes API
- Update to 1.1-rc3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Official 1.0.1 release now rfc6716 is stable
orc-0.4.28-4.el8_10.x86_64.rpm | - Add patch for CVE-2024-40897
- Resolves: RHEL-50710
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Update to 0.4.18.
- x86: add endbr32 and endbr64 instructions
- Resolves: rhbz#1693292
- Update to latest upstream release
- Removed obsolete patches
- Add Fedora specific patch for tempfiles in subdirs
- Update to 0.4.14
- Use orc as pakage name
- spec-file cleanup
- Added devel requirements
- Removed an rpath issue
- Fix fallback path when register allocation fails
- Fixes gstreamer-1.0 crash on OLPC XO-1.75
- Update to 0.4.13, another bug fixing release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update to 0.4.26
- Fix typo rhbz#817944
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Update to 0.4.11.
- More bug fixes for CPUs that do not have backends, mmx and sse.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to 0.4.12, a bug fixing release
- Update to 0.4.9, a pimarily bug fixing release.
- Removed unused libdir
- don't run tests on ppc, ppc64
- don't run test on s390(x)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Updated to 0.4.6.
- New orc-bugreport added.
- Rebuilt for Fedora 23 Change
https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
- Added removed testing libraries to package.
- Running autoreconf to prevent building problems.
- Added missing files to docs.
- Added examples to devel docs.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Update to 0.4.25
- Update to 0.4.24
- Docs as noarch.
- Sanitize timestamps of header files.
- orcc in -compiler subpackage.
- Add orc-bugreport to the main package (#702727)
- Update to 0.4.27
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Updated to 0.4.5.
- Removed testing libraries from package.
- Do not run tests on aarch64
- Add upstream patch for selinux issue with tmp files
- Rebuilt for glibc bug#747377
- Update to 0.4.10.
- Fixes some bugs related to SELinux.
- Updated to 0.4.7.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Update to 0.4.22
- Update to 0.4.28
- Disable regeneration of docs
- Updated subdir patch.
- Add ARM platforms to the make check exclusion
- Updated to 0.4.4: Includes bugfixes for x86_64.
- Specfile cleanup
- Removed tools subpackage
- Added docs subpackage
- Update to 0.4.23
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Add upstream patches to fix gstreamer crash on Geode (#746185)
- Initial release
- Updated to 0.4.3
- Update to 0.4.16
- Fixing regression introdcued by 0.4.15 (#742534 and #734911)
- Update to 0.4.15
pcre2-utf16-10.32-3.el8_6.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Fix pcre2-config --libs-posix output (upstream bug #1924)
- Fix a memory leak and a typo in a documentation (upstream bug #1973)
- Fix a buffer overflow in partial match test for CRLF in an empty buffer
(upstream bug #1975)
- Fix a crash in pcre2test when displaying a wide character with a set locate
(upstream bug #1976)
- Fix DFA matching a lookbehind assertion that has a zero-length branch
(PCRE2 oss-fuzz issue 1859)
- Fix returned offsets from regexec() when REG_STARTEND is used with starting offset
greater than zero (upstream bug #2128)
- Fix a pcre2test crash on multiple push statements (upstream bug #2109)
- Fix handling a hyphen at the end of a character class (upstream bug #2153)
- 10.30 bump
- Backport fix for AArch64
- Close serialization file in pcre2test after any error (upstream bug #2074)
- Fix a memory leak in pcre2_serialize_decode() when the input is invalid
(upstream bug #2075)
- Fix a potential NULL dereference in pcre2_callout_enumerate() if called with
a NULL pattern pointer when Unicode support is available (upstream bug #2076)
- Fix CVE-2017-8786 (32-bit error buffer size bug in pcre2test) (bug #1500717)
- Disable SELinux-friendly JIT allocator because it crashes after a fork
(upstream bug #1749)
- Recognize all Unicode space characters with /x option in a pattern
(bug #1617960)
- Fix changing dynamic options (bug #1617960)
- Fix autopossessifying a repeated negative class with no characters less than
256 that is followed by a positive class with only characters less than 255,
(bug #1617960)
- Fix autopossessifying a repeated negative class with no characters less than
256 that is followed by a positive class with only characters less than 256,
(bug #1617960)
- Fix a race in JIT locking condition
- Fix an ovector check in JIT test program
- Enable JIT in the pcre2grep tool
- Fix global search/replace in pcre2test and pcre2_substitute() when the pattern
matches an empty string, but never at the starting offset
- 10.20-RC1 bump
- Replace dependency on glibc-headers with gcc (bug #1230479)
- Preserve soname
- Fix multi-line matching in pcre2grep tool (upstream bug #2187)
- Disable the JIT on riscv64.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Adapt a test to French locale on RHEL
- Fix a compiler warning in JIT code for ppc32
- Fix caseless matching an extended class in JIT mode (bug #1617960)
- 10.20 bump
- Fix anchoring in conditionals with only one branch (bug #1617960)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- 10.22-RC1 bump
- libpcre2-posix library changed ABI
- Fix register overwite in JIT when SSE2 acceleration is enabled
- Correct pcre2unicode(3) documentation
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Switch to %ldconfig_scriptlets
- 10.21 bump
- Fix compiling classes with a negative escape and a property escape
(upstream bug #1697)
- Fix integer overflow for patterns whose minimum matching length is large
(upstream bug #1699)
- Fix returning unset groups in POSIX interface if REG_STARTEND has a non-zero
starting offset (upstream bug #2244)
- Fix pcre2test -C to correctly show what \R matches
- Fix matching repeated character classes against an 8-bit string containting
multi-code-unit characters
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- 10.23 bump
- Fix bug when \K is used in a lookbehind in a substitute pattern
- Add support to pcre2grep for binary zeros in -f files (upstream bug #2222)
- Fix compiler warnings in pcre2grep
- 10.23-RC1 bump
- Rebuild for readline 7.x
- Fix displaying a callout position in pcretest output with an escape sequence
greater than \x{ff}
- Fix pcrepattern(3) documentation
- Fix miscopmilation of conditionals when a group name start with "R"
(upstream bug #1873)
- Fix internal option documentation in pcre2pattern(3) (upstream bug #1875)
- Fix optimization bugs for patterns starting with lookaheads
(upstream bug #1882)
- Fix an internal error for a forward reference in a lookbehind with
PCRE2_ANCHORED (oss-fuzz bug #865)
- Fix a pcre2test bug for global match with zero terminated subject
(upstream bug #2063)
- PCRE2 library packaged
- Package pcre2demo.c as a documentation for pcre2-devel
- Fix a typo in pcre2_study()
- Fix applying local x modifier while global xx was in effect
- 10.31-RC1 bump
- 10.22 bump
- 10.30-RC1 bump
- Heap-based matching implementation replaced stack-based one
- SELinux-friendly JIT enabled
- Ship README in devel as it covers API and build, not general info
- Move UTF-16 and UTF-32 libraries into pcre-ut16 and pcre-32 subpackages
- Fix an out-of-bound read in pcre2test tool within POSIX mode
(upstream bug #2008)
- Accept files names longer than 128 bytes in recursive mode of pcre2grep
(upstream bug #2177)
- 10.31 bump
- Fix handling \K in an assertion in pcre2grep tool and documentation
(upstream bug #2211)
- Fix matching at a first code unit of a new line sequence if PCRE2_FIRSTLINE
is enabled
- Fix compiling a class with UCP and without UTF
- Fix pcre2_jit_match() to properly check the pattern was JIT-compiled
- Allow pcre2grep match counter to handle values larger than 2147483647,
(upstream bug #2208)
- Fix incorrect first matching character when a backreference with zero minimum
repeat starts a pattern (upstream bug #2209)
- Fix auto-possessification at the end of a capturing group that is called
recursively (upstream bug #2232)
- Fix a crash when doing an extended substitution for \p, \P, or \X
(upstream bug #1977)
- Fix a crash in substitution if starting offest was specified beyond the
subject end (upstream bug #1992)
- Enlarge ovector array match data structure to be large enough in all cases
(oss-fuzz #5415)
- Fix DFA match for a possessively repeated character class (upstream bug #2086)
- Use a memory allocator from the pattern if no context is supplied to
pcre2_match()
- Rebuild with binutils fix for ppc64le (#1475636)
- Handle memmory allocation failures in pcre2test tool
- Fix CVE-2017-7186 (a crash when finding a Unicode property for a character
with a code point greater than 0x10ffff in UTF-32 library while UTF mode is
disabled) (upstream bug #2052)
- Fix backtracking atomic groups when they are not separated by something with
a backtracking point
- Document assert capture limitation (upstream bug #1887)
- Ignore offset modifier in pcre2test in POSIX mode (upstream bug #1898)
- 10.32 bump (bug #1628200)
- Fix a subject buffer overread in JIT when UTF is disabled and \X or \R has
a greater than 1 fixed quantifier (bug #1628200)
- Fix matching a zero-repeated subroutine call at a start of a pattern
(bug #1628200)
- Fix heap limit checking overflow in pcre2_dfa_match() (bug #1628200)
- Fix CVE-2017-7186 in JIT mode (a crash when finding a Unicode property for
a character with a code point greater than 0x10ffff in UTF-32 library while
UTF mode is disabled) (bug #1434504)
- Fix an incorrect cast in UTF validation (upstream bug #2090)
- 10.21-RC1 bump
- Fix compiling patterns with PCRE2_NO_AUTO_CAPTURE (upstream bug #1704)
- Fix faulty auto-anchoring patterns when .* is inside an assertion
- Resolves: CVE-2022-1586
- Fix repeated pcregrep output if -o with -M options were used and the match
extended over a line boundary (upstream bug #1848)
- Fix matching characters above 255 when a negative character type was used
without enabled UCP in a positive class (upstream bug #1866)
- Report unmatched closing parantheses properly
- Fix pcre2test for expressions with a callout inside a look-behind assertion
(upstream bug #1783)
- Fix CVE-2016-3191 (workspace overflow for (*ACCEPT) with deeply nested
parentheses) (upstream bug #1791)
- Fix checking that a lookbehind assertion has a fixed length if the
lookbehind assertion is used inside a lookahead assertion
- Fix parsing VERSION conditions
- Fix CVE-2019-20454 (a crash when \X is used without UTF mode in a JIT)
(bug #1734468)
- Fix setting error offset zero for early errors in pcre2_pattern_convert()
- fixed Release field
platform-python-devel-3.6.8-71.el8_10.rocky.0.x86_64.rpm | - Remove sys.executable check from change-user-install-location patch
Resolves: rhbz#1532287
- Update to Python 3.4 beta 1.
- Refreshed patches: 102 (lib64), 111 (no static lib), 125 (less verbose COUNT
ALLOCS), 141 (fix COUNT_ALLOCS in test_module), 146 (hashlib fips),
157 (UID+GID overflows), 173 (ENOPROTOOPT in bind_port)
- Removed patch 00187 (remove pthread atfork; upstreamed)
- Provide System Python packages and macros
- Added fix for CVE-2013-4238 (rhbz#996399)
- Set to work with pip version 9.0.1
- Use python3-*, not python-* runtime requires on setuptools and pip
- rebuild for tcl-8.6
- Security fix for CVE-2020-26116: Reject control chars in HTTP method in http.client
Resolves: rhbz#1883257
- avoid allocating thunks in ctypes unless absolutely necessary, to avoid
generating SELinux denials on "import ctypes" and "import uuid" when embedding
Python within httpd (patch 155; rhbz#814391)
- Add __pycache__ directory for site-packages
- Updated to Python 3.3.2.
- Refreshed patches: 153 (gdb test noise)
- Dropped patches: 175 (configure -Wformat, fixed upstream), 182 (gdb
test threads)
- Synced patch numbers with python.spec.
- Rebuilt for gdbm
- Fix multilib dependencies.
Resolves: rhbz#1091815
- 3.3.0b2 -> 3.3.0rc1; refresh patches 3, 55
- add BR on bluez-libs-devel (rhbz#879720)
- disable gdbm module to prepare for gdbm soname bump
- Add -n option for pathfix.py
Resolves: rhbz#1546990
- refresh gdb hooks to v3 (reworking how they are packaged)
- 3.2b2
- rework patch 3 (removal of mimeaudio tests), patch 6 (no static libs),
patch 8 (systemtap), patch 102 (lib64)
- remove patch 4 (rendered redundant by upstream r85537), patch 103 (PEP 3149),
patch 110 (upstreamed expat fix), patch 111 (parallel build fix for grammar
fixed upstream)
- regenerate patch 300 (autotool intermediates)
- workaround COUNT_ALLOCS weakref issues in test suite (patch 126, patch 127,
patch 128)
- stop using runtest.sh in %check (dropped by upstream), replacing with
regrtest; fixup list of failing tests
- introduce "pyshortver", "SOABI_optimized" and "SOABI_debug" macros
- rework manifests of shared libraries to use "SOABI_" macros, reflecting
PEP 3149
- drop itertools, operator and _collections modules from the manifests as py3k
commit r84058 moved these inside libpython; json/tests moved to test/json_tests
- move turtle code into the tkinter subpackage
- Build Python with -fno-semantic-interposition for better performance
- https://fedoraproject.org/wiki/Changes/PythonNoSemanticInterpositionSpeedup
- Also fix test_gdb failures with Link Time Optimizations
Resolves: rhbz#1724996
- Security fix for CVE-2015-20107
Resolves: rhbz#2075390
- rewrite of "check", introducing downstream-only hooks for skipping specific
cases in an rpmbuild (patch 132), and fixing/skipping failing tests in a more
fine-grained manner than before; (patches 106, 133-142 sparsely, moving
patches for consistency with python.spec: 128 to 134, 126 to 135, 127 to 141)
- Update %py_byte_compile macro
- Remove unused configure flags (rhbz#1374357)
- Disable test_gdb for all arches and test_buffer for ppc64le in anticipation
of the F28 mass rebuild
- Re-enable these tests after the mass rebuild when they can be properly
addressed
- Move distutils to system-python-libs
- Security fix for CVE-2021-3426: information disclosure via pydoc
Resolves: rhbz#1935913
- cherrypick fix for distutils not using __pycache__ when byte-compiling
files (rhbz#722578)
- support OpenSSL FIPS mode in _hashlib and hashlib; don't build the _md5 and
_sha* modules, relying on _hashlib in hashlib (rhbz#563986; patch 146)
- Do not include the unversioned pyvenv binary in the rpm
- Fix an incompatibility between pyexpat and the system expat-2.0.1 that led to
a segfault running test_pyexpat.py (patch 110; upstream issue 9054; rhbz#610312)
- aarch64 has valgrind, just list those that don't support it
- 3.2rc2
- Don't add Werror=declaration-after-statement for extension
modules through setup.py (PyBT#21121)
- Security fix for CVE-2019-16935
Resolves: rhbz#1798001
- Add idle3 to the alternatives system
- Resolves: rhbz#1632625
- add ppc64p7 build target, optimized for Power7
- Rebuild for reverted gdbm 1.13 on Fedora 27
- Update to Python 3.6.1 release candidate 1
- Add patch 264 to skip a known test failure on aarch64
- Add Requires (/post/postun) on /usr/sbin/alternatives
- Resolves: rhbz#1632625
- disable some tests on sparc arches
- rebuild
- Use python3 style of calling super() without arguments in rpath
patch to prevent recursion in UnixCCompiler subclasses
Resolves: rhbz#1458122
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rename the python3 subpackage to platform-python
- Provide the `python3` name for backwards compatibility until it's taken over
by the python36 component
- The python36 component that contains /usr/bin/python3 will Provide the
name `python3` in its upcoming update
- Resolves: rhbz#1619153
- Fix for CVE-2021-23336
Resolves: rhbz#1928904
- Security fix for CVE-2024-4032
Resolves: RHEL-44060
- exclude test_gdb on ppc* (rhbz#1132488)
- exclude test_http_cookies when running selftests, due to hang seen on
http: //koji.fedoraproject.org/koji/taskinfo?taskID=2088463 (cancelled after
11 hours)
- update python-gdb.py from v5 to py3k version submitted upstream
- Remove versioned libpython from devel package
- BuildRequire the new dependencies of setuptools when rewheel mode is enabled
in order for the virtualenvs to work properly
- Add filters for tarfile extraction (CVE-2007-4559, PEP-706)
Resolves: rhbz#263261
- Fix /usr/bin/env dependency from python3-tools
Resolves: rhbz#1482118
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Use RPM built wheels of pip and setuptools in ensurepip instead of our rewheel patch
- Require platform-python-setuptools from platform-python-devel to prevent packaging errors
Resolves: rhbz#1701286
- Rebased to version 3.5.2
- Set to work with pip version 8.1.2
- Removed patches 207, 237, 241 as fixes are already contained in Python 3.5.2
- Removed arch or environment specific patches 194, 196, 203, and 208
as test builds indicate they are no longer needed
- Updated patches 102, 146, and 242 to work with the new Python codebase
- Removed patches 200, 201, 5000 which weren't even being applied
- OpenSSL disabled SSLv3 in SSLv23 method
- Update rewheel patch with fix from https://github.com/bkabrda/rewheel/pull/1
- Update to Python 3.4 alpha 4.
- Refreshed patches: 55 (systemtap), 102 (lib64), 111 (no static lib),
114 (statvfs flags), 132 (unittest rpmbuild hooks), 134 (fix COUNT_ALLOCS in
test_sys), 143 (tsc on ppc64), 146 (hashlib fips), 153 (test gdb noise),
157 (UID+GID overflows), 173 (ENOPROTOOPT in bind_port), 186 (dont raise
from py_compile)
- Removed patches: 129 (test_subprocess nonreadable dir - no longer fails in
Koji), 142 (the mock issue that caused this is fixed)
- Added patch 187 (remove thread atfork) - will be in next version
- Refreshed script for checking pyc and pyo timestamps with new ignored files.
- The fips patch is disabled for now until upstream makes a final decision
what to do with sha3 implementation for 3.4.0.
- add flags for statvfs.f_flag to the constant list in posixmodule (i.e. "os")
(patch 105)
- Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
- Fix the test suite support for Expat >= 2.4.5
Resolves: rhbz#2047376, rhbz#2060435
- Fix memory corruption due to allocator mix
Resolves: rhbz#1498207
- Filter out automatic /usr/bin/python3.X requirement,
recommend the main package from libs instead
Resolves: rhbz#1547131
- fix permission on find-provides-without-python-sonames.sh from 775 to 755
- Fixed undefined behaviour in faulthandler which caused test to hang on x86_64
(http://bugs.python.org/issue23433)
- Security fix for CVE-2021-3737
Resolves: rhbz#1995162
- Make relocating Python by changing _prefix actually work
Resolves: rhbz#1231801
- Security fix for CVE-2019-5010 (rhbz#1666789)
- Security fix for CVE-2019-16056
Resolves: rhbz#1750776
- Make it build with OpenSSL-1.1.0 based on upstream patch
- Security fix for CVE-2023-40217
Resolves: RHEL-3041
- Reduced default build flags used to build extension modules
https://fedoraproject.org/wiki/Changes/Python_Extension_Flags
Resolves: rhbz#1634784
- Dropped BuildRequires on db4-devel which was useful for Python 2 (module
bsddb), however, no longer needod for Python 3
- Tested building Python 3 with and without the dependency, all tests pass and
filelists of resulting RPMs are identical
- reading the timestamp counter is available only on some arches (see Python/ceval.c)
- R: gdbm-devel → R: gdbm for python3-libs
- Use bconds for configuring the build
- Reorganize the initial sections
- fix up indentation in arm patch
- fix sysconfig to not rely on the -devel subpackage (rhbz#653058)
- Security fix for CVE-2024-6232
Resolves: RHEL-57399
- Initial package for Python 3.
- Remove system-python, see https://fedoraproject.org/wiki/Changes/Platform_Python_Stack
- don't use --with-tsc on ppc64 debug builds (rhbz#698726)
- Reduce the number of tests running during the profile guided optimizations build
- Enable profile guided optimizations for all the supported architectures
Resolves: rhbz#1749576
- python3-devel missing autogenerated pkgconfig() provides (#746751)
- Remove Windows binaries from the source archive
- Resolves: rhbz#1633219
- New patches: 170 (gc asserts), 200 (gettext headers),
201 (gdbm memory leak)
- fix gcc 4.8 incompatibility (rhbz#927358); regenerate autotool intermediates
- Add macro %python3_version_nodots
- Make `devel` subpackage require python36-devel again
(and get /usr/bin/python3 and /usr/bin/python3-config from that).
- Remove /usr/bin/python3* executables
- Use pip36 instead of `pip3`
- Fix test_alpn_protocols from test_ssl
- Do not require rebundled setuptools dependencies
- Fix the compilation of the nis module.
- Disallow control chars in http URLs
- Fixes CVE-2019-9740 and CVE-2019-9947
Resolves: rhbz#1704365 and rhbz#1703531
- Do not generate debuginfo subpackages (#1476593)
- Rebuild with binutils fix for ppc64le (#1475636)
- Refactor patch for properly fixing CVE-2016-5636
- Add patch that enables building on ppc64p7 (replace the sed, so that
we get consistent with python2 spec and it's more obvious that we're doing it.
- Security fix for CVE-2023-6597
Resolves: RHEL-33671
- Security fixes for CVE-2020-10735 and CVE-2021-28861
Resolves: rhbz#1834423, rhbz#2120642
- introduce %{dynload_dir} macro
- explicitly list all lib-dynload files, rather than dynamically gathering the
payload into a temporary text file, so that we can be sure what we are
shipping
- introduce a macros.pybytecompile source file, to help with packaging python3
modules (Source3; written by Toshio)
- rename "2to3-3" to "python3-2to3" to better reflect python 3 module packaging
plans
- Modify the runtime dependency of python3-libs on system-python-libs to use
just the version and release number, but not the dist tag due to Modularity
- update python-gdb.py from v4 to v5 (improving performance and stability,
adding commands)
- Rename python3.Xm-config script to arch specific.
Resolves: rhbz#1091815
- Security fix for CVE-2018-20852
Resolves: rhbz#1741553
- Fix test_dbm_gnu for gdbm 1.15 which fails on ppc64le
Resolves: rhbz#1638710
- 3.2.2
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- fixup importlib/_bootstrap.py so that it correctly handles being unable to
open .pyc files for writing (patch 2, upstream issue 7187)
- actually apply the rpath patch (patch 1)
- Added patch for fixing possible integer overflow and heap corruption in zipimporter.get_data()
- Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response
Resolves: rhbz#2036020
- work around test_subprocess failure seen in koji (patch 129)
- Enable rewheel
- Don't blow up on EL7 kernel (random generator) (rhbz#1410175)
- Fix update of idle3's alternative symlink
- Resolves: rhbz#1632625
- build with valgrind on ppc64le
- disable test_gdb on s390(x) until rhbz#1181034 is resolved
- Update PEP 538 to the latest upstream implementation
- re-enable gdbm (patch 148; rhbz#742242)
- Provide the `python3` name with _isa until some packages can be rebuilt
- Resolves: rhbz#1619153
- Update to Python 3.4.1
- fix test_gdb.py (patch 156; rhbz#817072)
- remove build-time requirements on tix and tk, since we already have
build-time requirements on the -devel subpackages for each of these (Thomas
Spura)
- replace usage of %define with %global (Thomas Spura)
- remove forcing of CC=gcc as this old workaround for bug 109268 appears to
longer be necessary
- move various test files from the "tools"/"tkinter" subpackages to the "test"
subpackage
- Fix localeconv() encoding for LC_NUMERIC
- Disable test_gdb on aarch64 (rhbz#1196181), it joins all other non x86 arches
- Rename patch files to be consistent
- Run autotools to generate the configure script before building
- Merge lib64 patches (104 into 102)
- Skip test_bdist_rpm using test config rather than a patch (removes patch 137)
- Remove patches 157 and 186, which had test changes left over after upstreaming
- Remove patch 188, a temporary workaround for hashlib tests
- Merge patches 180, 206, 243, 5001 (architecture naming) into new patch 274
- Move python2-tools conflicts to tools subpackage (it was wrongly in tkinter)
- don't run test_openpty and test_pty in %check
- Security fix for CVE-2022-45061
- Strip the LTO bytecode from python.o
Resolves: rhbz#2144072, rhbz#2137707
- 3.2.3; refresh patch 102 (lib64); drop upstream patches 148 (gdbm magic
values), 149 (__pycache__ fix); add patch 152 (test_gdb regex)
- Temporarily disable tests requiring SIGHUP (rhbz#1088233)
- Make test_asyncio to not depend on the current SIGHUP signal handler.
- Rename the python3-debug subpackage to platform-python-debug
- Provide the `python3-debug` name for backwards compatibility until it's taken
over by the python36 component
- Rename the python3-libs-devel subpackage to platform-python-devel for
symmetry with the `platform-python` and `platform-python-debug` package
- Add symlink /usr/libexec/platform-python-debug that was mistakenly omitted
- Related: rhbz#1619153
- Compile the debug build with -Og rather than -O0
- Resolves: rhbz#1624162
- Point __os_install_post to correct brp-* files
- 3.3.0rc2 -> 3.3.0rc3
- Forward arguments to the arch specific config script
Resolves: rhbz#1102683
- use newly installed python for byte compiling (#787498)
- Enable profile guided optimizations for x86_64 and i686 architectures
- Update to a newer implementation of PEP 538
- Update description to reflect that Python 3 is now the default Python
- renumber and rename patches for consistency with python.spec (8 to 55, 106
to 104, 6 to 111, 104 to 113, 105 to 114, 125, 131, 130 to 143)
- Define HAVE_LONG_LONG as 1 for backwards compatibility
- Make pip and distutils in user environment install into separate location
- ensure that the compiler is invoked with "-fwrapv" (rhbz#594819)
- reformat whitespace in audioop.c (patch 106)
- CVE-2010-1634: fix various integer overflow checks in the audioop
module (patch 107)
- CVE-2010-2089: further checks within the audioop module (patch 108)
- CVE-2008-5983: the new PySys_SetArgvEx entry point from r81399 (patch 109)
- Skip test_startup_imports from test_site if we have a .pth file in sys.path
Resolves: rhbz#1814392
- Platform-Python: Rebase implementation from RHEL8 Alpha:
- Move the main executable to /usr/libexec/platform-python
- Move /usr/bin/python*-config and /usr/bin/pythonX.Ym scripts to /usr/libexec/
- Provide symlink to the main executable and other scripts from /usr/bin/,
these will be later shipped only in the python36 module
- Adding a new patch 329 that adds support for OpenSSL FIPS mode
- Explicitly listing man pages in files section to fix an RPM warning
Resolves: rhbz#1731424
- Require large enough gdbm (fixup for previous bump)
- 3.2
- drop alphatag
- regenerate autotool patch
- Update to Python 3.4 beta 2.
- Refreshed patches: 55 (systemtap), 146 (hashlib-fips), 154 (test_gdb noise)
- Dropped patches: 114 (statvfs constants), 177 (platform unicode)
- add macros.python3 to the -devel subpackage, containing common macros for use
when packaging python3 modules
- Move xml module to system-python-libs
- update uid/gid handling to avoid int overflows seen with uid/gid
values >= 2^31 on 32-bit architectures (patch 157; rhbz#697470)
- Security fix for CVE-2023-27043
Resolves: RHEL-20610
- Fix for CVE-2019-10160
Resolves: rhbz#1689318
- Create the `libs-devel` subpackage and move `devel` contents there
- `devel` subpackage is only for the buildroot and requires `python36-devel`
to get /usr/bin/python3{,-config} symlinks there
- `devel` subpackage will not be shipped into RHEL8, only `libs-devel` will
- `debug` subpackage now runtime requires `libs-devel` instead of `devel`
- Obsolete and Provide python35 package
- rebuild for new package of redhat-rpm-config (rhbz:564527)
- use 'install -p' when running 'make install'
- Add --executable option to install.py command
- Specfile cleanup
- Make the main description also applicable to the SRPM
- Add audiotest.au to the test package
- move lib2to3 from -tools subpackage to main package (bug 556667)
- Add explicit RPM Provides for /usr/libexec/platform-python
Resolves: RHEL-48605
- Enable link time optimizations
- Move windows executables to the devel subpackage (rhbz#1426257)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Include `-g` in the flags sent to the linker (LDFLAGS)
Resolves: rhbz#1483222
- 3.3.0rc3 -> 3.3.0; drop alphatag
- fix tapset for debug build
- 3.3b1 -> 3.3b2; drop upstreamed patch 152; refresh patches 3, 102, 111,
134, 153, 160; regenenerate autotools patch; rework systemtap patch to work
correctly when LANG=C (patch 55); importlib.test was moved to
test.test_importlib upstream
- add %check section (thanks to Thomas Spura)
- update patch 4 to use correct shebang line
- get rid of stray patch file from buildroot
- Security fix for CVE-2023-24329
Resolves: rhbz#2173917
- Fix python3-config --configdir (rhbz#1772992).
- add a /usr/bin/python3-debug symlink within the debug subpackage
- Modify the runtime dependency of python3-libs on system-python-libs again,
because previous attempt didn't work properly with dnf resolving mechanism
- Move pathfix.py to bindir, https://github.com/fedora-python/python-rpm-porting/issues/24
- Make the -devel package require redhat-rpm-config
Resolves: rhbz#1496757
- Fix test_pyexpat failure with Expat version of 2.2.0
- Remove old system-python Provides/Obsoletes/symlinks/patches from Fedora
- add explicit version requirements on expat to avoid linkage problems with
XML_SetHashSalt
- Raise the release of platform-python obsoletes for better maintainability
- Update to 3.5.0
- fix the libpython.stp systemtap tapset (rhbz#697730)
- remove config flag from /etc/rpm/macros.{python3|pybytecompile}
- Security fix for CVE-2020-8492
Resolves: rhbz#1810618
- Fix for: CVE-2016-0772 python: smtplib StartTLS stripping attack
- Raise an error when STARTTLS fails
- rhbz#1303647: https://bugzilla.redhat.com/show_bug.cgi?id=1303647
- rhbz#1346345: https://bugzilla.redhat.com/show_bug.cgi?id=1346345
- Fixed upstream: https://hg.python.org/cpython/rev/d590114c2394
- Remove Obsoletes and Provides that are not relevant for RHEL
- Disable ssl related tests for now
- Use 1024bit DH key in test_ssl
- Use -O0 when compiling -debug build
- Update pip version variable to the version we actually ship
- Make sure the entire test.support module is in python3-libs
Resolves: rhbz#1651215
- update the arch list where valgrind exists - %power64 includes also
ppc64le which is not supported yet
- Remove downstream 00178-dont-duplicate-flags-in-sysconfig.patch which
introduced a bug on distutils.sysconfig.get_config_var('LIBPL')
(rhbz#1851090).
- Update to Python 3.4 final
- Add patch adding the rewheel module
- Merge patches from master
- Security fix for CVE-2024-9287
Resolves: RHEL-64878
- Security fix for CVE-2025-8194
Resolves: RHEL-106333
- add aarch64 (rhbz#909783)
- Added a dependency to the devel subpackage on python3-rpm-generators which
have been excised out of rpm-build
- Updated notes on bootstrapping Python on top of this specfile accordingly
- Involves: rhbz#1410631, rhbz#1444925
- Fix test_tarfile on ppc64 (rhbz#1639490)
- Add compatibility fixes for openssl 1.1.1 and tls 1.3
Resolves: rhbz#1610023
- update patch0's setup of the crypt module to link it against libcrypt
- update patch0 to comment "datetimemodule" back out, so that it is built
using setup.py (see Setup, option 3), thus linking it statically against
timemodule.c and thus avoiding a run-time "undefined symbol:
_PyTime_DoubleToTimet" failure on "import datetime"
- Stop providing the `python3` and `python3-debug` names from the
platform-python/-debug subpackages
- The `python3` and `python3-debug` names are now provided from the python36
component
- Conflict with older versions of `python3` and `python3-debug`
- Related: rhbz#1619153
- 3.2.1; refresh lib64 patch (102), subprocess unit test patch (129), disabling
of static library build (due to Modules/_testembed; patch 6), autotool
intermediates (patch 300)
- Change shouldRollover() methods of logging.handlers to only rollover regular files
Resolves: rhbz#2009200
- Remove %{pylibdir}/Tools/scripts/2to3
- Update to 3.5.1
- Removed patch 199 and 207 (upstream)
- Change paths to bundled projects in rewheel patch
- Add bcond for --without optimizations
- Reword package descriptions
- Remove Group declarations
- Skip failing test_float_with_comma
- Rebuild for readline 7.x
- Update to Python 3.6.0 beta 4
- add a sys._debugmallocstats() function (patch 147)
- Rebuilt for Fedora 23 Change
https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
- add pyfuntop.stp example (source 7)
- convert usage of $$RPM_BUILD_ROOT to %{buildroot} throughout, for
consistency with python.spec
- In config script, use uname -m to write the arch
- test_ssl fixes for TLS 1.3 and OpenSSL 1.1.1 (rhbz#1639531)
- disable rAssertAlmostEqual in test_cmath on PPC (#750811)
- 3.2rc3
- regenerate autotool patch
- Bytecompile all *.py files properly during build (rhbz#1023607)
- disable some failing checks on PPC* (rhbz#846849)
- Patch 329 (FIPS) modified: Added workaround for mod_ssl:
Skip error checking in _Py_hashlib_fips_error
Resolves: rhbz#1760106
- New options -a and -k for pathfix.py script backported from upstream
Resolves: rhbz#1917691
- Security fix for CVE-2019-9636 (rhbz#1689318)
- Fix for CVE-2016-1000110 HTTPoxy attack
- SPEC file cleanup
- Updated to 3.4.3
- BuildPython now accepts additional build options
- Temporarily disabled test_gdb on arm (rhbz#1196181)
- Use the monotonic clock for theading.Condition
- Use the monotonic clock for the global interpreter lock
Resolves: rhbz#2003758
- Obsolete platform-python and it's subpackages
- Rebuild with new LDFLAGS from redhat-rpm-config
- Fix the "urllib FTP protocol stream injection" vulnerability
Resolves: rhbz#1478916
- Remove the python3-tools package (#rhbz 1312030)
- Move /usr/bin/2to3 to python3-devel
- Move /usr/bin/idle and idlelib to python3-idle
- Provide python3-tools from python3-idle
- Updated to Python 3.3.1.
- Refreshed patches: 55 (systemtap), 111 (no static lib), 146 (hashlib fips),
153 (fix test_gdb noise), 157 (uid, gid overflow - fixed upstream, just
keeping few more downstream tests)
- Removed patches: 3 (audiotest.au made it to upstream tarball)
- Removed workaround for http://bugs.python.org/issue14774, discussed in
http: //bugs.python.org/issue15298 and fixed in revision 24d52d3060e8.
- Remove /usr/bin/idle3 symlink
- Resolves: rhbz#1623811
- Build with $RPM_LD_FLAGS (#756863).
- Use xz-compressed source tarball.
- Add support for upstream architecture names
https: //fedoraproject.org/wiki/Changes/Python_Upstream_Architecture_Names
Resolves: rhbz#1868003
- Updated fix for CVE-2019-9636 (rhbz#1689318)
- Do not send IP addresses in SNI TLS extension
- Fix broken macro invocation and broken building of C Python extensions
Resolves: rhbz#1560103
- Build Python with -O3
- https://fedoraproject.org/wiki/Changes/Python_built_with_gcc_O3
- Security fix for CVE-2024-11168
Resolves: RHEL-67252
- Update to 3.6.7 (rhbz#1627739)
- Re-enable test_gdb (rhbz#1639536)
- Re-enable test_faulthandler (rhbz#1640147)
- bump release and rebuild to link with the correct tcl/tk libs on ppcle
- fix the URLs output by pydoc so they point at python.org's 3.1 build of the
docs, rather than the 2.6 build
- run selftests with "--verbose"
- disable parts of test_io on ppc (rhbz#732998)
- Adjusted the postun scriptlets to enable upgrading to RHEL 9
- Resolves: rhbz#1933055
- Fix %py_byte_compile macro: when invoked with a Python 2 binary it also
mistakenly ran py3_byte_compile
- Revert "Set values of prefix and exec_prefix to /usr/local for
/usr/bin/python* executables..." to prevent build failures
of packages using alternate build tools
- 3.2 -> 3.3: https://fedoraproject.org/wiki/Features/Python_3.3
- 3.3.0b1: refresh patches 3, 55, 102, 111, 113, 114, 134, 157; drop upstream
patch 147; regenenerate autotools patch; drop "--with-wide-unicode" from
configure (PEP 393); "plat-linux2" -> "plat-linux" (upstream issue 12326);
"bz2" -> "_bz2" and "crypt" -> "_crypt"; egg-info files are no longer shipped
for stdlib (upstream issues 10645 and 12218); email/test moved to
test/test_email; add /usr/bin/pyvenv[-3.3] and venv module (PEP 405); add
_decimal and _lzma modules; make collections modules explicit in payload again
(upstream issue 11085); add _testbuffer module to tests subpackage (added in
upstream commit 3f9b3b6f7ff0); fix test failures (patches 160 and 161);
workaround erroneously shared _sysconfigdata.py upstream issue #14774; fix
distutils.sysconfig traceback (patch 162); add BuildRequires: xz-devel (for
_lzma module); skip some tests within test_socket (patch 163)
- Update the rewheel module
- Fix symlink handling in the fix for CVE-2007-4559
Resolves: rhbz#263261
- fix test.test_gdb.PyBtTests.test_threads on ppc64 (patch 181; rhbz#960010)
- Fix for CVE-2021-3177
Resolves: rhbz#1918168
- Fix reentrant call to threading.enumerate() (rhbz#1959459)
- Don't exit Python with abort() when a thread exit and there is no available
file descriptor to load dynamically the libgcc_s.so.1 library (rhbz#1972293)
- Hide the private _Py_atomic_xxx symbols from public header
- reword description, based on suggestion by amcnabb
- fix the test_email and test_imp selftests (patch 3 and patch 4 respectively)
- fix the test_tk and test_ttk_* selftests (patch 5)
- fix up the specfile's handling of shebang/perms to avoid corrupting
test_httpservers.py (sed command suggested by amcnabb)
- patch Makefile.pre.in to avoid building static library (patch 6, bug 556092)
- switched a few instances of "find |xargs" to "find -exec" for consistency.
- made the description of __os_install_post more accurate.
- Own systemtap dirs (#710733)
- use the %{_isa} macro to ensure that the python-devel dependency on python
is for the correct multilib arch (#555943)
- delete bundled copy of libffi to make sure we use the system one
- build and install two different configurations of Python 3: debug and
standard, packaging the debug build in a new "python3-debug" subpackage
(patch 103)
- Do not set PHA verify flag on client side (rhbz#1725721)
- Enable TLS 1.3 post-handshake authentication in http.client (rhbz#1671353)
- Update to version 3.6.1 final
- Switch to requiring platform-python-pip/setuptools instead of the python3-
versions
- Resolves: rhbz#1638836
- Remove 3 > 3.6 symlinks for pydoc and python manpage
- Resolves: rhbz#1615727
- fix missing include in uid/gid handling patch (patch 157; rhbz#830405)
- Add desktop entry and appdata.xml file for IDLE 3 (rhbz#1392049)
- disable invocation of brp-python-bytecompile in postprocessing, since
it would be with the wrong version of python (adapted from ivazquez'
python3000 specfile)
- use a custom implementation of __find_provides in order to filter out bogus
provides lines for the various .so modules
- fixup distutils/unixccompiler.py to remove standard library path from rpath
(patch 1, was Patch0 in ivazquez' python3000 specfile)
- split out libraries into a -libs subpackage
- update summaries and descriptions, basing content on ivazquez' specfile
- fixup executable permissions on .py, .xpm and .xbm files, based on work in
ivazquez's specfile
- get rid of DOS batch files
- fixup permissions for shared libraries from non-standard 555 to standard 755
- move /usr/bin/python*-config to the -devel subpackage
- mark various directories as being documentation
- Patch 329 that adds support for OpenSSL FIPS mode has been improved and
bugfixed
Resolves: rhbz#1744670 rhbz#1745499 rhbz#1745685
- Use proper patch numbering and base upstream branch for
porting ssl and hashlib modules to OpenSSL 1.1.0
- Drop hashlib patch for now
- Add riscv64 arch to 64bit and no-valgrind arches
- Have /usr/bin/2to3 (rhbz#1111275)
- Provide 2to3 and idle3, list them in summary and description (rhbz#1076401)
- Drop python3 macros, require python/python3-rpm-macros
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Security fix for CVE-2024-6923
Resolves: RHEL-53065
- Add patch for libxcrypt
- Disable strict symbol checks in the link editor
- Rebuild with wheel set to 1
- Fix syntax error in %py_byte_compile macro (rhbz#1433569)
- move the -gdb.py file from %{_libdir}/INSTSONAME-gdb.py to
%{_prefix}/lib/debug/%{_libdir}/INSTSONAME.debug-gdb.py to avoid noise from
ldconfig (bug 562980), and which should also ensure it becomes part of the
debuginfo subpackage, rather than the libs subpackage
- introduce %{py_SOVERSION} and %{py_INSTSONAME} to reflect the upstream
configure script, and to avoid fragile scripts that try to figure this out
dynamically (e.g. for the -gdb.py change)
- Add rocky to supported dists
- on 64bit "stdlib" was still "/usr/lib/python*" (modify *lib64.patch)
- make find-provides-without-python-sonames.sh 64bit aware
- Disable test_faulthandler, test_gdb on aarch64
Resolves: rhbz#1045193
- Modify the test suite to better handle disabled SSL/TLS versions and FIPS mode
- Use OpenSSL's DRBG and disable os.getrandom() function in FIPS mode
Resolves: rhbz#1754028, rhbz#1754027, rhbz#1754026, rhbz#1774471
- add gdb hooks for easier debugging (Source 4)
- Update to Python 3.6.3
- add workaround for ENOPROTOOPT seen running selftests in Koji
(rhbz#913732)
- Use proper command line parsing in _testembed
- Backport of PEP 538: Coercing the legacy C locale to a UTF-8 based locale
https://fedoraproject.org/wiki/Changes/python3_c.utf-8_locale
- 3.2a1; add alphatag
- rework %files in the light of PEP 3147 (__pycache__)
- drop our configuration patch to Setup.dist (patch 0): setup.py should do a
better job of things, and the %files explicitly lists our modules (r82746
appears to break the old way of doing things). This leads to various modules
changing from "foomodule.so" to "foo.so". It also leads to the optimized build
dropping the _sha1, _sha256 and _sha512 modules, but these are provided by
_hashlib; _weakref becomes a builtin module; xxsubtype goes away (it's only for
testing/devel purposes)
- fixup patches 3, 4, 6, 8, 102, 103, 105, 111 for the rebase
- remove upstream patches: 7 (system expat), 106, 107, 108 (audioop reformat
plus CVE-2010-1634 and CVE-2010-2089), 109 (CVE-2008-5983)
- add machinery for rebuilding "configure" and friends, using the correct
version of autoconf (patch 300)
- patch the debug build's usage of COUNT_ALLOCS to be less verbose (patch 125)
- "modulator" was removed upstream
- drop "-b" from patch applications affecting .py files to avoid littering the
installation tree
- use macro for power64 (rhbz#834653)
- Security fix for CVE-2024-0450
Resolves: RHEL-33683
- add a provides of "python(abi)" (see bug 532118)
- fix issues identified by a.badger in package review (bug 526126, comment 39):
- use "3" thoughout metadata, rather than "3.*"
- remove conditional around "pkg-config openssl"
- use standard cleanup of RPM_BUILD_ROOT
- replace hardcoded references to /usr with _prefix macro
- stop removing egg-info files
- use /usr/bin/python3.1 rather than /use/bin/env python3.1 when fixing
up shebang lines
- stop attempting to remove no-longer-present .cvsignore files
- move the post/postun sections above the "files" sections
- Install the Makefile in its proper location (rhbz#1438219)
- Fix the `devel` subpackage to require python3, rather than python36-devel,
and provide /usr/bin/python3-config itself.
- Security fix for CVE-2021-3733: Denial of service when identifying crafted invalid RFCs
Resolves: rhbz#1995234
- Bump release for rebuild
Resolves: rhbz#2173917
- use newly installed python for byte compiling (now for real)
- Disable %check so package will build for Mass Rebuild
- Related: bug#1614611
- Fix the py_byte_compile macro to work on Python 2
- Remove the pybytecompile macro file from the flat package
Resolves: rhbz#1484993
- Add patch for CVE-2013-2099 (rhbz#963261).
- add --with-valgrind to configuration (on architectures that support this)
- cleanup of BuildRequires; add comment headings to specfile sections
- Fix error in platform.platform() when non-ascii byte strings are decoded to
unicode (rhbz#922149)
- Release bump
Resolves: rhbz#2136435
- Rename python3.Xdm-config script from -debug to be arch specific
Resolves: rhbz#1179073
- Restore the PyExc_RecursionErrorInst public symbol
- update python-3.1.1-config.patch to remove downstream customization of build
of pyexpat and elementtree modules
- add patch adapted from upstream (patch 7) to add support for building against
system expat; add --with-system-expat to "configure" invocation
- remove embedded copies of expat and zlib from source tree during "prep"
- Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
Resolves: RHEL-98030, RHEL-97987, RHEL-98232, RHEL-98065, RHEL-98189
- Update to Python 3.6.6
- Provide python3-enum34
- replace references to /usr with %{_prefix}; replace references to
/usr/include with %{_includedir} (Toshio)
- Switch all shebangs to point to the Platform-Python executables
- re-enable and fix the --with-tsc option on ppc64, and rework it on 32-bit
ppc to avoid aliasing violations (patch 130; rhbz#698726)
- Move test.support to core package (rhbz#596258)
- Add various missing __pycache__ directories to payload
- add %python3_version to the rpm macros (rhbz#719082)
- split configure options into multiple lines for easy of editing
- add systemtap static markers (wcohen, mjw, dmalcolm; patch 8), a systemtap
tapset defining "python.function.entry" and "python.function.return" to make
the markers easy to use (dmalcolm; source 5), and an example of using the
tapset to the docs (dmalcolm; source 6) (rhbz:545179)
- Require glibc >= 2.24.90-26 for system-python-libs (rhbz#1410644)
- Expat >= 2.1.0 is everywhere, remove explicit requires
- Conditionalize systemtap-devel BuildRequires
- For consistency, require /usr/sbin/ifconfig instead of net-tools
- Properly pass the -Og optimization flag to the debug build
Resolves: rhbz#1712977 and rhbz#1714733
- add configure-time support for COUNT_ALLOCS and CALL_PROFILE debug options
(patch 104); enable them and the WITH_TSC option within the debug build
- Fix build with libffi containing multilib wrapper for ffi.h (rhbz#979696).
- update to 3.1.2: http://www.python.org/download/releases/3.1.2/
- drop upstreamed patch 2 (.pyc permissions handling)
- drop upstream patch 5 (fix for the test_tk and test_ttk_* selftests)
- drop upstreamed patch 200 (path-fixing script)
- remove commented-away patch 51 (python-2.6-distutils_rpm.patch): the -O1
flag is used by default in the upstream code
- "Makefile" and the config-32/64.h file are needed by distutils/sysconfig.py
_init_posix(), so we include them in the core package, along with their parent
directories (bug 531901)
- Update to Python 3.6.2
- Implement `alternatives` for chosing /usr/bin/python
- Provide the default `no-python` alternative
- Resolves: rhbz#1632625
- Update to version 3.6.4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- 3.2rc1
- rework patch 6 (static lib removal)
- remove upstreamed patch 130 (ppc debug build)
- regenerate patch 300 (autotool intermediates)
- updated packaging to reflect upstream rewrite of "Demo" (issue 7962)
- added libpython3.so and 2to3-3.2
- change python-3.1.1-config.patch to remove our downstream change to curses
configuration in Modules/Setup.dist, so that the curses modules are built using
setup.py with the downstream default (linking against libncursesw.so, rather
than libncurses.so), rather than within the Makefile; add a test to %install
to verify the dso files that the curses module is linked against the correct
DSO (bug 539917; changes _cursesmodule.so -> _curses.so)
- set EXTRA_CFLAGS to our CFLAGS, rather than overriding OPT, fixing a linker
error with dynamic annotations (when configured using --with-valgrind)
- fix the ppc build of the debug configuration (patch 130; rhbz#661510)
- Rebuilt for switch to libxcrypt
- Security fix for CVE-2020-27619: eval() call on content received via HTTP in the CJK codec tests
Resolves: rhbz#1890237
- Updated .pyc 'bytecompilation with the newly installed interpreter' to also
recompile optimized .pyc files
- Removed .pyo 'bytecompilation with the newly installed interpreter', as .pyo
files are no more
- Resolves rhbz#1373635
- Update to 3.6.5
- Fix error check, so that Random.seed actually uses OS randomness (rhbz#1412275)
- Skip test_aead_aes_gcm during rpmbuild
- add correct arch for ppc64/ppc64le to fix build failure
- renumber autotools patch from 300 to 5000
- specfile cleanups
- Add setuptools and pip to Requires
- Escape macros in %changelog
- Revert "Add --executable option to install.py command"
This enhancement is currently not needed and it can possibly
collide with `pip --editable`option
- use the gdb hooks from the upstream tarball, rather than keeping our own copy
- use "--findleaks --verbose3" when running test suite
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Add a sentinel value on the Hmac_members table of the fips compliant hmac module
Resolves: rhbz#1800512
- fix test_gdb (patch 153)
- Add patch to explicitly link _ctypes module with -ldl (#1537489)
- Refactored patch for libxcrypt
- Re-enable strict symbol checks in the link editor
- Fix up shared library extension (rhbz#889784)
- add %py3dir macro to macros.python3 (to be used during unified python 2/3
builds for setting up the python3 copy of the source tree)
- Fix build with expat with fixed CVE-2023-52425
Related: RHEL-33671
- Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
Resolves: rhbz#1856481
- Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
Resolves: rhbz#1854926
- Properly strip the LTO bytecode from python.o
Resolves: rhbz#2137707
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- update python-gdb.py from v3 to v4 (fixing infinite recursion on reference
cycles and tracebacks on bytes 0x80-0xff in strings, adding handlers for sets
and exceptions)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- remove executable flag from various files that shouldn't have it
- fix end-of-line encodings
- fix a character encoding
- Update to 3.6.8
Resolves: rhbz#1658271
- Set values of prefix and exec_prefix to /usr/local for
/usr/bin/python* executables
- Use new %_module_build macro
- Security fix for CVE-2019-9948
Resolves: rhbz#1714643
- Build properly on MIPS
- Fix CVE-2014-4650 - CGIHTTPServer URL handling
Resolves: rhbz#1113529
- Update to Python 3.6.0 final
- Security fix for CVE-2022-48564
Resolves: RHEL-16674
- Skip tests failing on s390x
Resolves: RHEL-19252
- Skip windows specific test_get_exe_bytes test case and enable test_distutils
Resolves: rhbz#1754040
- Security fix for CVE-2018-14647
- Resolves: rhbz#1632096
- python3-devel: Require python-macros for version independant macros such as
python_provide. See fpc#281 and fpc#534.
- Add choices for sort option of cProfile for better output
Resolves: rhbz#1640151
- fix typo in libpython.stp (rhbz:575336)
- Update to Python 3.6.0 release candidate 1
- Fix test_gdb failure on ppc64le
Resolves: rhbz#1095355
- renumber patches to keep them in sync with python.spec
- Changed Requires into Recommends for python3-pip to allow a lower RHEL8
footprint for containers and other minimal environments
Resolves: rhbz#1756217
- Update to 3.4.2
- Refreshed patches: 156 (gdb autoload)
- Removed: 195 (Werror declaration), 197 (CVE-2014-4650)
- Turn on computed-gotos.
- Fix for parallel make and graminit.c
- Define TLS cipher suite on build time.
- Add missing %license macro
- gzip the unversioned-python man page
Resolves: rhbz#1665514
- move most of the content of the core package to the libs subpackage, given
that the libs aren't meaningfully usable without the standard libraries
- 3.3.0rc1 -> 3.3.0rc2; refresh patch 55
- Add fix for gdb tests failing on arm, rhbz#951802.
- Update to the latest upstream implementation of PEP 538
- Security fix for CVE-2022-48560
Resolves: RHEL-16707
- disable a test that fails on arm
- enable valgrind support on arm arches
pulseaudio-libs-14.0-4.el8.x86_64.rpm | - 6.99.1 (#1257770)
- pulseaudio-10.99.1 (#1474559)
- default.pa: fix for renamed modules (#908117)
- actually install new dell-dock-tb16-usb-audio.conf alsa profile (#1492344)
- handle jack/lirc modules better (#1056619)
- -libs-devel: own some dirs to avoid deps on cmake/vala
- -module-bluetooth: make dep arch'd for consistency
- pulseaudio 6.0 breaks 5.1 network sound configuration (#1230957)
- include experiemental Intel HDMI LPE fixes (fdo#100488)
- Move module-jackdbus-detect.so to -module-jack subpackage with the
rest of the jack modules
- fix the with_webrtc condition
- pulseaudio-5.99.2 (6.0-rc2)
- [RFE] Build with libcap (#969232)
- %check: make non-fatal, echo test-suite.log on failure (#1345826)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- own /var/run/pulse (#1173811)
- Obsoletes: padevchooser < 1.0
- Bring in Lennart's patch from f17
- Temporary fix for CK/systemd move (#794690)
- New 4.0 stable release
- http://www.freedesktop.org/wiki/Software/PulseAudio/Notes/4.0/
- Rebuild (libjson-c)
- pulseaudio-8.0 (#1301040)
- BR: gcc-c++
- pulseaudio-2.0
- Add pulseaudio-daemon' Provides + Conflicts only on fedora
- Resolves: rhbz#1924094
- Fix RHEL build
- Add patch for profile switching
- Resolves: rhbz#2052011. rhbz#2073877
- pulseaudio-9.0
- Update to today's git snapshot
- Backport a patch for pulseaudio crash at startup (#1000966)
- PulseAudio 2.99.3 (3.0 rc3)
- omit -gdm-hooks, moved to gdm (f28+)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- pulseaudio-7.1 (#1276811)
- don't mark .desktop and dbus configurations as %config
- Fix the build on RHEL
- pulseaudio-8.99.2
- better autostart.patch, handle case were autospawn is disabled (or otherwise doesn't work, like for root user)
- use %make_build, %make_install
- enable systemd socket/service activation on f28+ (and disable autospawn)
- Update to 10.0
- pulseaudio-11.0
- Don't load the ck module in gdm, either
- -qpaeq subpkg (#1002585)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- enable hardened build (#983606)
- Add flatpak access control
- Fix for building with gcc 4.7
- snapshot, with wip bt headset2 patches (#1045548,#1067470)
- Enable webrtc-aec
- pulseaudio-3.99.2 (#966631)
- backport 'pa_sink_input_assert_ref()' crashfix (#1472285)
- --disable-tcpwrap on f28+ (#1518777)
- Remove /var/run/pulse and /var/lib/pulse, they are directories in tmpfs
- exit-idle-time = 4 (#1510301)
- f28+ ftbfs: memfd_create conflicts
- drop getaffinity.patch (no longer needed)
- enable webrtc support for all archs
- make tests non-fatal on i686,s390x
- Fix port to qt5.
- Resolves: rhbz#1591134
- PulseAudio doesn't load locales (fdo#92142)
- Rebuilt once more for libjson-c
- experimental fixes bluetooth profile switching (f28+ only, fdo#93898)
- Rebuild with binutils fix for ppc64le (#1475636)
- --disable-systemd-daemon, revert to autospawn mode
- 20141103 327-gaec81 snapshot, pulseaudio socket activation support
- use bash completionsdir
- Use the statically allocated UID and GID from /usr/share/doc/setup/uidgid (#1056656)
- The pulse-rt group doesn't exist (#885020)
- enable %check
- fix bz#1345826, only start threads on activ CPUs
- pulseaudio-5.99.3 (6.0-rc3) (#1184850)
- BR: automake libtool (for bootstrap.sh)
- Really add pulse-rt group when needed (bug #885020)
- 4.99.4
- fresh snapshot
- Add xauthority parameter to X11 modules
- Fix compilation against newer alsa-lib
- Resolves: rhbz#1723065
- Use python3 version of qt5
- Resolves: rhbz#1591134
- New upstream release
- 4.99.3
- backport upstream fixes: memfd, qpape PyQt5 port
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- 4.99.2 (#1057528)
- pulseaudio-9.99.1 (#1409939)
- %check: use %_smp_mflags
- rebuilt for json-c-0.9-4.fc17
- pulseaudio-8.99.1 (#1335527)
- disable webrtc support for now (waiting on #1335536)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- skip patch93, seems to cause crashes w/headphone jacks (#1544507,#1551270,#1554035)
- Escape macros in %changelog
- Fixup ldconfig scriptlets
- pulseaudio-7.99.1 (8.0 rc1) (#1294555)
- Update to 13.99.1
- Resolves: rhbz#1817378
- duplicate directory between pulseaudio and pulseaudio-libs (#909690)
- pulseaudio-3.0
- fix PACKAGE_VERSION
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- ship a single autostart file
- RFE: Disable PulseAudio's flat volumes f24+ (#1265267)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- %build fix typo, explicitly --enable-tests
- pulseaudio-11.1
- fix resampler-related build dependencies (libsamplerate/speex) (#1239208)
- pulseaudio-5.99.1 (6.0-rc1)
- Provide padsp-32, /usr/bin/padsp is native arch only (#856146)
- Update to 14.0
- Add pulseaudio-daemon' Provides + Conflicts to support
swapping with PipeWire
- Resolves: rhbz#1906322
- Pulse Audio settings lost after reboot / HDMI is set as default (#1035025)
- Enable pulseaudio-module-bluetooth on s390x
- manually package sockets.target.wants/pulseaudio.socket to help
handle socket activation on upgrades
- Add patch to avoid bluez warning.
- Resolves: rhbz#1969944
- drop Requires: kernel (per recent -devel ml thread)
- pulseaudio-7.0
- Rebuilt for GCC 5 C++11 ABI change
- move libpulsedsp plugin to -libs, avoids -utils multilib (#891425)
- 6.99.2 (#1262579)
- autostart.patch: fix stdout/stderr redirection
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- pulseaudio-7.99.2 (#1297774)
- Fix pa crashing on Bay- and Cherry-Trail devices
- fixed bz#1580853, FTBFS
- SBC is needed only when BlueZ is used
- use %tests macro, enable systemd socket activation (#1265720)
- apply srbchannel patch
- pulseaudio-6.0 (#1192384)
- fix changelog
- backport some alsa-mixer related fixes (#1492344)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- 5.0 (#1072259)
- pulseaudio-2.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- respin disable_flat_volumes.patch harder
- respin disable_flat_volumes.patch
- disable make check on PPC* (rhbz #1067470)
- alsa-mixer: Fix the analog-output-speaker-always path
- webrtc-aec is x86 and ARM only for now
- always run tests, but don't fail the build on big endian arches (relates #1067470)
- use %license, %ldconfig_scriptlets
- use better upstream patch for exit-idle-time
- Fix dbus-python dependency
- enable libsoxr support
- Update to git snapshot bf9b3f0 for BlueZ 5 support
- pulseaudio-3.99.1 (#952594)
- RFE: Restore the pipe-sink and pipe-source modules (#958949)
- prune (pre 1.x) changelog
- backport srbchannel crasher fix
- -libs: Obsoletes: pulseaudio-libs-zeroconf
- use versioned Obsoletes/Provides
- tighten subpkg deps via %_isa
- remove autoconf/libtool hackery
- Own the %{_libdir}/pulseaudio dir.
- Fix bogus %changelog dates.
- rebuild for libudev1
- rtp-recv: fix crash on empty UDP packets (CVE-2014-3970,#1104835,#1108011)
- name HDMI outputs uniquely
- re-enable webrtc support (arm,x86_64 only for now)
- X-KDE-autostart-phase=1
- artificially bump Release to 100, to ensure upgrade path
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- pull a few more patches from upstream stable-3.x branch
pulseaudio-libs-glib2-14.0-4.el8.x86_64.rpm | - 6.99.1 (#1257770)
- pulseaudio-10.99.1 (#1474559)
- default.pa: fix for renamed modules (#908117)
- actually install new dell-dock-tb16-usb-audio.conf alsa profile (#1492344)
- handle jack/lirc modules better (#1056619)
- -libs-devel: own some dirs to avoid deps on cmake/vala
- -module-bluetooth: make dep arch'd for consistency
- pulseaudio 6.0 breaks 5.1 network sound configuration (#1230957)
- include experiemental Intel HDMI LPE fixes (fdo#100488)
- Move module-jackdbus-detect.so to -module-jack subpackage with the
rest of the jack modules
- fix the with_webrtc condition
- pulseaudio-5.99.2 (6.0-rc2)
- [RFE] Build with libcap (#969232)
- %check: make non-fatal, echo test-suite.log on failure (#1345826)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- own /var/run/pulse (#1173811)
- Obsoletes: padevchooser < 1.0
- Bring in Lennart's patch from f17
- Temporary fix for CK/systemd move (#794690)
- New 4.0 stable release
- http://www.freedesktop.org/wiki/Software/PulseAudio/Notes/4.0/
- Rebuild (libjson-c)
- pulseaudio-8.0 (#1301040)
- BR: gcc-c++
- pulseaudio-2.0
- Add pulseaudio-daemon' Provides + Conflicts only on fedora
- Resolves: rhbz#1924094
- Fix RHEL build
- Add patch for profile switching
- Resolves: rhbz#2052011. rhbz#2073877
- pulseaudio-9.0
- Update to today's git snapshot
- Backport a patch for pulseaudio crash at startup (#1000966)
- PulseAudio 2.99.3 (3.0 rc3)
- omit -gdm-hooks, moved to gdm (f28+)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- pulseaudio-7.1 (#1276811)
- don't mark .desktop and dbus configurations as %config
- Fix the build on RHEL
- pulseaudio-8.99.2
- better autostart.patch, handle case were autospawn is disabled (or otherwise doesn't work, like for root user)
- use %make_build, %make_install
- enable systemd socket/service activation on f28+ (and disable autospawn)
- Update to 10.0
- pulseaudio-11.0
- Don't load the ck module in gdm, either
- -qpaeq subpkg (#1002585)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- enable hardened build (#983606)
- Add flatpak access control
- Fix for building with gcc 4.7
- snapshot, with wip bt headset2 patches (#1045548,#1067470)
- Enable webrtc-aec
- pulseaudio-3.99.2 (#966631)
- backport 'pa_sink_input_assert_ref()' crashfix (#1472285)
- --disable-tcpwrap on f28+ (#1518777)
- Remove /var/run/pulse and /var/lib/pulse, they are directories in tmpfs
- exit-idle-time = 4 (#1510301)
- f28+ ftbfs: memfd_create conflicts
- drop getaffinity.patch (no longer needed)
- enable webrtc support for all archs
- make tests non-fatal on i686,s390x
- Fix port to qt5.
- Resolves: rhbz#1591134
- PulseAudio doesn't load locales (fdo#92142)
- Rebuilt once more for libjson-c
- experimental fixes bluetooth profile switching (f28+ only, fdo#93898)
- Rebuild with binutils fix for ppc64le (#1475636)
- --disable-systemd-daemon, revert to autospawn mode
- 20141103 327-gaec81 snapshot, pulseaudio socket activation support
- use bash completionsdir
- Use the statically allocated UID and GID from /usr/share/doc/setup/uidgid (#1056656)
- The pulse-rt group doesn't exist (#885020)
- enable %check
- fix bz#1345826, only start threads on activ CPUs
- pulseaudio-5.99.3 (6.0-rc3) (#1184850)
- BR: automake libtool (for bootstrap.sh)
- Really add pulse-rt group when needed (bug #885020)
- 4.99.4
- fresh snapshot
- Add xauthority parameter to X11 modules
- Fix compilation against newer alsa-lib
- Resolves: rhbz#1723065
- Use python3 version of qt5
- Resolves: rhbz#1591134
- New upstream release
- 4.99.3
- backport upstream fixes: memfd, qpape PyQt5 port
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- 4.99.2 (#1057528)
- pulseaudio-9.99.1 (#1409939)
- %check: use %_smp_mflags
- rebuilt for json-c-0.9-4.fc17
- pulseaudio-8.99.1 (#1335527)
- disable webrtc support for now (waiting on #1335536)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- skip patch93, seems to cause crashes w/headphone jacks (#1544507,#1551270,#1554035)
- Escape macros in %changelog
- Fixup ldconfig scriptlets
- pulseaudio-7.99.1 (8.0 rc1) (#1294555)
- Update to 13.99.1
- Resolves: rhbz#1817378
- duplicate directory between pulseaudio and pulseaudio-libs (#909690)
- pulseaudio-3.0
- fix PACKAGE_VERSION
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- ship a single autostart file
- RFE: Disable PulseAudio's flat volumes f24+ (#1265267)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- %build fix typo, explicitly --enable-tests
- pulseaudio-11.1
- fix resampler-related build dependencies (libsamplerate/speex) (#1239208)
- pulseaudio-5.99.1 (6.0-rc1)
- Provide padsp-32, /usr/bin/padsp is native arch only (#856146)
- Update to 14.0
- Add pulseaudio-daemon' Provides + Conflicts to support
swapping with PipeWire
- Resolves: rhbz#1906322
- Pulse Audio settings lost after reboot / HDMI is set as default (#1035025)
- Enable pulseaudio-module-bluetooth on s390x
- manually package sockets.target.wants/pulseaudio.socket to help
handle socket activation on upgrades
- Add patch to avoid bluez warning.
- Resolves: rhbz#1969944
- drop Requires: kernel (per recent -devel ml thread)
- pulseaudio-7.0
- Rebuilt for GCC 5 C++11 ABI change
- move libpulsedsp plugin to -libs, avoids -utils multilib (#891425)
- 6.99.2 (#1262579)
- autostart.patch: fix stdout/stderr redirection
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- pulseaudio-7.99.2 (#1297774)
- Fix pa crashing on Bay- and Cherry-Trail devices
- fixed bz#1580853, FTBFS
- SBC is needed only when BlueZ is used
- use %tests macro, enable systemd socket activation (#1265720)
- apply srbchannel patch
- pulseaudio-6.0 (#1192384)
- fix changelog
- backport some alsa-mixer related fixes (#1492344)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- 5.0 (#1072259)
- pulseaudio-2.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- respin disable_flat_volumes.patch harder
- respin disable_flat_volumes.patch
- disable make check on PPC* (rhbz #1067470)
- alsa-mixer: Fix the analog-output-speaker-always path
- webrtc-aec is x86 and ARM only for now
- always run tests, but don't fail the build on big endian arches (relates #1067470)
- use %license, %ldconfig_scriptlets
- use better upstream patch for exit-idle-time
- Fix dbus-python dependency
- enable libsoxr support
- Update to git snapshot bf9b3f0 for BlueZ 5 support
- pulseaudio-3.99.1 (#952594)
- RFE: Restore the pipe-sink and pipe-source modules (#958949)
- prune (pre 1.x) changelog
- backport srbchannel crasher fix
- -libs: Obsoletes: pulseaudio-libs-zeroconf
- use versioned Obsoletes/Provides
- tighten subpkg deps via %_isa
- remove autoconf/libtool hackery
- Own the %{_libdir}/pulseaudio dir.
- Fix bogus %changelog dates.
- rebuild for libudev1
- rtp-recv: fix crash on empty UDP packets (CVE-2014-3970,#1104835,#1108011)
- name HDMI outputs uniquely
- re-enable webrtc support (arm,x86_64 only for now)
- X-KDE-autostart-phase=1
- artificially bump Release to 100, to ensure upgrade path
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- pull a few more patches from upstream stable-3.x branch
python-qt5-rpm-macros-5.15.0-3.el8.noarch.rpm | - 5.4
- 5.5
- python3: (Build)Requires: python3-dbus
- Rebuild (binutils)
Resolves: bz#1949066
- New base sub package to provide QtBase only (RHBZ#1394626)
- New requirement from the main package to the base sub package
- BR: python2-devel, use %__python2 macro
- Rebuild with binutils fix for ppc64le (#1475636)
- fix python3-qt5-webkit name
- 5.13.1
Resolves: bz#1775603
- -rpm-macros: Conflicts: python(3)-qt5 < 5.6
- rebuild (qt5)
- %description: mention PyQt5
- Provides: PyQt5
- fixed bz#1348507 - Arbitrary code execution due to insecure loading
of Python module from CWD
- 5.9.1
- rebuild (sip)
- restore qtwebengine support
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Enabled QtWebEngine for Fedora >= 24
- fix python3-qt5-webengine name
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- Rebuild (Qt 5.15.3)
Resolves: bz#2061729
- Update to 5.10.1 andd rop dependency on qt5-qtwebkit and qt5-qtwebengine
- rebuild (qt5)
- rebuild (f21-python)
- +Qt5Positioning,Qt5Sensors support
- rebuild (sip)
- rebuild (sip), re-enable -webengine for secondary archs
- 5.5.1
- enable qtenginio, fix pyuic5 wrapper, use %license
- rebuild (qt5)
- 5.4.2
- python3-qt5-devel subpkg
- PyQt-gpl-5.3.1
- PyQt5-5.7.1
- PyQt-5.2.1
- PyQt5-5.8.2
- rebuild (qt5)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- -devel: restore dep on base pkg
- PyQt5-5.10
- move -devel binaries to main pkg(s) (#1422613)
- add missing -webengine/-webkit descriptions
- better python3-qt5-devel description
- try to determine dbus-python install paths dynamically (#1161121)
- Rebuild for Python 3.6
- restore python3 support
- explicitly support Qt5 newer than just 5.9.3 (+5.9.4,5.10.0,5.10.1)
- fix pyrcc5 wrapper typo
- PyQt-5.2
- rebuild (sip)
- rebuild (qt5)
- Cleanup spec file conditionals
- python3-qt5: omit sip files inadvertantly added in 5.7.1-5
- Add patch to fix python3 sip installation dir (#1228432)
- BR: sip + sync with Fedora
- PyQt5-5.7
- (temp) disable -webengine support
- rebuild against new qt5-qtbase-5.7.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- PyQt-gpl-5.3.2
- rebuild (sip)
- python3-qt5 support
- Drop dependency on qt5-qtenginio
- -webengine,-webkit subpkgs
- Rebuild against fixed qt5-qtbase to fix -debuginfo (#1065636)
- rebuild (qt5)
- add Obsoletes for misnamed -webengine/-webkit pkgs (#1315025)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- PyQt5-5.11 + sync with Fedora
- Drop dependency on phonon and python2 support
- enable -webengine on f25+
- pkgconfig(QtOpenGL) being satisfied by qt4 devel (#1162415)
- drop ppc ppc64 ppc64le, it's not supported yet
- python-qt5 is not built with $RPM_OPT_FLAGS (#1314998)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- explicitly set CFLAGS,CXXFLAGS,LFLAGS
- +macros.pyqt5
- limit -webengine support to just primary archs (for now)
- rebuild (qt5)
- PyQt5-5.6
- 5.9.2
- rebuild
- 5.15.0
Resolves: bz#1949066
- rebuild (sip)
- Build failure in sipQtWebKitWidgestQWebInspector: qprinter.h not found (#1160932)
- python2_sitelib should be python2_sitearch (#1161121)
- 5.4.1
- restore -webengine
- fixed bz#1348507, pyqt5 with python2 in isolated mode
- Rebuild again for Python 3.6
- PyQt5-5.8.1
- PyQt5-5.8
- -rpm-macros subpkg
- add wrappers for pyrcc5,pylupdate5 (#141116,#1415812)
- update provides filtering
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- rebuild (qt5)
- use safer subdir builds
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- BR: qt5-qtbase-private-devel
- python3-qt5: add versioned qt5 dep (like base python-qt5 pkg has)
- (temporarily) omit webengine support on fc26
- rebuild (qt5-qtenginio)
- rebuild (qt5-qtbase), disable -webengine (temp on f25, until fixed)
- License: GPLv3 (#1520186)
- rebuild (qt5)
- 5.11.2 + sync with Fedora
- wrong python release used in pyuic5 launch script (#1193107)
- -doc: add qsci doc QyQt5.api content
- enable Qt5WebChannel/Qt5WebSockets support
- ensure .so modules are executable (for proper -debuginfo extraction)
- -webengine: add ExclusiveArch (matching qt5-qtwebengine's)
- PyQt5-5.9
- Rebuilt for GCC 5 C++11 ABI change
- rebuild (qt5), Provides: python2-qt5
- PyQt-gpl-5.3
- +Qt5Bluetooth,Qt5Quick,Qt5SerialPorts support
python3-augeas-0.5.0-12.el8.noarch.rpm | - version 0.4.1
- include egg only on F-9, RHEL-6 and later
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- add python-ctypes dependency (rhbz#1020239)
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Modernize spec
- Fix python3 package file ownership
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- new version
- wildcard to catch egg-info in case it is build
- switched to noarch, dlopen/ python bindings
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- initial version
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Version 0.5.0 release
- Run the tests during the build (RHBZ#1682268).
- Rebuild for Python 3.6
- use %global instead of %define
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- version 0.3.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- version to import in CVS (rhbz#444945)
- Rebuild for Python 2.6
- version 0.2.1
- Added Python 3 subpackage
- Rebuilt for Python3.5 rebuild
- set mode of _augeas.so to 0755
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- only include egg-info, if fedora >=9 or rhel >= 6
Resolves: rhbz#661452
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
python3-gssapi-1.5.1-5.el8.x86_64.rpm | - Add gcc to build-deps
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Initial Packaging
- Prepare for release 1.5.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- New upstream version 1.1.4
- Resolves #1286458
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Fix problem where gss_display_status can infinite loop
- Move to autosetup and rpm-git-tree
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Bump NVR to re-run our useless gating
- Resolves: #1715040
- Conditionalize the python2 subpackage
- Gating can't be bothered to check my BuildRequires
- Resolves: #1715040
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- New minor release.
- Add gating tests
- Resolves: #1682269
- Prepare for release 1.4.1
- Rebuild for Python 3.6
- Rebuilt for Python3.5 rebuild
- New upstream release v1.3.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- New upstream version 1.2.0
- New minor release.
- Resolves #1254458
- Fixes a crash bug when inquiring incomplete security contexts
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Update spec file from Fedora
- Resolves: #1715040
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Python 2 binary package renamed to python2-gssapi
See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
- Fix tox dependency
- New upstream minor release
- Remove warning about collections ABCs on python3.7
- Resolves: #1594834
python3-ipaclient-4.9.13-20.module+el8.10.0+2067+377bdd64.noarch.rpm | - Resolves: #846033 [RFE] Documentation for JSONRPC IPA API
- Resolves: #989091 Ability to manage IdM/IPA directly from a standard LDAP
client
- Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
users in IdM
- Resolves: #1115294 [RFE] Add support for DNSSEC
- Resolves: #1145748 [RFE] IPA running with One Way Trust
- Resolves: #1199520 [RFE] Introduce single upgrade tool - ipa-server-upgrade
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Resolves: #1200728 [RFE] Replicate PKI Profile information
- Resolves: #1200735 [RFE] Allow issuing certificates for user accounts
- Resolves: #1204054 SSSD database is not cleared between installs and
uninstalls of ipa
- Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
Trusts
- Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
- Resolves: #1204504 [RFE] Add access control so hosts can create their own
services
- Resolves: #1206534 [RFE] Offer Kerberos over HTTP (kdcproxy) by default
- Resolves: #1206613 [RFE] Configure IPA to be a trust agent by default
- Resolves: #1209476 package ipa-client does not require package dbus-python
- Resolves: #1211589 [RFE] Add option to skip the verify_client_version
- Resolves: #1211608 [RFE] Generic support for unknown DNS RR types (RFC 3597)
- Resolves: #1215735 ipa-replica-prepare automatically adds a DNS zone
- Resolves: #1217010 OTP Manager field is not exposed in the UI
- Resolves: #1222475 krb5kdc : segfault at 0 ip 00007fa9f64d82bb sp
00007fffd68b2340 error 6 in libc-2.17.so
- Related: #1204809 Rebase ipa to 4.2
- Update to upstream 4.2.0
- Move /etc/ipa/kdcproxy to the server subpackage
- Hardening for CVE-2020-25717
- Rebuild against samba-4.14.5-11.el8
- Resolves: RHBZ#2021443
- PKI database is ugraded during replica installation (#1075118)
- Resolves: #1254689 Storing big file as a secret in vault raises traceback
- vault: Limit size of data stored in vault
- Resolves: #1255880 ipactl status should distinguish between different
pki-tomcat services
- ipactl: Do not start/stop/restart single service multiple times
- Upstream pre release FreeIPA 4.9.0rc3
Related: RHBZ#1891832
- Updated to upstream 3.0.0 GA
- Set minimum for samba to 4.0.0-153.
- Make sure server-trust-ad subpackage alternates winbind_krb5_locator.so
plugin to /dev/null since they cannot be used when trusts are configured
- Restrict krb5-server to 1.10.
- Update BR for 389-ds-base to 1.3.0
- Add directory /var/lib/ipa/pki-ca/publish for CRL published by pki-ca
- Add Requires on zip for generating FF browser extension
- Resolves: #1614301 Remove --no-sssd and --noac options
- Resolves: #1613879 Disable Domain Level 0
- New patch sets to disable domain level 0
- New adapted patch to disable DL0 specific tests (pytest_ipa vs.
pytest_plugins)
- Adapted branding patch in ipa-replica-install.1 due to DL0 removal
- Set mode of /etc/ipa/ca.crt to 0644 in CA-less installations
Resolves: RHBZ#1870202
- Resolves: #1475238 Use CommonNameToSANDefault in default profile
(new installs only)
- Restore old version of caIPAserviceCert for upgrade only
- Remove ipa-server-selinux obsoletes as upgrades from version prior to
3.3.0 are not allowed
- Wrap server-trust-ad subpackage description better
- Add (noreplace) flag for %{_sysconfdir}/tmpfiles.d/ipa.conf
- Change permissions on default_encoding_utf8.so to fix ipa-python Provides
- Use default crypto policy for TLS and enable TLS 1.3 support
Resolves: RHBZ#1777809
- Covscan fixes
Resolves: RHBZ#1777920
- Change pki_version to 10.8.0
Related: RHBZ#1748987
- Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
- Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
- Related: #1356134 'kinit -E' does not work for IPA user
- Add bash completion script and own /etc/bash_completion.d in case it
doesn't already exist
- Bump up minimum version of python-nss to pick up nss_is_initialize() API
- Updated to upstream 3.0.0 beta 1
- Resolves: #1416454 replication race condition prevents IPA to install
- wait_for_entry: use only DN as parameter
- Wait until HTTPS principal entry is replicated to replica
- Use proper logging for error messages
- Unable to remove replica by ipa-replica-manage (#1001662)
- Before uninstalling a server, warn about active replicas (#998069)
- Move initialization of Guests mapping after cifs/ principal is created
- Related: rhbz#1623895
- Upstream release FreeIPA 4.9.1
Related: RHBZ#1891832
- Fix mapping of BUILTIN\Guests to 'nobody' group during upgrade
to not use generated Samba config at this point
- Related: rhbz#1623895
- Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
- Increase default timeout for IPA services (#1033273)
- Error while running trustdomain-find (#1054376)
- group-show lists SID instead of name for external groups (#1054391)
- Fix IPA server NetBIOS name in samba configuration (#1030517)
- dnsrecord-mod produces missing API version warning (#1054869)
- Hide trust-resolve command as internal (#1052860)
- Add Trust domain Web UI (#1054870)
- ipasam cannot delete multiple child trusted domains (#1056120)
- Require 389-ds-base-legacy-tools for setup tools
- ipatests: Update ipa-adtrust-install test
Resolves: RHEL-40894
- Conditionally restart also dirsrv and httpd when upgrading
- IPA extdom plugin fails when encountering large groups (#1193759)
- CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
(#1202998)
- Added auto* BuildRequires
- Added httpd SELinux policy so CRLs can be read
- Revert DNSResolver Fix use of nameservers with ports.
Related: RHBZ#2141316
- Fix NetBIOS name generation in CLDAP plugin (#1030517)
- ipa-kdb: Fix double free in ipadb_reinit_mspac()
Resolves: RHEL-25742
- kra: set RSA-OAEP as default wrapping algo when FIPS is enabled
Resolves: RHEL-12153
- Vault: improve vault server archival/retrieval calls error handling
Resolves: RHEL-12153
- Vault: add support for RSA-OAEP wrapping algo
Resolves: RHEL-12153
- Fix postin scriplet for F-15/F-16
- Deletion of active subdomain range should not be allowed (#1075615)
- Fallback to global policy in ipa lockout plugin (#912725)
- Migration does not add users to default group (#903232)
- ipa-kdb: Make AD-SIGNEDPATH optional with krb5 DAL 8 and older
Resolves: RHEL-12198
- Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
tracked
- cert renewal: Include KRA users in Dogtag LDAP update
- cert renewal: Automatically update KRA agent PEM file
- Resolves: #1257163 renaming certificatte profile with --rename option leads
to integrity issues
- certprofile: remove 'rename' option
- Resolves: #1257968 kinit stop working after ipa-restore
- Backup: back up the hosts file
- Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
- DNSSEC: remove "DNSSEC is experimental" warnings
- Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
- Installer: do not modify /etc/hosts before user agreement
- Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
zone
- DNSSEC: backup and restore opendnssec zone list file
- DNSSEC: remove ccache and keytab of ipa-ods-exporter
- DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
- DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
- DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
key master
- DNSSEC: Fix key metadata export
- DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
- Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
- Using LDAPI to setup CA and KRA agents.
- Resolves: #1259848 server closes connection and refuses commands after
deleting user that is still logged in
- ldap: Make ldap2 connection management thread-safe again
- Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
'ra_certprofile' while ipa-ca-install
- load RA backend plugins during standalone CA install on CA-less IPA master
- Remove dependency on nss_ldap/nss-pam-ldapd
- The official client is sssd and that's what we use by default.
- Resolves: #1461177 ipa-otptoken-import - XML file is missing PBKDF2
parameters!
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
search in cn=ad, cn=trusts,dc=example,dc=com
- Resolves: #1467887 iommu platform support for ipxe
- Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic key for
host
- Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
4.5
- Resolves: #1480102 ipa-server-upgrade failes with "This entry already
exists"
- Resolves: #1482802 Unable to set ca renewal master on replica
- Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
(ipa-server-upgrade)
- Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
thus startup of Web UI fails
- Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
to self-signed CA
- Resolves: #1469246 Replica install fails to configure IPA-specific
temporary files/directories
- Resolves: #1469480 bind package is not automatically updated during
ipa-server upgrade process
- Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
installs only)
- Resolves: #1477703 IPA upgrade fails for latest ipa package
- Prevent multilib failures in *.pyo and *.pyc files
- Update dependencies for samba, 389-ds and sssd
Resolves: RHBZ#1792848
- Remove v1-style /etc/ipa/ipa.conf, replacing with /etc/ipa/default.conf
- Removed python-asset based webui
- Improve server affinity for CA-less deployments
Resolves: RHEL-22283
- host: update system: Manage Host Keytab permission
Resolves: RHEL-22286
- adtrustinstance: make sure NetBIOS name defaults are set properly
Resolves: RHEL-21938
- ipatests: Fix healthcheck report when nsslapd accesslog logbuffering is set to off
Resolves: RHEL-19672
- Resolves: #1377973 ipa-server-install fails when the provided or resolved
IP address is not found on local interfaces
- Only warn when specified server IP addresses don't match intf
- Resolves: #1438016 gssapi errors after IPA server upgrade
- Bump version of python-gssapi
- Resolves: #1457942 certauth: use canonical principal for lookups
- ipa-kdb: use canonical principal in certauth plugin
- Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
breaking older clients
- Add code to be able to set default kinit lifetime
- Revert setting sessionMaxAge for old clients
- Add missing entry for /var/cache/ipa/kpasswd (444624)
- Added patch to fix permissions problems with the Apache NSS database.
- Added patch to fix problem with DNS querying where the query could be
returned as the answer.
- Fix spec error where patch1 was in the wrong section
- Update to upstream 3.3.3 (#991064)
- Rebuild against samba4 beta7
- [WebUI] IPA Error 3007: RequirmentError" while adding members in
"User ID overrides" tab (updated)
Resolves: RHBZ#1757045
- ipa-client-install: use the authselect backup during uninstall
Resolves: RHBZ#1810179
- Replace SSLCertVerificationError with CertificateError for py36
Resolves: RHBZ#1858318
- Fix AVC denial during ipa-adtrust-install --add-agents
Resolves: RHBZ#1859213
- ipa-server-install fails if --subject parameter is other than default
realm (#983075)
- do not allow configuring bind-dyndb-ldap without persistent search (#967876)
- Lockout plugin crashed during ipa-server-install (#912725)
- Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
- ldap: limit the retro changelog to dns subtree
- Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
of "CA:FALSE" IPA CA CSR
- Include the CA basic constraint in CSRs when renewing a CA
- Resolves: #1493145 ipa-replica-install might fail because of an already
existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
- Checks if replica-s4u2proxy.ldif should be applied
- Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
- ds: ignore time skew during initial replication step
- ipa-replica-manage: implicitly ignore initial time skew in force-sync
- Resolves: #1500218 Replica installation at domain-level 0 fails against
upgraded ipa-server
- Fix ipa-replica-conncheck when called with --principal
- Resolves: #1506188 server-del doesn't remove dns-server configuration
from ldap
- Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
- Fix an integer underflow bug in libotp
- Resolves: #1262996 ipa vault internal error on replica without KRA
- install: always export KRA agent PEM file
- vault: select a server with KRA for vault operations
- Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
- do not overwrite files with local users/groups when restoring authconfig
- Renamed patch 1011 to 0138, as it was merged upstream
- Resolves: #1469246 Replica install fails to configure IPA-specific
temporary files/directories
- replica install: drop-in IPA specific config to tmpfiles.d
- Resolves: #1469480 bind package is not automatically updated during
ipa-server upgrade process
- Bumped Required version of bind-dyndb-ldap and bind package
- Set minimum version of sssd to 1.5.1
- Update to upstream freeipa-2.0.0.rc1
- Move server-only binaries from admintools subpackage to server
- Resolves: #1455946 Provide a tooling automating the configuration
of Smart Card authentication on a FreeIPA master
- smart-card advises: configure systemwide NSS DB also on master
- smart-card advises: add steps to store smart card signing CA cert
- Allow to pass in multiple CA cert paths to the smart card advises
- add a class that tracks the indentation in the generated advises
- delegate the indentation handling in advises to dedicated class
- advise: add an infrastructure for formatting Bash compound statements
- delegate formatting of compound Bash statements to dedicated classes
- Fix indentation of statements in Smart card advises
- Use the compound statement formatting API for configuring PKINIT
- smart card advises: use a wrapper around Bash `for` loops
- smart card advise: use password when changing trust flags on HTTP cert
- smart-card-advises: ensure that krb5-pkinit is installed on client
- Resolves: #1475238 Use CommonNameToSANDefault in default profile
(new installs only)
- Add CommonNameToSANDefault to default cert profile
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s
during search in cn=ad,cn=trusts,dc=example,dc=com
- NULL LDAP context in call to ldap_search_ext_s during search
- Fixed share/ipa/wsgi.py so .pyc, .pyo files are included
- No need to create /var/log/ipa_error.log since we aren't using
TurboGears any more.
- Update to upstream 2.1.0
- Upstream pre release FreeIPA 4.9.0rc2
Related: RHBZ#1891832
- Synchronize spec file with upstream and Fedora
Related: RHBZ#1891832
- Traceback while doing ipa-backup
Resolves: RHBZ#1901068
- ipa-client-install changes system wide ssh configuration
Resolves: RRBZ#1544379
- ipa-kdb: support subordinate/superior UPN suffixes
Resolves: RHBZ#1891056
- KRA Transport and Storage Certificates do not renew
Resolves: RHBZ#1872603
- Move where the restore state is marked during IPA server upgrade
Resolves: RHBZ#1569011
- Intermittent IdM Client Registration Failures
Resolves: RHBZ#1812871
- Nightly test failure in test_acme.py::TestACME::test_third_party_certs
(updates-testing)
Resolves: RHBZ#1903025
- Add IPA RA Agent to ACME group on the CA
Resolves: RHBZ#1902727
- Resolves: #1356102 Server uninstall does not stop tracking lightweight sub-CA
with certmonger
- uninstall: untrack lightweight CA certs
- Resolves: #1351807 ipa-nis-manage config.get_dn missing
- ipa-nis-manage: Use server API to retrieve plugin status
- Resolves: #1353452 ipa-compat-manage command failed,
exception: NotImplementedError: config.get_dn()
- ipa-compat-manage: use server API to retrieve plugin status
- Resolves: #1353899 ipa-advise: object of type 'type' has no len()
- ipa-advise: correct handling of plugin namespace iteration
- Resolves: #1356134 'kinit -E' does not work for IPA user
- kdb: check for local realm in enterprise principals
- Resolves: #1353072 ipa unknown command vault-add
- Enable vault-* commands on client
- vault-add: set the default vault type on the client side if none was given
- Resolves: #1353995 Default CA can be used without a CA ACL
- caacl: expand plugin documentation
- Resolves: #1356144 host-find should not print SSH keys by default, only
SSH fingerprints
- host-find: do not show SSH key by default
- Resolves: #1353506 ipa migrate-ds command fails for IPA in RHEL 7.3
- Removed unused method parameter from migrate-ds
- Expand the token auth/sync windows (#919228)
- Access is not rejected for disabled domain (#1172598)
- krb5kdc crash in ldap_pvt_search (#1170695)
- RHEL7.1 IPA server httpd avc denials after upgrade (#1164896)
- Ensure that /etc/ipa exists before moving user-modifiable html files there
- Put html files into /etc/ipa/html instead of /etc/ipa
- Replica CA installation: ignore skew during initial replication
Resolves RHEL-80995
- Update to upstream version 1.1.0
- Patch for indexing memberof attribute
- Patch for indexing uidnumber and gidnumber
- Patch to change DNA default values for replicas
- Patch to fix uninitialized variable in ipa-getkeytab
- Fix --external-ca-profile not passed to CSR
Resolves: RHBZ#1731813
- Upgrade: fix replica agreement, fix backported patch
Related: RHBZ#2216551
- Enforce uniqueness across krbprincipalname and krbcanonicalname
ipa-kdb: enforce PAC presence on TGT for TGS-REQ
ipatests: extend test for unique krbcanonicalname
Resolves: RHEL-110061
- Resolve: #1455946 Provide a tooling automating the configuration
of Smart Card authentication on a FreeIPA master
- server certinstall: update KDC master entry
- pkinit manage: introduce ipa-pkinit-manage
- server upgrade: do not enable PKINIT by default
- Extend the advice printing code by some useful abstractions
- Prepare advise plugin for smart card auth configuration
- Resolve: #1461053 allow to modify list of UPNs of a trusted forest
- trust-mod: allow modifying list of UPNs of a trusted forest
- WebUI: add support for changing trust UPN suffixes
- Rebuilt for glibc bug#747377
- Update to upstream freeipa-2.0.0.rc2
- Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
- Set minimum version of sssd to 1.5.1
- Patch to include SuiteSpotGroup when setting up 389-ds instances
- Move a lot of BuildRequires so this will build with ONLY_CLIENT enabled
- Added support for ipa_kpasswd and ipa_pwd_extop
- Rebase to upstream release 4.8.4
- Removed upstream patches 0001 to 0008 that are part of version 4.8.3-3
Resolves: RHBZ#1782658
Resolves: RHBZ#1782169
Resolves: RHBZ#1783046
Related: RHBZ#1748987
- Update to upstream GA release
- Automatically apply updates when the package is upgraded
- Remove ipa_webgui, its functions rolled into ipa_httpd
- kdb: keeep ipadb_get_connection() from succeding with null LDAP context
Resolves: RHEL-58453
- CVE-2019-14867: Denial of service in IPA server due to wrong use of ber_scanf()
Resolves: RHBZ#1767304
- CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
Resolves: RHBZ#1776939
- Removed python-cherrypy from BuildRequires and Requires
- Added Requires python-assets, python-wehjit
- Resolves: #1609883 ipaserver/plugins/cert.py: Add reason to raise of
errors.NotFound
- Resolves: #1615765 do-not-use-RC4-in-FIPS-mode
- Move fips_enabled to a common library to share across different plugins
- ipasam: do not use RC4 in FIPS mode
- Marked with wrong license. IPA is GPLv2.
- Update to upstream 3.2.0 Prerelease 1
- Use upstream reference spec file as a base for Fedora spec file
- Change Requires from fedora-ds-base to 389-ds-base
- Set minimum level of 389-ds-base to 1.2.6 for the replication
version plugin.
- Resolves: #747612 [RFE] IPA should support and manage DNS sites
- Resolves: #826790 Disabling password expiration (--maxlife=0 and --minlife=0)
in the default global_policy in IPA sets user's password expiration
(krbPasswordExpiration) to be 90 days
- Resolves: #896699 ipa-replica-manage -H does not delete DNS SRV records
- Resolves: #1084018 [RFE] Add IdM user password change support for legacy
client compat tree
- Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
aliases)
- Fix incorrect check for principal type when evaluating CA ACLs
- Resolves: #1146860 [RFE] Offer OTP generation for host enrollment in the UI
- Resolves: #1238190 ipasam unable to lookup group in directory yet manual
search works
- Resolves: #1250110 search by users which don't have read rights for all attrs
in search_attributes fails
- Resolves: #1263764 Show Certificate displays in useless format
- Resolves: #1272491 [WebUI] Certificate action dropdown does not display all
the options after adding new certificate
- Resolves: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.4.0
- Resolves: #1294503 IPA fails to issue 3rd party certs
- Resolves: #1298242 [RFE] API compatibility - compatibility of clients
- Resolves: #1298848 [RFE] Centralized topology management
- Resolves: #1298966 [RFE] Extend Smart Card support
- Resolves: #1315146 Multiple clients cannot join domain simultaneously:
/var/run/httpd/ipa/clientcaches race condition?
- Resolves: #1318903 ipa server install failing when SUBCA signs the cert
- Resolves: #1319003 ipa-winsync-migrate: Traceback should be fixed with proper
console output
- Resolves: #1324055 IPA always qualify requests for admin
- Resolves: #1328552 [RFE] Allow users to authenticate with alternative names
- Resolves: #1334582 Inconsistent UI and CLI options for removing certificate
hold
- Resolves: #1346321 Exclude o=ipaca subtree from Retro Changelog (syncrepl)
- Resolves: #1349281 Fix `Conflicts` with ipa-python
- Resolves: #1350695 execution of copy-schema script fails
- Resolves: #1351118 upgrade failed for RHEL-7.3 from RHEL-7.2.z
- Resolves: #1351153 AVC seen on Replica during ipa-server upgrade test
execution to 7.3
- Resolves: #1351276 ipa-server-install with dns cannot resolve itself to
create ipa-ca entry
- Related: #1343422 [RFE] Add GssapiImpersonate option
- Pull upstream changelog 698
- Fix ownership of /var/log/ipa_error.log during install (435119)
- Add pwpolicy command and man page
- Fix requirement for python3-kdcproxy, add no autoreqprov for ipatests sub
package
Related: RHBZ#1891832
- ipa-csreplica-manage connect fails (#1157735)
- error message which is not understandable when IDNA2003 characters are
present in --zonemgr (#1163849)
- Fix warning message should not contain CLI commands (#1114013)
- Renewing the CA signing certificate does not extend its validity period end
(#1163498)
- RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
httpd (#1159330)
- Make sure ipa-server depends on krb5-kdb-version to pick up
right MIT Kerberos KDB ABI
Related: RHBZ#1700121
- User field separator uses '$$' within ipaSELInuxUserMapOrder
Fixes: RHBZ#1729099
- Require the Python interpreter directly instead of using the package name
- Related: rhbz#1619153
- DNS install check: Fix overlapping DNS zone from the master itself
Resolves: RHBZ#1784003
- Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
Trusts
- winsync-migrate: Convert entity names to posix friendly strings
- winsync-migrate: Properly handle collisions in the names of external groups
- Resolves: #1261074 Adjust Firefox configuration to new extension signing
policy
- webui: use manual Firefox configuration for Firefox >= 40
- Resolves: #1263337 IPA Restore failed with installed KRA
- ipa-backup: Add mechanism to store empty directory structure
- Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
and private key in world readable file [rhel-7.2]
- install: fix KRA agent PEM file permissions
- Resolves: #1265086 Mark IdM API Browser as experimental
- WebUI: add API browser is experimental warning
- Resolves: #1265277 Fix kdcproxy user creation
- install: create kdcproxy user during server install
- platform: add option to create home directory when adding user
- install: fix kdcproxy user home directory
- Resolves: #1265559 GSS failure after ipa-restore
- destroy httpd ccache after stopping the service
- Resolves: #1432630 python2-jinja2 needed for python2-ipaclient
- Remove csrgen
- Resolves: #1432903 Set GssProxy options to enable caching of ldap tickets
- Add options to allow ticket caching
- Update to upstream version 1.2.0
- Set fedora-ds-base minimum version to 1.1.3 for winsync header
- Set the minimum version for SELinux policy
- Remove references to Fedora 7
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650139
- Added support for libipa-dna-plugin
- Rebuild to samba 4.17.2.
Related: RHBZ#2132051
- Update to upstream 4.7.0 GA
- ipatests: fix TestOTPToken::test_check_otpd_after_idle_timeout
Related: RHBZ#2053024
- Resolves: #1477703 IPA upgrade fails for latest ipa package
- Restore old version of caIPAserviceCert for upgrade only
- Reinstalling ipa server hangs when configuring certificate
server (#1018804)
- Allow longer dirsrv startup with systemd:
- IPAdmin class will wait until dirsrv instance is available up to 10 seconds
- Helps with restarts during upgrade for ipa-ldap-updater
- Fix pylint warnings from F16 and Rawhide
- selinux don't audit rules deny fetching trust topology
Resolves: RHBZ#1845596
- fix iPAddress cert issuance for >1 host/service
Resolves: RHBZ#1846352
- Specify cert_paths when calling PKIConnection
Resolves: RHBZ#1849155
- Update crypto policy to allow AD-SUPPORT when installing IPA
Resolves: RHBZ#1851139
- Add version to ipa-idoverride-memberof obsoletes
Related: RHBZ#1846434
- Resolves: #1365858 ipa-ca-install fails on replica when IPA Master is
installed without CA
- Set up DS TLS on replica in CA-less topology
- Resolves: #1398600 IPA replica install fails with dirsrv errors.
- Do not configure PKI ajp redirection to use "::1"
- Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
ca-del, ca-disable and ca-enable commands
- ca: correctly authorise ca-del, ca-enable and ca-disable
- Rebuild for Python 2.6
- Allow ipa-tests to work with older version (1.7.7) of python-paramiko
- Resolves: #1477367 ipa-server-upgrade timeouts on wait_for_open ports
expecting IPA services listening on IPv6 ports
- Make sure upgrade also checks for IPv6 stack
- control logging of host_port_open from caller
- log progress of wait_for_open_ports
- Resolves: #1477243 ipa help command returns traceback when no cache
is present
- Store help in Schema before writing to disk
- Disable pylint in get_help function because of type confusion.
- Require samba packages instead of obsoleted samba4 packages
- Fixed License in specfile
- Include files from /usr/lib/python*/site-packages/ipaserver
- Set the N-V-R so rc1 is an update to beta2.
- Resolves: #1452216 Replica installation grants HTTP principal
access in WebUI
- Make sure we check ccaches in all rpcserver paths
- Mass rebuild 2013-12-27
- Drop Requires of python-krbV on ipa-client
- Resolves: #828866 [RFE] enhance --subject option for ipa-server-install
- Resolves: #1160555 ipa-server-install: Cannot handle double hyphen "--" in
hostname
- Resolves: #1286288 Insufficient 'write' privilege to the 'ipaExternalMember'
attribute
- Resolves: #1321652 ipa-server-install fails when using external certificates
that encapsulate RDN components in double quotes
- Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
revocation reasons
- Resolves: #1340880 ipa-server-install: improve prompt on interactive
installation
- Resolves: #1353841 ipa-replica-install fails to install when resolv.conf
incomplete entries
- Resolves: #1356104 cert-show command does not display Subject Alternative
Names
- Resolves: #1357511 Traceback message seen when ipa is provided with invalid
configuration file name
- Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
converted from CA-less to CA-full
- Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
- Resolves: #1367572 improve error message in ipa migrate-ds: mention ipa
config-mod --enable-migration=TRUE
- Resolves: #1367868 Add options to retrieve lightweight CA certificate/chain
- Resolves: #1371927 Implement ca-enable/disable commands.
- Resolves: #1372202 Add Users into User Group editors fails to show Full names
- Resolves: #1373091 Adding an auth indicator from the CLI creates an extra
check box in the UI
- Resolves: #1375596 Ipa-server WebUI - long user/group name show wrong error
message
- Resolves: #1375905 "Normal" group type in the UI is confusing
- Resolves: #1376040 IPA client ipv6 - invalid --ip-address shows traceback
- Resolves: #1376630 IDM admin password gets written to
/root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
- Resolves: #1376729 ipa-server-install script option --no_hbac_allow should
match other options
- Resolves: #1378461 IPA Allows Password Reuse with History value defined when
admin resets the password.
- Resolves: #1379029 conncheck failing intermittently during single step
replica installs
- Resolves: #1379858 [RFE] better debugging for ipa-replica-conncheck
- Resolves: #1384310 ipa dnsrecord-add fails with Keyerror stack trace
- Resolves: #1392778 Update man page for ipa-adtrust-install by
removing --no-msdcs option
- Resolves: #1392858 Rebase to FreeIPA 4.5+
- Rebase to 4.5.0
- Resolves: #1399133 Delete option shouldn't be available for hosts applied to
view.
- Resolves: #1399190 [RFE] Certificates issued by externally signed IdM CA
should contain full trust chain
- Resolves: #1400416 RFE: Provide option to take backup of IPA server before
uninstalling IPA server
- Resolves: #1400529 cert-request is not aware of Kerberos principal aliases
- Resolves: #1401526 IPA WebUI certificates are grayed out on overview page but
not on details page
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- Resolves: #1404750 ipa-client-install fails to get CA cert via LDAP when
non-FQDN name of IPA server is first in /etc/hosts
- Resolves: #1409628 [RFE] Semi-automatic integration with external DNS using
nsupdate
- Resolves: #1413742 Backport request for bug/issue Change IP address
validation errors to warnings
- Resolves: #1415652 IPA replica install log shows password in plain text
- Resolves: #1427897 different behavior regarding system wide certs in master
and replica.
- Resolves: #1430314 The ipa-managed-entries command failed, exception:
AttributeError: ldap2
- Throw zonemgr error message before installation proceeds (#1163849)
- Winsync: Setup is broken due to incorrect import of certificate (#1169867)
- Enable last token deletion when password auth type is configured (#919228)
- ipa-otp-lasttoken loads all user's tokens on every mod/del (#1166641)
- add --hosts and --hostgroup options to allow/retrieve keytab methods
(#1007367)
- Extend host-show to add the view attribute in set of default attributes
(#1168916)
- Prefer TCP connections to UDP in krb5 clients (#919228)
- [WebUI] Not able to unprovisioning service in IPA 4.1 (#1168214)
- webui: increase notification duration (#1171089)
- RHEL7.1 ipa automatic CA cert renewal stuck in submitting state (#1166931)
- RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
(#1170003)
- Improve validation of --instance and --backend options in ipa-restore
(#951581)
- RHEL7.1 ipa replica unable to replicate to rhel6 master (#1167964)
- Disable TLS 1.2 in nss.conf until mod_nss supports it (#1156466)
- Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
error observed during ipa upgrade with latest package.
- ipa-server-install: fix uninstall
- Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
replica
- ca install: merge duplicated code for DM password
- installutils: add DM password validator
- ca, kra install: validate DM password
- Rebase to upstream release 4.8.2
- Removed upstream patches 0001 to 0010 that are part of version 4.8.2
- Updated branding patch
Resolves: RHBZ#1748987
- Update dependency for bind-dndb-ldap to 11.2-2
Related: RHBZ#1762813
- Upstream release FreeIPA 4.9.5
Related: RHBZ#1945038
- IPA to allow setting a new range type
Resolves: RHBZ#1688267
- ipa-server-install displays debug output when --debug output is not
specified.
Resolves: RHBZ#1943151
- ACME fails to generate a cert on migrated RHEL8.4 server
Resolves: RHBZ#1934991
- Switch ipa-client to use the JSON API
Resolves: RHBZ#1937856
- IDM - Allow specifying permanent logging settings for BIND
Resolves: RHBZ#1951511
- Cache LDAP data within a request
Resolves: RHBZ#1953656
- ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4
Resolves: RHBZ#1957768
- Rebuild for broken deps
- Fix 389-ds-base strict dep to be 1.3.0.5 and krb5-server 1.11.1
- Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
- Re-adding existing trust fails (#1033216)
- IPA uninstall exits with a samba error (#1033075)
- Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
- Fixed ownership of /usr/share/ipa/ui/js (#1026260)
- ipa-tests: support external names for hosts (#1032668)
- ipa-client-install fail due fail to obtain host TGT (#1029354)
- Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
by abusing password policy
- ipa-kdb: search for password policies globally
- Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream
- [ipa-python] ipalib.errors.LDAPError: failed to decode certificate:
(SEC_ERROR_INVALID_ARGS) security library: invalid arguments. (#1194312)
- Set krb5 DAL version to 7.0 (#1580711)
- Rebuild aclocal and configure during build
- hbactest does not work for external users (#848531)
- Resolves: #1443869 Command "openssl pkcs12 ..." failed during IPA upgrade
- Fix CAInstance.import_ra_cert for empty passwords
- New upstream release 4.8.0
- New subpackage: freeipa-client-samba
- Added command ipa-cert-fix with man page
- New sysconfdir sysconfig/certmonger
- Updated pki_version, certmonger_version, sssd_version and kdcproxy_version
Related: RHBZ#1684528
- Update to upstream 2.2.0 beta 1 (2.1.90.rc1)
- Set minimum n-v-r for pki-ca and pki-silent to 9.0.18.
- Add Conflicts on mod_ssl
- Update minimum n-v-r of 389-ds-base to 1.2.10.4
- Update minimum n-v-r of sssd to 1.8.0
- Update minimum n-v-r of slapi-nis to 0.38
- Update minimum n-v-r of pki-* to 9.0.18
- Update conflicts on bind-dyndb-ldap to < 1.1.0-0.9.b1
- Update conflicts on bind to < 9.9.0-1
- Drop requires on krb5-server-ldap
- Add patch to remove escaping arguments to pkisilent
- Re-add accidentally removed patches for #1170695 and #1164896
- Fix wrong path in packaging freeipa-systemd-upgrade
- Create systemd-user HBAC service and rule
Resolves: RHBZ#1664974
- ipaserver/dcerpc: fix exclusion entry with a forest trust domain info returned
Resolves: RHBZ#1664023
- trustdomain-find with pkey-only fails (#1068611)
- Invalid credential cache in trust-add (#1069182)
- ipa-replica-install prints unexpected error (#1069722)
- Too big font in input fields in details facet in Firefox (#1069720)
- trust-add for POSIX AD does not fetch trustdomains (#1070925)
- Misleading trust-add error message in some cases (#1070926)
- Access is not rejected for disabled domain (#1070924)
- Set minimum level of sssd to 1.1.1 to pull in required hbac fixes.
- Add OTP patches
- Add patch to set KRB5CCNAME for 389-ds-base
- Resolves: #1431520 ipa cert-find runs a large number of searches, so IPA
WebUI is slow to display user details page
- cert: defer cert-find result post-processing
- Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
helper when installing replica
- server-install: No double Kerberos install
- Resolves: #1437502 ipa-replica-install fails with requirement to
use --force-join that is a client install option.
- Add the force-join option to replica install
- replicainstall: better client install exception handling
- Resolves: #1437953 Server CA-less impossible option check
- server-install: remove broken no-pkinit check
- Resolves: #1441160 FreeIPA client <= 4.4 fail to parse 4.5 cookies
- Add debug log in case cookie retrieval went wrong
- Resolves: #1441548 ipa server install fails with --external-ca option
- ext. CA: correctly write the cert chain
- Resolves: #1441718 Conversion of CA-less server to CA fails on CA instance
spawn
- Fix CA-less to CA-full upgrade
- Resolves: #1442133 Do not link libkrad, liblber, libldap_r and
libsss_nss_idmap to every binary in IPA
- configure: fix AC_CHECK_LIB usage
- Resolves: #1442815 Replica install fails during migration from older IPA
master
- Fix RA cert import during DL0 replication
- Related: #1442004 Building IdM/FreeIPA internally on all architectures -
filtering unsupported packages
- Build all subpackages on all architectures
- Hardening for CVE-2020-25717
- Harden processing of trusted domains' users in S4U operations
- Resolves: RHBZ#2021443
- Updated to upstream 2.2.0 GA
- Update minimum n-v-r of certmonger to 0.53
- Update minimum n-v-r of slapi-nis to 0.40
- Add Requires in client to oddjob-mkhomedir and python-krbV
- Update minimum selinux-policy to 3.10.0-110
- 4.7.1
- Fixes: rhbz#1633105 - rebase to 4.7.1
- Fix otptoken_sync plugin
Resolves: RHBZ#1777811
- Fix automount behavior with authselect
Resolves: RHBZ#1740167
- Require mod_nss-1.0.7-2 for mod_proxy fixes
- Pull upstream changelog 678
- Add new subpackage, ipa-server-selinux
- Add Requires: authconfig to ipa-python (bz #433747)
- Package i18n files
- Fix breakage caused by python-kerberos update to 1.1
- Fix Requires for krb5-server that was missing for Fedora versions > 9
- Remove quotes around test for fedora version to package egg-info
- Load ipa_dogtag.pp in post install
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- user-undel: Fix error messages.
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Prohibit deletion of predefined profiles
- Resolves: #1232819 testing ipa-restore on fresh system install fails
- Backup/resore authentication control configuration
- Resolves: #1243331 pkispawn fails when migrating to 4.2 server from 3.0
server
- Require Dogtag PKI >= 10.2.6
- Resolves: #1245225 Asymmetric vault drops traceback when the key is not
proper
- Asymmetric vault: validate public key in client
- Resolves: #1248399 Missing DNSSEC related files in backup
- fix typo in BasePathNamespace member pointing to ods exporter config
- ipa-backup: archive DNSSEC zone file and kasp.db
- Resolves: #1248405 PassSync should be disabled after ipa-winsync-migrate is
finished
- winsync-migrate: Add warning about passsync
- winsync-migrate: Expand the man page
- Resolves: #1248524 User can't find any hosts using "ipa host-find $HOSTNAME"
- adjust search so that it works for non-admin users
- Resolves: #1250093 ipa certprofile-import accepts invalid config
- Require Dogtag PKI >= 10.2.6
- Resolves: #1250107 IPA framework should not allow modifying trust on AD trust
agents
- trusts: Detect missing Samba instance
- Resolves: #1250111 User lifecycle - preserved users can be assigned
membership
- ULC: Prevent preserved users from being assigned membership
- Resolves: #1250145 Add permission for user to bypass caacl enforcement
- Add permission for bypassing CA ACL enforcement
- Resolves: #1250190 idrange is not added for sub domain
- idranges: raise an error when local IPA ID range is being modified
- trusts: harden trust-fetch-domains oddjobd-based script
- Resolves: #1250928 Man page for ipa-server-install is out of sync
- install: Fix server and replica install options
- Resolves: #1251225 IPA default CAACL does not allow cert-request for services
after upgrade
- Fix default CA ACL added during upgrade
- Resolves: #1251561 ipa vault-add Unknown option: ipavaultpublickey
- validate mutually exclusive options in vault-add
- Resolves: #1251579 ipa vault-add --user should set container owner equal to
user on first run
- Fixed vault container ownership.
- Resolves: #1252517 cert-request rejects request with correct
krb5PrincipalName SAN
- Fix KRB5PrincipalName / UPN SAN comparison
- Resolves: #1252555 ipa vault-find doesn't work for services
- vault: Add container information to vault command results
- Add flag to list all service and user vaults
- Resolves: #1252556 Missing CLI param and ACL for vault service operations
- Added CLI param and ACL for vault service operations.
- Resolves: #1252557 certprofile: improve profile format documentation
- certprofile-import: improve profile format documentation
- certprofile: add profile format explanation
- Resolves: #1253443 ipa vault-add creates vault with invalid type
- vault: validate vault type
- Resolves: #1253480 ipa vault-add-owner does not fail when adding an existing
owner
- baseldap: Allow overriding member param label in LDAPModMember
- vault: Fix param labels in output of vault owner commands
- Resolves: #1253511 ipa vault-find does not use criteria
- vault: Fix vault-find with criteria
- Resolves: #1254038 ipa-replica-install pk12util error returns exit status 10
- install: Fix replica install with custom certificates
- Resolves: #1254262 ipa-dnskeysync-replica crash cannot contact kdc
- improve the handling of krb5-related errors in dnssec daemons
- Resolves: #1254412 when dirsrv is off ,upgrade from 7.1 to 7.2 fails with
starting CA and named-pkcs11.service
- Server Upgrade: Start DS before CA is started.
- Resolves: #1254637 Add ACI and permission for managing user userCertificate
attribute
- add permission: System: Manage User Certificates
- Resolves: #1254641 Remove CSR allowed-extensions restriction
- cert-request: remove allowed extensions check
- Resolves: #1254693 vault --service does not normalize service principal
- vault: normalize service principal in service vault operations
- Resolves: #1254785 ipa-client-install does not properly handle dual stacked
hosts
- client: Add support for multiple IP addresses during installation.
- Add dependency to SSSD 1.13.1
- client: Add description of --ip-address and --all-ip-addresses to man page
- Remove dependency on python-paramiko (#1002884)
- Broken redirection when deleting last entry of DNS resource
record (#1006360)
- "an internal error has occurred" during ipa host-del --updatedns (#1198431)
- Renamed patch 1013 to 0114, as it was merged upstream
- Fax number not displayed for user-show when kinit'ed as normal user.
(#1198430)
- Replication agreement with replica not disabled when ipa-restore done without
IPA installed (#1199060)
- Limit deadlocks between DS plugin DNA and slapi-nis (#1199128)
- Build radius separately
- Fix a few minor issues
- Broke invididual Requires and BuildRequires onto separate lines and
reordered them
- Added python-tgexpandingformwidget as a dependency
- Require at least fedora-ds-base 1.1
- Server install failure during client enrollment shouldn't
roll back (#1023086)
- nsds5ReplicaStripAttrs are not set on agreements (#1023085)
- ipa-server conflicts with mod_ssl (#1018172)
- Update to upstream 3.3.2 (#991064)
- Add delegation info to MS-PAC (#915799)
- Warn about incompatibility with AD when IPA realm and domain
differs (#1009044)
- Allow PKCS#12 files with empty password in install tools (#1002639)
- Privilege "SELinux User Map Administrators" did not list
permissions (#997085)
- SSH key upload broken when client joins an older server (#1009024)
- Set minimum pki-ca and pki-silent versions to 9.0.0
- Set krbCanonicalName admin@REALM on the admin user
Resolves: RHEL-89895
- Rebuild against samba4 beta4
- Resolves: #1361119 UPN-based search for AD users does not match an entry in
slapi-nis map cache
- support multiple uid values in schema compatibility tree
- Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
version to 1.0.7-4 so we pick up the NSS fixes.
- Add selinux-policy-base(post) to Requires (446496)
- Resolves: #1296140 Remove redhat-access-plugin-ipa support
- Obsolete and conflict redhat-access-plugin-ipa
- Resolves: #1351119 Multiple issues while uninstalling ipa-server
- server uninstall fails to remove krb principals
- Resolves: #1351758 ipa commands not showing expected error messages
- frontend: copy command arguments to output params on client
- Show full error message for selinuxusermap-add-hostgroup
- Resolves: #1352883 Traceback on adding default automember group and hostgroup
set
- allow 'value' output param in commands without primary key
- Resolves: #1353888 Fix the help for ipa otp and other topics
- schema: Fix subtopic -> topic mapping
- Resolves: #1354348 ipa trustconfig-show throws internal error.
- allow 'value' output param in commands without primary key
- Resolves: #1354381 ipa trust-add with raw option gives internal error.
- trust-add: handle `--all/--raw` options properly
- Resolves: #1354493 Replica install fails with old IPA master
- DNS install: Ensure that DNS servers container exists
- Resolves: #1354628 ipa hostgroup-add-member does not return error message
when adding itself as member
- frontend: copy command arguments to output params on client
- Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
- messages: specify message type for ResultFormattingError
- Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
secret key
- expose `--secret` option in radiusproxy-* commands
- prevent search for RADIUS proxy servers by secret
- Resolves: #1356099 Bug in the ipapwd plugin
- Heap corruption in ipapwd plugin
- Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
client changes
- Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
- Resolves: #1356964 Renaming a user removes all of his principal aliases
- Preserve user principal aliases during rename operation
- Require slapi-nis 0.47.7 delivering a core feature of 3.3.0 release
- ipa man page format the EXAMPLES section
Resolves: RHBZ#2129895
- Fix canonicalization issue in Web UI
Resolves: RHBZ#2127035
- Remove idnssoaserial argument from dns zone API.
Resolves: RHBZ#2108630
- Warn for permissions with read/write/search/compare and no attrs
Resolves: RHBZ#2098187
- Add PKINIT support to ipa-client-install
Resolves: RHBZ#2075452
- Generate CNAMEs for TXT+URI location krb records
Resolves: RHBZ#2104185
- Vault: fix interoperability issues with older RHEL systems
Resolves: RHBZ#2144737
- Fix typo on ipaupgrade.log chmod during RPM %post snipppet
Resolves: RHBZ#2140994
- Set minimum of python-pyasn1 to 0.0.9a so we have support for the ASN.1
Any type
- Remove ipa-server dependency from ipa-selinux subpackage
- Related: RHBZ#1891832
- clean up spec
- Depend on sssd >= 1.6.2 for better user experience
- webui: Do not allow empty pagination size
Resolves: RHBZ#2094672
- [WebUI] IPA Error 3007: RequirmentError" while adding members in
"User ID overrides" tab
Resolves: RHBZ#1757045
- EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in
freeipa-client-epn
Resolves: RHBZ#1847999
- FreeIPA - Utilize 256-bit AJP connector passwords
Resolves: RHBZ#1849914
- ipa: typo issue in ipanthomedirectoryrive deffinition
Resolves: RHBZ#1851411
- FreeIPA 4.8.0 tarball lacks two update files that are in git
Resolves: RHBZ#1741170
- Proxy PKI URI /ca/ee/ca/profileSubmit to enable replication with future
PKI versions (#1080865)
- kdb: apply combinatorial logic for ticket flags (CVE-2024-3183)
Resolves: RHEL-29927
- kdb: fix vulnerability in GCD rules handling (CVE-2024-2698)
Resolves: RHEL-29692
- Drop workaround for building on AArch64 (#1482244)
- Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)
- schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
build fails (#1167196)
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
- "ipa trust-add ... " cmd says : (Trust status: Established and verified)
while in the logs we see "WERR_ACCESS_DENIED" during verification step.
(#1144121)
- POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
(#1156466)
- Add support/hooks for a one-time password system like SecureID in IPA
(#919228)
- Tracebacks with latest build for --zonemgr cli option (#1167270)
- ID Views: Support migration from the sync solution to the trust solution
(#891984)
- Remove posixAccount from service_find search filter
Resolves: RHBZ#1731437
- Fix repeated uninstallation of ipa-client-samba crashes
Resolves: RHBZ#1732529
- WebUI: Add PKINIT status field to 'Configuration' page
Resolves: RHBZ#1518153
- Resolve user/group names in idoverride*-find
Resolves: RHBZ#1657745
- Configure CA replication to use TLS instead of SSL
- New command automember-find-orphans to find and remove orphan automemeber
rules has been added
Resolves: RHBZ#1638373
- Moved ipa/idm logos and background to redhat-logos-ipa-80.4:
header-logo.png, login-screen-background.jpg, login-screen-logo.png,
product-name.png
New requirement to redhat-logos-ipa >= 80.4 in ipa-server-common
Resolves: RHBZ#1626507
- Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
users in IdM
- store certificates issued for user entries as
- user-show: add --out option to save certificates to file
- Resolves: #1145748 [RFE] IPA running with One Way Trust
- Fix upgrade of sidgen and extdom plugins
- Resolves: #1195339 ipa-client-install changes the label on various files
which causes SELinux denials
- Use 'mv -Z' in specfile to restore SELinux context
- Resolves: #1198796 Text in UI should describe differing LDAP vs Krb behavior
for combinations of "User authentication types"
- webui: add LDAP vs Kerberos behavior description to user auth
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- ULC: Fix stageused-add --from-delete command
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- certprofile-import: do not require profileId in profile data
- Give more info on virtual command access denial
- Allow SAN extension for cert-request self-service
- Add profile for DNP3 / IEC 62351-8 certificates
- Work around python-nss bug on unrecognised OIDs
- Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
- Validate vault's file parameters
- Fixed missing KRA agent cert on replica.
- Resolves: #1225866 display browser config options that apply to the browser.
- webui: add Kerberos configuration instructions for Chrome
- Remove ico files from Makefile
- Resolves: #1246342 Unapply idview raises internal error
- idviews: Check for the Default Trust View only if applying the view
- Resolves: #1248102 [webui] regression - incorrect/no failed auth messages
- webui: fix regressions failed auth messages
- Resolves: #1248396 Internal error in DomainValidator.__search_in_dc
- dcerpc: Fix UnboundLocalError for ccache_name
- Resolves: #1249455 ipa trust-add failed CIFS server configuration does not
allow access to \\pipe\lsarpc
- Fix selector of protocol for LSA RPC binding string
- dcerpc: Simplify generation of LSA-RPC binding strings
- Resolves: #1250192 Error in ipa trust-fecth-domains
- Fix incorrect type comparison in trust-fetch-domains
- Resolves: #1251553 Winsync setup fails with unexpected error
- replication: Fix incorrect exception invocation
- Resolves: #1251854 ipa aci plugin is not parsing aci's correctly.
- ACI plugin: correctly parse bind rules enclosed in
- Resolves: #1252414 Trust agent install does not detect available replicas to
add to master
- adtrust-install: Correctly determine 4.2 FreeIPA servers
- Introduce upgrade script to recover existing configuration after systemd migration
as user has no means to recover FreeIPA from systemd migration
- Upgrade script:
- recovers symlinks in Dogtag instance install
- recovers systemd configuration for FreeIPA's directory server instances
- recovers freeipa.service
- migrates directory server and KDC configs to use proper keytabs for systemd services
- Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
- Remove references to admin server in ipa-server-setupssl
- Generate a client certificate for the XML-RPC server to connect to LDAP with
- Create a keytab for Apache
- Create an ldif with a test user
- Provide a certmap.conf for doing SSL client authentication
- Update to 4.7.90-pre1
Related: RHBZ#1684528
- Removed patches 0002 to 0031 as these are upsteram and part of 4.7.90-pre1
- Added new patches 0001-revert-minssf-defaults.patch and
0001-Correct-default-fontawesome-path-broken-by-da2cf1c5.patch
- Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
- Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
- Resolves: #1341249 Subsequent external CA installation fails
- install: fix external CA cert validation
- Resolves: #1353831 ipa-server-install fails in container because of
hostnamectl set-hostname
- server-install: Fix --hostname option to always override api.env values
- install: Call hostnamectl set-hostname only if --hostname option is used
- Resolves: #1356091 ipa-cacert-manage --help and man differ
- Improvements for the ipa-cacert-manage man and help
- Resolves: #1360631 ipa-backup is not keeping the
/etc/tmpfiles.d/dirsrv-.conf
- ipa-backup: backup /etc/tmpfiles.d/dirsrv-.conf
- Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
file is needed
- Update ipa-replica-install documentation
- Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
not rpm-require it
- client: RPM require initscripts to get *-domainname.service
- Resolves: #1364197 caacl: error when instantiating rules with service
principals
- caacl: fix regression in rule instantiation
- Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
- parameters: move the `confirm` kwarg to Param
- Resolves: #1364464 Topology graph: ca and domain adders shows question marks
instead of plus icon
- Fix unicode characters in ca and domain adders
- Resolves: #1365083 Incomplete output returned for command ipa vault-add
- client: add missing output params to client-side commands
- Resolves: #1365526 build fails during "make check"
- ipa-kdb: Fix unit test after packaging changes in krb5
- Rebase to security release 4.8.3 (CVE-2019-14867, CVE-2019-10195)
Resolves: RHBZ#1767304
Resolves: RHBZ#1776939
- Support KDC ticket policies for authentication indicators
Resolves: RHBZ#1777564
- Fix misleading errors during client install rollback
Resolves: RHBZ#1658283
- ipa-advise: update url of cacerdir_rehash tool
Resolves: RHBZ#1658287
- Handle NTP configuration in a replica server installation
Resolves: RHBZ#1651679
- Fix defects found by static analysis
Resolves: RHBZ#1658182
- ipa-replica-install --setup-adtrust: check for package ipa-server-trust-ad
Resolves: RHBZ#1658294
- ipaldap: invalid modlist when attribute encoding can vary
Resolves: RHBZ#1658302
- Allow ipaapi and Apache user to access SSSD IFP
Resolves: RHBZ#1639910
- Add sysadm_r to default SELinux user map order
Resolves: RHBZ#1658303
- certdb: ensure non-empty Subject Key Identifier and validate server cert sig
Resolves: RHBZ#1641988
- ipa-replica-install: password and admin-password options mutually exclusive
Resolves: RHBZ#1658309
- ipa upgrade: handle double-encoded certificates
Resolves: RHBZ#1658310
- PKINIT: fix ipa-pkinit-manage enable|disable
Resolves: RHBZ#1658313
- Enable LDAP debug output in client to display TLS errors in join
Resolves: RHBZ#1658316
- rpc: always read response
Resolves: RHBZ#1639890
- ipa vault-retrieve: fix internal error
Resolves: RHBZ#1658485
- Move ipa's systemd tmpfiles from /var/run to /run
Resolves: RHBZ#1658487
- Fix authselect invocations to work with 1.0.2
Resolves: RHBZ#1654291
- ipa-client-automount and NFS unit name changes
Resolves: RHBZ#1645501
- Fix compile issue with new 389-ds
Resolves: RHBZ#1659448
- ipatests: fix test_topology
Resolves: RHBZ#2232351
- Installer: activate nss and pam services in sssd.conf
Resolves: RHBZ#2216532
- Update to upstream 4.1.0 (#1109726)
- Re-enable otptoken_yubikey plugin
- Convert to autotools-based build
- Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
because of missing dependencies
- Rebuild with krb5-1.14.1
- Update to upstream 3.3.0 (#991064)
- Set 0.14 as minimum version for slapi-nis
- ipa-client-automount fails with incompatibility error when installed against
older IPA server (#1083108)
- Server installation fails using external signed certificates with
"IndexError: list index out of range" (#1111320)
- Add rhino to BuildRequires to fix Web UI build error
- Abstracted client class to work directly or over RPC
- Fix S4U2Self regression for cross-realm requester SID buffer
- Related: RHBZ#2021443
- Add dep for freeipa-admintools and acl
- Add Requires: python-nss to ipa-python sub-package
- Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
- python2-ipalib: add missing python dependency
- installer service: fix typo in service entry
- upgrade: add missing suffix to http instance
- Resolves: #1444791 Update man page of ipa-kra-install
- ipa-kra-install manpage: document domain-level 1
- Resolves: #1441493 ipa cert-show raises stack traces when
--certificate-out=/tmp
- cert-show: writable files does not mean dirs
- Resolves: #1441192 Add the name of URL parameter which will be check for
username during cert login
- Bump version of ipa.conf file
- Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
- Turn on NSSOCSP check in mod_nss conf
- Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
template on
- renew agent: respect CA renewal master setting
- server upgrade: always fix certmonger tracking request
- cainstance: use correct profile for lightweight CA certificates
- renew agent: allow reusing existing certs
- renew agent: always export CSR on IPA CA certificate renewal
- renew agent: get rid of virtual profiles
- ipa-cacert-manage: add --external-ca-type
- Resolves: #1441593 error adding authenticator indicators to host
- Fixing adding authenticator indicators to host
- Resolves: #1449525 Set directory ownership in spec file
- Added plugins directory to ipaclient subpackages
- ipaclient: fix missing RPM ownership
- Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
- otptoken-add-yubikey: When --digits not provided use default value
- Upstream release FreeIPA 4.9.2
Related: RHBZ#1891832
- Rebuild for broken deps in rawhide
- Fix 389-ds-base strict dep to be 1.3.0.3
- Move ipa-tests package to separate srpm (#1032668)
- Don't always override the port in import_included_profiles
Fixes: RHBZ#2022483
- Remove ipa-join errors from behind the debug option
Fixes: RHBZ#2048558
- Enable the ccache sweep timer during installation
Fixes: RHBZ#2051575
- ipa-replica-install never checks for 7389 port (#1075165)
- Non-terminated string may be passed to LDAP search (#1075091)
- ipa-sam may fail to translate group SID into GID (#1073829)
- Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
- Update to upstream version 1.0.0
- rpcserver: validate Kerberos principal name before running kinit
Resolves: RHEL-26153
- Vault: add additional fallback to RSA-OAEP wrapping algo
Resolves: RHEL-28259
- Set min version of 389-ds-base to 1.2.8
- Set min version of mod_nss 1.0.8-10
- Set min version of selinux-policy to 3.9.7-27
- Add dogtag themes to Requires
- Update to upstream freeipa-2.0.0.pre2
- Resolves: #1339483 ipa-server-install fails with ERROR pkinit_cert_files
- Fix incorrect rebase of patch 1001
- Fixed weekday in 4.8.4-2 changelog date
Related: RHBZ#1784003
- adtrust: print DNS records for external DNS case after role is enabled
Resolves: RHBZ#1665051
- AD user without override receive InternalServerError with API
Resolves: RHBZ#1782572
- ipa-client-automount fails after repeated installation/uninstallation
Resolves: RHBZ#1790886
- install/updates: move external members past schema compat update
Resolves: RHBZ#1803165
- kdb: make sure audit_as_req callback signature change is preserved
Resolves: RHBZ#1803786
- Resolves: #1449189 ipa-kra-install timeouts on replica
- kra: promote: Get ticket before calling custodia
- Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
- Fix ipa-server-install in pure IPv6 environment
- Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
reachable via the forest root
- trust: make sure ID range is created for the child domain even if it exists
- ipa-kdb: simplify trusted domain parent search
- Resolves: #1335567 Update Warning in IdM Web UI API browser
- WebUI: add API browser is tech preview warning
- Resolves: #1348560 Mulitple domain Active Directory Trust conflict
- ipaserver/dcerpc: reformat to make the code closer to pep8
- trust: automatically resolve DNS trust conflicts for triangle trusts
- Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
certificate revocation
- cert-revoke: fix permission check bypass (CVE-2016-5404)
- Resolves: #1353936 custodia.conf and server.keys file is world-readable.
- Remove Custodia server keys from LDAP
- Secure permissions of Custodia server.keys
- Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
converted from CA-less to CA-full
- custodia: include known CA certs in the PKCS#12 file for Dogtag
- custodia: force reconnect before retrieving CA certs from LDAP
- Resolves: #1362333 ipa vault container owner cannot add vault
- Fix: container owner should be able to add vault
- Resolves: #1365546 External trust with root domain is transitive
- trust: make sure external trust topology is correctly rendered
- Resolves: #1365572 IPA server broken after upgrade
- Require pki-core-10.3.3-7
- Resolves: #1367864 Server assumes latest version of command instead of
version 1 for old / 3rd party clients
- rpcserver: assume version 1 for unversioned command calls
- rpcserver: fix crash in XML-RPC system commands
- Resolves: #1367773 thin client ignores locale change
- schema cache: Fallback to 'en_us' when locale is not available
- Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
- Fail on topology disconnect/last role removal
- Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
- otptoken, permission: Convert custom type parameters on server
- Resolves: #1369414 ipa server-del fails with Python stack trace
- Handled empty hostname in server-del command
- Resolves: #1369761 ipa-server must depend on a version of httpd that support
mod_proxy with UDS
- Require httpd 2.4.6-31 with mod_proxy Unix socket support
- Resolves: #1370512 Received ACIError instead of DuplicatedError in
stageuser_tests
- Raise DuplicatedEnrty error when user exists in delete_container
- Resolves: #1371479 cert-find --all does not show information about revocation
- cert: add missing param values to cert-find output
- Renamed patch 1011 to 0100, as it was merged upstream
- Add BuildRequires for authconfig
- Add explicit dependency for libvert-libev
Resolves: RHBZ#2104929
- ipatests: Backport test fixes in python3-ipatests.
Resolves: RHBZ#2057505
- Rely on sssd-krb5 to include SSSD-generated krb5 configuration
Resolves: RHBZ#2214563
- Refactor ipatests for unique krbcanonicalname
Resolves: RHEL-110061
- Move ipalib to ipa-python subpackage
- Bump minimum version of slapi-nis to 0.15
- Remove client-epn left over files for ONLY_CLIENT
Related: RHBZ#1847999
- Resolves: #1252556 Missing CLI param and ACL for vault service operations
- vault: fix private service vault creation
- Update to upstream 2.1.4 (CVE-2011-3636)
- Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
by abusing password policy
- password policy: Add explicit default password policy for hosts and
services
- Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
certprofile-mod
- certprofile-mod: correctly authorise config update
- Update to upstream 4.1.0 Alpha 1 (#1109726)
- PKI service restart after CA renewal failed (#1040018)
- Preverse mode on ipa-keytab-util
- Version bump for relase and rpm name change
- Resolves: #1318186 Misleading error message during external-ca IPA master
install
- httpinstance: make sure NSS database is backed up
- Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
CA certificate chain in ... incomplete"
- httpinstance: make sure NSS database is backed up
- Resolves: #1393726 Enumerate all available request type options in ipa
cert-request help
- Hide request_type doc string in cert-request help
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- spec file: bump libsss_nss_idmap-devel BuildRequires
- server: make sure we test for sss_nss_getlistbycert
- Resolves: #1437378 ipa-adtrust-install produced an error and failed on
starting smb when hostname is not FQDN
- adtrust: make sure that runtime hostname result is consistent with the
configuration
- Resolves: #1437555 ipa-replica-install with DL0 fails to get annonymous
keytab
- Always check and create anonymous principal during KDC install
- Remove duplicate functionality in upgrade
- Resolves: #1437946 Upgrade to FreeIPA 4.5.0 does not configure anonymous
principal for PKINIT
- Upgrade: configure PKINIT after adding anonymous principal
- Remove unused variable from failed anonymous PKINIT handling
- Split out anonymous PKINIT test to a separate method
- Ensure KDC is propery configured after upgrade
- Resolves: #1437951 Remove pkinit-related options from server/replica-install
on DL0
- Fix the order of cert-files check
- Don't allow setting pkinit-related options on DL0
- replica-prepare man: remove pkinit option refs
- Remove redundant option check for cert files
- Resolves: #1438490 CA-less installation fails on publishing CA certificate
- Get correct CA cert nickname in CA-less
- Remove publish_ca_cert() method from NSSDatabase
- Resolves: #1438838 Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
- IPA-KDB: use relative path in ipa-certmap config snippet
- Resolves: #1439038 Allow erasing ipaDomainResolutionOrder attribute
- Allow erasing ipaDomainResolutionOrder attribute
- Upstream release FreeIPA 4.8.6
- New SELinux sub package to provide own module
- Depend on selinux-policy-devel 3.14.3-43 for build due to a makefile issue in
SELinux external policy support
Related: RHBZ#1818765
- CAless installation: set the perms on KDC cert file
Resolves: RHBZ#1863616
- EPN: handle empty attributes
Resolves: RHBZ#1866938
- IPA-EPN: enhance input validation
Resolves: RHBZ#1866291
- EPN: enhance input validation
Resolves: RHBZ#1863079
- Require new samba build 4.12.3-52
Related: RHBZ#1868558
- Require new selinux-policy build 3.14.3-52
Related: RHBZ#1869311
- Resolves: #1398670 Check IdM Topology for broken record caused by replication
conflict before upgrading it
- Check for conflict entries before raising domain level
- package the sessions dir /var/cache/ipa/sessions
- Pull upstream changelog 597
- Add call to /usr/sbin/upgradeconfig to post install
- Resolves: #1262996 ipa vault internal error on replica without KRA
- upgrade: make sure ldap2 is connected in export_kra_agent_pem
- Resolves: #1270608 IPA upgrade fails for server with CA cert signed by
external CA
- schema: do not derive ipaVaultPublicKey from ipaPublicKey
- dcerpc: invalidate forest trust intfo cache when filtering out realm domains
Resolves: RHEL-28559
- Backport latests test fixes in python3-tests
ipatests: add xfail for autoprivate group test with override
ipatests: remove xfail thanks to sssd 2.9.4
ipatests: adapt for new automembership fixup behavior
ipatests: Fixes for test_ipahealthcheck_ipansschainvalidation testcases
test_xmlrpc: adopt to automember plugin message changes in 389-ds
Resolves: RHEL-29908
- Config plugin: return EmptyModlist when no change is applied.
Resolves: RHBZ#2031825
- Custodia: use a stronger encryption algo when exporting keys.
Resolves: RHBZ#2032806
- ipa-kdb: do not remove keys for hardened auth-enabled users.
Resolves: RHBZ#2033342
- ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus
Resolves: RHBZ#2049167
- Backport latest test fxes in python3 ipatests.
Resolves: RHBZ#2048509
- Removed unused patch files that were part of 4.9.8 rebase.
- Upstream final release FreeIPA 4.9.0
Related: RHBZ#1891832
- Add end to end integration tests for external IdP
Resolves: RHBZ#2106346
- Upstream release FreeIPA 4.9.8
Related: RHBZ#2015607
- Hardening for CVE-2020-25717
- Resolves: #1419735 ipa-replica-install fails promotecustodia.create_replica
with cert errors (untrusted)
- added ssl verification using IPA trust anchor
- Resolves: #1428472 batch param compatibility is incorrect
- compat: fix `Any` params in `batch` and `dnsrecord`
- Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream
- rebuild with new openssl
- Rebase ipa to 4.9.13
Resolves: RHEL-16936
- Remove the IPA DNA plugin, use the DS one
- Drop requires on python-configobj (not used any more)
- Drop ipa-ldap-updater message, upgrades are done differently now
- Update minimum selinux-policy to 3.9.16-18
- Update minimum pki-ca and pki-selinux to 9.0.7
- Update minimum 389-ds-base to 1.2.8.0-1
- Update to upstream 2.0.1
- Remove radius subpackages
- Pull upstream changelog 641
- Require minimum version of krb5-server on F-7 and F-8
- Package some new files
- Add ipa init script
- Update to upstream 4.0.3 (#1109726)
- Update Requires on selinux-policy to 3.13.1-4
- Add missing part of backported CVE-2024-3183 fix
Resolves: RHEL-29927
- Drop BuildRequires on mozldap-devel
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
- Updated upstream pull (596) to fix bug in ipa_webgui that was causing the
UI to not start.
- Remove duplicate %files entries on share/ipa/static
- Add python default encoding shared library
- Winsync agreement cannot be created (#1023085)
- Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
aliases)
- harden the check for trust namespace overlap in new principals
- Resolves: #1351142 CLI is not using session cookies for communication with
IPA API
- Fix session cookies
- Resolves: #1353888 Fix the help for ipa otp and other topics
- help: Add dnsserver commands to help topic 'dns'
- Resolves: #1354406 host-del updatedns options complains about missing ptr
record for host
- Host-del: fix behavior of --updatedns and PTR records
- Resolves: #1355718 ipa-replica-manage man page example output differs actual
command output
- Minor fix in ipa-replica-manage MAN page
- Resolves: #1358229 Traceback message should be fixed, seen while editing
winsync migrated user information in Default trust view.
- baseldap: Fix MidairCollision instantiation during entry modification
- Resolves: #1358849 CA replica install logs to wrong log file
- unite log file name of ipa-ca-install
- Resolves: #1359130 ipa-server-install command fails to install IPA server.
- DNS Locations: fix update-system-records unpacking error
- Resolves: #1359237 AVC on dirsrv config caused by IPA installer
- Use copy when replacing files to keep SELinux context
- Resolves: #1359692 ipa-client-install join fail with traceback against
RHEL-6.8 ipa-server
- compat: fix ping call
- Resolves: #1359738 ipa-replica-install --domain= option
does not work
- replica-install: Fix --domain
- Resolves: #1360778 Vault commands are available in CLI even when the server
does not support them
- Revert "Enable vault-* commands on client"
- client: fix hiding of commands which lack server support
- Related: #1281704 Rebase to softhsm 2.1.0
- Remove the workaround for softhsm bug #1293340
- Related: #1298288 [RFE] Improve performance in large environments.
- Create indexes for krbCanonicalName attribute
- Use OpenJDK 8 to bootstrap on AArch64 until RH1482244 is resolved in
buildroot
- Resolves: #1470177 - Rebase IPA to latest 4.5.x version
- Resolves: #1398594 ipa topologysuffix-verify should only warn about
maximum number of replication agreements.
- Resolves: #1404236 Web UI: Change "Host Based" and "Role Based"
to "Host-Based" and "Role-Based"
- Resolves: #1409786 Second phase of --external-ca ipa-server-install
setup fails when dirsrv is not running
- Resolves: #1451576 ipa cert-request failed to generate certificate from csr
- Resolves: #1452086 Pagination Size under Customization in IPA WebUI
accepts negative values
- Resolves: #1458169 --force-join option is not mentioned in
ipa-replica-install man page
- Resolves: #1463186 IPA shouldn't allow objectclass if not all in lower case
- Resolves: #1478322 user-show command fails when sizelimit is configured
to number <= number of entity which is user member of
- Resolves: #1496775 Enterprise principals should be able to trigger
a refresh of the trusted domain data in the KDC
- Resolves: #1502533 Changing cert-find to go through the proxy
instead of using the port 8080
- Resolves: #1502663 pkinit-status command fails after an upgrade from
a pre-4.5 IPA
- Resolves: #1498168 Error when trying to modify a PTR record
- Resolves: #1457876 ipa-backup fails silently
- Resolves: #1493531 In case full PKINIT configuration is failing during
server/replica install the error message should be more meaningful.
- Resolves: #1449985 Suggest CA installation command in KRA installation
warning
- Display server name in ipa command's verbose mode (#1061703)
- Remove sourcehostcategory from default HBAC rule (#1061187)
- dnszone-add cannot add classless PTR zones (#1058688)
- Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)
- Add ipa-rmkeytab tool
- ipaclient-install: chmod needs octal permissions (#1609880)
- Added Require mod_wsgi, added share/ipa/wsgi.py
- Improve otptoken help messages (#919228)
- Ensure users exist when assigning tokens to them (#919228)
- Enable QR code display by default in otptoken-add (#919228)
- Show warning instead of error if CA did not start (#1158410)
- CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
- Traceback when adding zone with long name (#1164859)
- Backup & Restore mechanism (#951581)
- ignoring user attributes in migrate-ds does not work if uppercase characters
are returned by ldap (#1159816)
- Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
- Failure when installing on dual stacked system with external ca (#1128380)
- ipa-server should keep backup of CS.cfg (#1059135)
- Tracebacks with latest build for --zonemgr cli option (#1167270)
- webui: use domain name instead of domain SID in idrange adder dialog
(#891984)
- webui: normalize idview tab labels (#891984)
- Unable to add trust successfully with --trust-secret (#1075704)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Resolves: #1258965 ipa vault: set owner of vault container
- baseldap: make subtree deletion optional in LDAPDelete
- vault: add vault container commands
- vault: set owner to current user on container creation
- vault: update access control
- vault: add permissions and administrator privilege
- install: support KRA update
- Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
- config: allow user/host attributes with tagging options
- Resolves: #1262315 Unable to establish winsync replication
- winsync: Add inetUser objectclass to the passsync sysaccount
- Update SELinux policy to allow ipa_kpasswd to connect ldap and
read /dev/urandom. (#759679)
- Adopt to samba4 beta6 (libsecurity -> libsamba-security)
- Add dependency to samba4-winbind
- Resolves: #1298288 [RFE] Improve performance in large environments.
- cert: speed up cert-find
- Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
authentication
- service: add flag to allow S4U2Self
- Add 'trusted to auth as user' checkbox
- Added new authentication method
- Resolves: #1353881 ipa-replica-install suggests about
non-existent --force-ntpd option
- Don't show --force-ntpd option in replica install
- Resolves: #1354441 DNS forwarder check is too strict: unable to add
sub-domain to already-broken domain
- DNS: allow to add forward zone to already broken sub-domain
- Resolves: #1356146 performance regression in CLI help
- schema: Speed up schema cache
- frontend: Change doc, summary, topic and NO_CLI to class properties
- schema: Introduce schema cache format
- schema: Generate bits for help load them on request
- help: Do not create instances to get information about commands and topics
- schema cache: Do not reset ServerInfo dirty flag
- schema cache: Do not read fingerprint and format from cache
- Access data for help separately
- frontent: Add summary class property to CommandOverride
- schema cache: Read server info only once
- schema cache: Store API schema cache in memory
- client: Do not create instance just to check isinstance
- schema cache: Read schema instead of rewriting it when SchemaUpToDate
- Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
- server install: do not prompt for cert file PIN repeatedly
- Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
cache directory: [Errno 13] Permission denied: '/home/test_user'
- schema: Speed up schema cache
- Resolves: #1366604 `cert-find` crashes on invalid certificate data
- cert: do not crash on invalid data in cert-find
- Resolves: #1366612 Middle replica uninstallation in line topology works
without '--ignore-topology-disconnect'
- Fail on topology disconnect/last role removal
- Resolves: #1366626 caacl-add-service: incorrect error message when service
does not exists
- Fix ipa-caalc-add-service error message
- Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
does not happen to run during dnf upgrade
- DNS server upgrade: do not fail when DNS server did not respond
- Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
with CA
- Add warning about only one existing CA server
- Set servers list as default facet in topology facet group
- Resolves: #1367773 thin client ignores locale change
- schema check: Check current client language against cached one
- Resolves: #1434032 Run ipa-custodia with custom SELinux context
- Require correct custodia version
- Fix: DNS installer adds invalid zonemgr email (#1056202)
- ipaplatform: Use the dirsrv service, not target (#951581)
- Fix: DNS policy upgrade raises asertion error (#1161128)
- Fix upgrade referint plugin (#1161128)
- Upgrade: fix trusts objectclass violationi (#1161128)
- group-add doesn't accept gid parameter (#1149124)
- Remove redundat Requires versions that are already in Fedora 17
- Replace python-crypto Requires with m2crypto
- Add missing Requires(post) for client and server-trust-ad subpackages
- Restart httpd service when server-trust-ad subpackage is installed
- Bump selinux-policy Requires to pick up PKI/LDAP port labeling fixes
- Fix SELinux code
- Resolves: #1378353 Replica install fails with old IPA master sometimes during
replication process
- spec file: bump minimal required version of 389-ds-base
- Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
- Fix missing file that fails DL1 replica installation
- Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
- WebUI: services without canonical name are shown correctly
- Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
- trustdomain-del: fix the way how subdomain is searched
- kdb: PAC generator: do not fail if canonical principal is missing
Resolves: RHEL-23630
- ipa-kdb: Fix memory leak during PAC verification
Resolves: RHEL-22644
- Fix session cookie access
Resolves: RHEL-23622
- Do not ignore staged users in sidgen plugin
Resovlves: RHEL-23626
- ipa-kdb: Disable Bronze-Bit check if PAC not available
Resolves: RHEL-22313
- krb5kdc: Fix start when pkinit and otp auth type are enabled
Resolves: RHEL-4874
- hbactest was not collecting or returning messages
Resolves: RHEL-12780
- Resolves: #712109 "krbExtraData not allowed" is logged in DS error log while
setting password for default sudo binddn.
- Resolves: #747612 [RFE] IPA should support and manage DNS sites
- Resolves: #768316 [RFE] ipa-getkeytab should auto-detect the ipa server name
- Resolves: #825391 [RFE] Replica installation should provide a means for
inheriting nssldap security access settings
- Resolves: #921497 Incorrect *.py[co] files placement
- Resolves: #1029640 RHEL7 IPA to add DNA Plugin config for dnaRemote support
- Resolves: #1029905 389 DS cache sizes not replicated to IPA replicas
- Resolves: #1196958 IPA replica installation failing with high number of users
(160000).
- Resolves: #1219402 IPA suggests to uninstall a client when the user needs to
uninstall a replica
- Resolves: #1224057 [RFE] TGS authorization decisions in KDC based on
Authentication Indicator
- Resolves: #1234222 [WebUI] UI error message is not appropriate for "Kerberos
principal expiration"
- Resolves: #1234223 [WebUI] General invalid password error message appearing
for "Locked user"
- Resolves: #1254267 ipa-server-install failure applying ldap updates with
limits exceeded
- Resolves: #1258626 realmdomains-mod --add-domain command throwing error when
doamin already is in forwardzone.
- Resolves: #1259020 ipa-server-adtrust-install doesn't allow
NetBIOS-name=EXAMPLE-TEST.COM (dash character)
- Resolves: #1260993 DNSSEC signing enablement on dnszone should throw error
message when DNSSEC master not installed
- Resolves: #1262747 dnssec options missing in ipa-dns-install man page
- Resolves: #1265900 Fail installation immediately after dirsrv fails to
install using ipa-server-install
- Resolves: #1265915 idoverrideuser-find fails if any SID anchor is not
resolvable anymore
- Resolves: #1268027 ipa-dnskeysync-replica crash with backtrace -
LimitsExceeded: limits exceeded for this query
- Resolves: #1269089 Certificate of managed-by host/service fails to resubmit
- Resolves: #1269200 ipa-server crashing while trying to preserve admin user
- Resolves: #1271321 Reduce ioblocktimeout and idletimeout defaults
- Resolves: #1271579 Automember rule expressions disappear from tables on
single expression delete
- Resolves: #1275816 Incomplete ports for IPA ad-trust
- Resolves: #1276351 [RFE] Remove
/usr/share/ipa/updates/50-lockout-policy.update file from IPA releases
- Resolves: #1277109 Add tool tips for Revert, Refresh, Undo, and Undo All in
the IPA UI
- Resolves: #1278426 Better error message needed for invalid ca-signing-algo
option
- Resolves: #1279932 ipa-client-install --request-cert needs workaround in
anaconda chroot
- Resolves: #1282521 Creating a user w/o private group fails when doing so in
WebUI
- Resolves: #1283879 ipa-winsync-migrate: Traceback message should be replaced
by "IPA is not configured on this system"
- Resolves: #1285071 ipa-kra-install fails on replica looking for admin cert
file
- Resolves: #1287194 [RFE] Support of UPN for trusted domains
- Resolves: #1288967 Normalize Manager entry in ipa user-add
- Resolves: #1289487 Priority field missing in Password Policy detail tab
- Resolves: #1291140 ipa client should configure kpasswd_server directive in
krb5.conf
- Resolves: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.4.0.alpha1
- Resolves: #1298848 [RFE] Centralized topology management
- Resolves: #1300576 Browser setup page includes instructions for Internet
Explorer
- Resolves: #1301586 ipa host-del --updatedns should remove related dns
entries.
- Resolves: #1304618 Residual Files After IPA Server Uninstall
- Resolves: #1305144 ipa-python does not require its dependencies
- Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
- Resolves: #1313798 Console output post ipa-winsync-migrate command should be
corrected.
- Resolves: #1314786 [RFE] External Trust with Active Directory domain
- Resolves: #1319023 Include description for 'status' option in man page for
ipactl command.
- Resolves: #1319912 ipa-server-install does not completely change hostname and
named-pkcs11 fails
- Resolves: #1320891 IPA Error 3009: Validation error: Invalid 'ptrrecord':
Reverse zone in-addr.arpa. requires exactly 4 IP address compnents, 5 given
- Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
revocation reasons
- Resolves: #1328549 "ipa-kra-install" command reports incorrect message when
it is executed on server already installed with KRA.
- Resolves: #1329209 ipa-nis-manage enable: change service name from 'portmap'
to 'rpcbind'
- Resolves: #1329275 ipa-nis-manage command should include status option
- Resolves: #1330843 'man ipa' should be updated with latest commands
- Resolves: #1333755 ipa cert-request causes internal server error while
requesting certificate
- Resolves: #1337484 EOF is not handled for ipa-client-install command
- Resolves: #1338031 Insufficient 'write' privilege on some attributes for the
members of the role which has "User Administrators" privilege.
- Resolves: #1343142 IPA DNS should do better verification of DNS zones
- Resolves: #1347928 Frontpage exposes runtime error with no cookies enabled in
browser
- Use NSS protocol range API to set available TLS protocols (#1156466)
- Updated to upstream 3.0.0 rc 2
- Include new FF configuration extension
- Set minimum Requires of selinux-policy to 3.11.1-33
- Set minimum Requires dogtag to 10.0.0-0.43.b1
- Add new optional strict sub-package to allow users to limit other
package upgrades.
- Add ipa-idrange-fix
Resolves: RHEL-56920
- Unconditionally add MS-PAC to global config on update
Resolves: RHEL-49437
- ipatests: Update ipa-adtrust-install test
Resolves: RHEL-40894
- Require python-qrcode version 5.3 or later
Related: RHEL-15090
- ipa-kdb: Rework ipadb_reinit_mspac()
Resolves: RHEL-25742
- ipatests: wait for replica update in test_dns_locations
Resolves: RHEL-22373
- ipatests: fix tasks.wait_for_replication() method
Resolves: RHEL-25708
- Resolves: #805188 [RFE] "ipa migrate-ds" ldapsearches with scope=1
- Resolves: #1019272 With 20000+ users, adding a user to a group intermittently
throws Internal server error
- Resolves: #1035494 Unable to add Kerberos principal via kadmin.local
- Resolves: #1045153 ipa-managed-entries --list -p still requires
DM password
- Resolves: #1125950 ipa-server-install --uinstall doesn't remove port 7389
from ldap_port_t
- Resolves: #1132540 [RFE] Expose service delegation rules in UI and CLI
- Resolves: #1145584 ipaserver/install/cainstance.py creates pkiuser not
matching uidgid
- Resolves: #1176036 IDM client registration failure in a high load environment
- Resolves: #1183116 Remove Requires: subscription-manager
- Resolves: #1186054 permission-add does not prompt to enter --right option in
interactive mode
- Resolves: #1187524 Replication agreement with replica not disabled when
ipa-restore done without IPA installed
- Resolves: #1188195 Fax number not displayed for user-show when kinit'ed as
normal user.
- Resolves: #1189034 "an internal error has occurred" during ipa host-del
--updatedns
- Resolves: #1193554 ipa-client-automount: failing with error LDAP server
returned UNWILLING_TO_PERFORM. This likely means that minssf is enabled.
- Resolves: #1193759 IPA extdom plugin fails when encountering large groups
- Resolves: #1194312 [ipa-python] ipalib.errors.LDAPError: failed to decode
certificate: (SEC_ERROR_INVALID_ARGS) security library: invalid arguments.
- Resolves: #1194633 Default trust view can be deleted in lower case
- Resolves: #1196455 ipa-server-install step [8/27]: starting certificate
server instance - confusing CA staus message on TLS error
- Resolves: #1198263 Limit deadlocks between DS plugin DNA and slapi-nis
- Resolves: #1199527 [RFE] Use datepicker component for datetime fields
- Resolves: #1200867 [RFE] Make OTP validation window configurable
- Resolves: #1200883 [RFE] Switch apache to use mod_auth_gssapi
- Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using
get_user_grouplist() [rhel-7.2]
- Resolves: #1204637 slow group operations
- Resolves: #1204642 migrate-ds: slow add o users to default group
- Resolves: #1208461 IPA CA master server update stuck on checking getStatus
via https
- Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
- Resolves: #1211708 ipa-client-install gets stuck during NTP sync
- Resolves: #1215197 ipa-client-install ignores --ntp-server option during time
sync
- Resolves: #1215200 ipa-client-install configures IPA server as NTP source
even if IPA server has not ntpd configured
- Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
- Related: #1204809 Rebase ipa to 4.2
- Update to upstream 4.2.0.alpha1
- ipatests: NAMED_CRYPTO_POLICY_FILE not defined for RHEL
Resolves: RHBZ#1982956
- Add sssd and certmonger as a Requires on ipa-client
- Rebase to upstream release 4.9.10
Remove upstream patches 0002 to 0016 that are part of version 4.9.10
Remove patches 1101 that is part of version 4.9.10
Rename patch 0001 to 1002 as it will be used in future RHEL 8 releases
Add patches 0001 and 0002 to fix build on RHEL 8.7
Resolves: RHBZ#2079466
Resolves: RHBZ#2063155
Resolves: RHBZ#1958777
Resolves: RHBZ#2068088
Resolves: RHBZ#2004646
Resolves: RHBZ#782917
Resolves: RHBZ#2059396
Resolves: RHBZ#2092015
- Handle new samba exception types.
Resolves: RHEL-17623
- Deprecate --serial-autoincrement option (#1016645)
- CA installation always failed on replica (#1005446)
- Re-initializing a winsync connection exited with error (#994980)
- Update to upstream 3.2.0 Beta 1
- Add a Requires for java-atk-wrapper until we can determine which package
should be pulling it in, dogtag or tomcat.
- Add redhat-access-plugin-ipa dependency
- extdom: unify error code handling especially LDAP_NO_SUCH_OBJECT
Resolves: RHBZ#1741530
- Resolves: #800545 [RFE] Support SUDO command rename
- Reworked the renaming mechanism
- Allow renaming of the sudorule objects
- Resolves: #872671 IPA WebUI login for AD Trusted User fails
- WebUI: check principals in lowercase
- WebUI: add method for disabling item in user dropdown menu
- WebUI: Add support for login for AD users
- Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
certificates on smart cards (pkinit)
- ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
- IPA certauth plugin
- ipa-kdb: do not depend on certauth_plugin.h
- spec file: bump krb5-devel BuildRequires for certauth
- Resolves: #1264370 RFE: disable last successful authentication by default in
ipa.
- Set "KDC:Disable Last Success" by default
- Resolves: #1318186 Misleading error message during external-ca IPA master
install
- certs: do not implicitly create DS pin.txt
- httpinstance: clean up /etc/httpd/alias on uninstall
- Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
CA certificate chain in ... incomplete"
- certs: do not implicitly create DS pin.txt
- httpinstance: clean up /etc/httpd/alias on uninstall
- Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
- configure: fix --disable-server with certauth plugin
- rpcserver.login_x509: Actually return reply from __call__ method
- spec file: Bump requires to make Certificate Login in WebUI work
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- extdom: do reverse search for domain separator
- extdom: improve cert request
- Resolves: #1430363 [RFE] HBAC rule names command rename
- Reworked the renaming mechanism
- Allow renaming of the HBAC rule objects
- Resolves: #1433082 systemctl daemon-reload needs to be called after
httpd.service.d/ipa.conf is manipulated
- tasks: run `systemctl daemon-reload` after httpd.service.d updates
- Resolves: #1434032 Run ipa-custodia with custom SELinux context
- Use Custodia 0.3.1 features
- Resolves: #1434384 RPC client should use HTTP persistent connection
- Use connection keep-alive
- Add debug logging for keep-alive
- Increase Apache HTTPD's default keep alive timeout
- Resolves: #1434729 man ipa-cacert-manage install needs clarification
- man ipa-cacert-manage install needs clarification
- Resolves: #1434910 replica install against IPA v3 master fails with ACIError
- Fixing replica install: fix ldap connection in domlvl 0
- Resolves: #1435394 Ipa-kra-install fails with weird output when backspace is
used during typing Directory Manager password
- ipapython.ipautil.nolog_replace: Do not replace empty value
- Resolves: #1435397 ipa-replica-install can't install replica file produced by
ipa-replica-prepare on 4.5
- replica prepare: fix wrong IPA CA nickname in replica file
- Resolves: #1435599 WebUI: in self-service Vault menu item is shown even if
KRA is not installed
- WebUI: Fix showing vault in selfservice view
- Resolves: #1435718 As a ID user I cannot call a command with --rights option
- ldap2: use LDAP whoami operation to retrieve bind DN for current connection
- Resolves: #1436319 "Truncated search results" pop-up appears in user details
in WebUI
- WebUI: Add support for suppressing warnings
- WebUI: suppress truncation warning in select widget
- Resolves: #1436333 Uninstall fails with No such file or directory:
'/var/run/ipa/services.list'
- Create temporaty directories at the begining of uninstall
- Resolves: #1436334 WebUI: Adding certificate mapping data using certificate
fails
- WebUI: Allow to add certs to certmapping with CERT LINES around
- Resolves: #1436338 CLI doesn't work after ipa-restore
- Backup ipa-specific httpd unit-file
- Backup CA cert from kerberos folder
- Resolves: #1436342 Bump samba version, required for FIPS mode and privilege
separation
- Bump samba version for FIPS and priv. separation
- Resolves: #1436642 [ipalib/rpc.py] - "maximum recursion depth exceeded" with
ipa vault commands
- Avoid growing FILE ccaches unnecessarily
- Handle failed authentication via cookie
- Work around issues fetching session data
- Prevent churn on ccaches
- Resolves: #1436657 Add workaround for pki_pin for FIPS
- Generate PIN for PKI to help Dogtag in FIPS
- Resolves: #1436714 [vault] cache KRA transport cert
- Simplify KRA transport cert cache
- Resolves: #1436723 cert-find does not find all certificates without
sizelimit=0
- cert: do not limit internal searches in cert-find
- Resolves: #1436724 Renewal of IPA RA fails on replica
- dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
- Resolves: #1436753 Master tree fails to install
- httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not
available
- webui IdP: Remove arrow notation due to uglify-js limitation
Related: RHBZ#2141316
- Use java-1.8.0-openjdk-devel
- Update to upstream 2.2.0 alpha 1 (2.1.90.pre1)
- Support krb5 1.18
Resolves: RHBZ#1817579
- Fix ipa-replica-install crashes
- Fix ipa-server-install and ipa-dns-install logging
- Set minimum version of pki-ca to 9.0.17 to fix sslget problem
caused by FEDORA-2011-17400 update (#771357)
- Set minimum version of certmonger to 0.26 (to pck up #621670)
- Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
- Set minimum version of pki-ca to 1.3.6
- Set minimum version of sssd to 1.2.1
- diffstat was missing as a build dependency causing multilib problems
- Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
Resolves: RHBZ#1790663
- Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
certificates on smart cards (pkinit)
- spec file: bump krb5 Requires for certauth fixes
- Resolves: #1438729 Configure local PKINIT on DL0 or when '--no-pkinit' option
is used
- separate function to set ipaConfigString values on service entry
- Allow for configuration of all three PKINIT variants when deploying KDC
- API for retrieval of master's PKINIT status and publishing it in LDAP
- Use only anonymous PKINIT to fetch armor ccache
- Stop requesting anonymous keytab and purge all references of it
- Use local anchor when armoring password requests
- Upgrade: configure local/full PKINIT depending on the master status
- Do not test anonymous PKINIT after install/upgrade
- Resolves: #1442427 ipa.ipaserver.install.plugins.adtrust.
update_tdo_gidnumber: ERROR Default SMB Group not found
- upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
installed
- Resolves: #1442932 ipa restore fails to restore IPA user
- restore: restart/reload gssproxy after restore
- Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
- Fix CA/server cert validation in FIPS
- Resolves: #1444947 Deadlock between topology and schema-compat plugins
- compat-manage: behave the same for all users
- Move the compat plugin setup at the end of install
- compat: ignore cn=topology,cn=ipa,cn=etc subtree
- Resolves: #1445358 ipa vault-add raises TypeError
- vault: piped input for ipa vault-add fails
- Resolves: #1445382 ipa vault-retrieve fails to retrieve data from vault
- Vault: Explicitly default to 3DES CBC
- Resolves: #1445432 uninstall ipa client automount failed with RuntimeWarning
- automount install: fix checking of SSSD functionality on uninstall
- Resolves: #1446137 pki_client_database_password is shown in
ipaserver-install.log
- Hide PKI Client database password in log file
- Prepare spec file for release
- Using git snapshot 80e87e75bd6ab56e3e20c49ece55bd4d52f1a503
- Version bump for release
- Add missing ipa-selinux package
Resolves: RHBZ#1853263
- Remove unnecessary moving of v1 CA serial number file in post script
- Add Obsoletes for server-selinxu subpackage
- Using git snapshot 442d6ad30ce1156914e6245aa7502499e50ec0da
- PassSync does not sync passwords due to missing ACIs (#1181093)
- ipa-replica-manage list does not list synced domain (#1181010)
- Do not assume certmonger is running in httpinstance (#1181767)
- ipa-replica-manage disconnect fails without password (#1183279)
- Put LDIF files to their original location in ipa-restore (#1175277)
- DUA profile not available anonymously (#1184149)
- IPA replica missing data after master upgraded (#1176995)
- Included LICENSE and README in all packages for documentation
- Move user-modifiable content to /etc/ipa and linked back to
/usr/share/ipa/html
- Changed some references to /usr to the {_usr} macro and /etc
to {_sysconfdir}
- Added popt-devel to BuildRequires for Fedora 8 and higher and
popt for Fedora 7
- Package the egg-info for Fedora 9 and higher for ipa-python
- Updated to upstream 3.0.0 beta 2
- 2.1.3
- Force to use 389-ds 1.2.10-0.8.a7 or above
- Improve upgrade script to handle systemd 389-ds change
- Fix freeipa to work with python-ldap 2.4.6
- Fix bug #702633
- Resolves: #1256840 [webui] majority of required fields is no longer marked as
required
- fix missing information in object metadata
- Resolves: #1256842 [webui] no option to choose trust type when creating a
trust
- webui: add option to establish bidirectional trust
- Resolves: #1256853 Clear text passwords in KRA install log
- Removed clear text passwords from KRA install log.
- Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
discouraged
- vault: change default vault type to symmetric
- Resolves: #1257163 renaming certificatte profile with --rename option leads
to integrity issues
- certprofile: prevent rename (modrdn)
- Allow the admin user to be disabled
Resolves: RHEL-34756
- ipa-otptoken-import: open the key file in binary mode
Resolves: RHEL-39616
- ipa-crlgen-manage: manage the cert status task execution time
Resolves: RHEL-30280
- idrange-add: add a warning because 389ds restart is required
Resolves: RHEL-28996
- PKINIT certificate: fix renewal on hidden replica
Resolves: RHEL-4913, RHEL-45908
- Mass rebuild 2014-01-24
- Require certmonger 0.79.7-1
Related: RHBZ#1708095
- Do not check if port 8443 is available in step 2 of external CA install
(#1129481)
- Resolves: #1249226 IPA dnssec-validation not working for AD dnsforwardzone
- DNSSEC: fix forward zone forwarders checks
- Resolves: #1250190 idrange is not added for sub domain
- trusts: format Kerberos principal properly when fetching trust topology
- Resolves: #1252334 User life cycle: missing ability to provision a stage user
from a preserved user
- Add user-stage command
- Resolves: #1252863 After applying RHBA-2015-1554 errata, IPA service fails to
start.
- spec file: Add Requires(post) on selinux-policy
- Resolves: #1254304 Changing vault encryption attributes
- Change internal rsa_(public|private)_key variable names
- Added support for changing vault encryption.
- Resolves: #1256715 Executing user-del --preserve twice removes the user
pernamently
- improve the usability of `ipa user-del --preserve` command
- Pull upstream changelog 608 which renamed several files
- Fix for CVE-2008-3274
- Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
- Add fix for bug #453185
- Rebuild against openldap libraries, mozldap ones do not work properly
- TurboGears is currently broken in rawhide. Added patch to not build
the UI locales and removed them from the ipa-server files section.
- Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
- Fix regression introduced in ipa-certupdate
- Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
- Do not initialize API in ipa-client-automount uninstall
- Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
client changes
- idrange: fix unassigned global variable
- Resolves: #1360792 Migrating users doesn't update krbCanonicalName
- re-set canonical principal name on migrated users
- Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
and 'bool' objects
- Fix ipa hbactest output
- Resolves: #1362260 ipa vault-mod no longer allows defining salt
- vault: add missing salt option to vault_mod
- Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
public key
- vault: Catch correct exception in decrypt
- Resolves: #1362537 ipa-server-install fails to create symlink from
/etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
- Correct path to HTTPD's systemd service directory
- Resolves: #1363756 Increase length of passwords generated by installer
- Increase default length of auto generated passwords
- Update to upstream 3.3.0 Beta 2 (#991064)
- Update Requires on pki-ca to 10.1.2-4 (#1129558)
- build: increase java stack size for all arches
- Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
- Fix dns zonemgr validation regression (#1056202)
- Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
- Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
(#886645)
- Add bind-dyndb-ldap working dir to IPA specfile
- Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
(#886645)
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
- Deadlock in schema compat plugin (#1161131)
- ipactl stop should stop dirsrv last (#1161129)
- Upgrade 3.3.5 to 4.1 failed (#1161128)
- CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)
- Fix status trust-add command status message (#910453)
- NetBIOS was not trimmed at 15 characters (#1030517)
- Harden CA subsystem certificate renewal on CA clones (#1040018)
- remove ipa-fix-CVE-2008-3274
- Resolves: #1382812 Creation of replica for disconnected environment is
failing with CA issuance errors; Need good steps.
- gracefully handle setting replica bind dn group on old masters
- Resolves: #1397439 ipa-ca-install on promoted replica hangs on creating a
temporary CA admin
- replication: ensure bind DN group check interval is set on replica config
- add missing attribute to ipaca replica during CA topology update
- Resolves: #1401088 IPA upgrade of replica without DNS fails during restart of
named-pkcs11
- bindinstance: use data in named.conf to determine configuration status
- Resolves: #1348948 IPA server install fails with build
ipa-server-4.4.0-0.el7.1.alpha1
- Revert "Increased mod_wsgi socket-timeout"
- Resolves: #1449189 ipa-kra-install timeouts on replica
- ipa-kra-install: fix check_host_keys
- Require python-wehjit >= 0.2.0
- Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
- Resolves: #1375269 ipa trust-fetch-domains throws internal error
- Set minimum level of 389-ds-base to 1.2.7 for enhanced memberof plugin
- Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
- ipa-sam: replace encode_nt_key() with E_md4hash()
- ipa_pwd_extop: do not generate NT hashes in FIPS mode
- Resolves: #1377973 ipa-server-install fails when the provided or resolved
IP address is not found on local interfaces
- Fix local IP address validation
- ipa-dns-install: remove check for local ip address
- refactor CheckedIPAddress class
- CheckedIPAddress: remove match_local param
- Remove ip_netmask from option parser
- replica install: add missing check for non-local IP address
- Remove network and broadcast address warnings
- Resolves: #1477178 - [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic
key for host
- Always check peer has keys before connecting
- Resolves: #1482802 - Unable to set ca renewal master on replica
- Fix ipa config-mod --ca-renewal-master
- Resolves: #1486283 - TypeError in renew_ca_cert prevents from swiching
back to self-signed CA
- Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
- Resolves: #1480102 - ipa-server-upgrade failes with "This entry already exists"
- Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
- Resolves: #1484826 - FreeIPA/IdM installations which were upgraded from
versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
thus startup of Web UI fails
- Adds whoami DS plugin in case that plugin is missing
- Resolves: #1478251 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
- Fixing how sssd.conf is updated when promoting a client to replica
- Resolves: #1461177 - ipa-otptoken-import - XML file is missing PBKDF2
parameters!
- ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
- Resolves: #1484428 - Updating from RHEL 7.3 fails with Server-Cert not found
(ipa-server-upgrade)
- Backport 4-5: Fix ipa-server-upgrade with server cert tracking
- kdb: Use-krb5_pac_full_sign_compat() when available
Resolves: RHBZ#2176406
- OTP: fix-data-type-to-avoid-endianness-issue
Resolves: RHBZ#2218293
- Upgrade: fix replica agreement
Resolves: RHBZ#2216551
- Upgrade: add PKI drop-in file if missing
Resolves: RHBZ#2215336
- Use the python-cryptography parser directly in cert-find
Resolves: RHBZ#2164349
- Backport test updates
Resolves: RHBZ#221884
- Initial rpm version
- SELinux Policy: let custodia replicate keys
Resolves: RHBZ#1868432
- Update slapi-nis dependency to pull 0.54-2 (#891984)
- ipa-restore: Don't crash if AD trust is not installed (#951581)
- Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
- Trust setting not restored for CA cert with ipa-restore command (#1159011)
- ipa-server-install fails when restarting named (#1162340)
- Rebuild against samba4 beta8
- Resolves: #1170770 [AD TRUST]IPA should detect inconsistent realm domains
that conflicts with AD DC
- trusts: Check for AD root domain among our trusted domains
- Resolves: #1195339 ipa-client-install changes the label on various files
which causes SELinux denials
- sysrestore: copy files instead of moving them to avoind SELinux issues
- Resolves: #1196656 [ipa-client][rhel71] enable debugging for spawned
commands / ntpd -qgc $tmpfile hangs
- enable debugging of ntpd during client installation
- Resolves: #1205264 Migration UI Does Not Work When Anonymous Bind is Disabled
- migration: Use api.env variables.
- Resolves: #1212719 abort-clean-ruv subcommand should allow
replica-certifyall: no
- Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand
- Resolves: #1216935 ipa trust-add shows ipa: ERROR: an internal error has
occurred
- dcerpc: Expand explanation for WERR_ACCESS_DENIED
- dcerpc: Fix UnboundLocalError for ccache_name
- Resolves: #1222778 idoverride group-del can delete user and user-del can
delete group
- dcerpc: Add get_trusted_domain_object_type method
- idviews: Restrict anchor to name and name to anchor conversions
- idviews: Enforce objectclass check in idoverride*-del
- Resolves: #1234919 Be able to request certificates without certmonger service
running
- cermonger: Use private unix socket when DBus SystemBus is not available.
- ipa-client-install: Do not (re)start certmonger and DBus daemons.
- Resolves: #1240939 Please add dependency on bind-pkcs11
- Create server-dns sub-package.
- ipaplatform: Add constants submodule
- DNS: check if DNS package is installed
- Resolves: #1242914 Bump minimal selinux-policy and add booleans to allow
calling out oddjobd-activated services
- selinux: enable httpd_run_ipa to allow communicating with oddjobd services
- Resolves: #1243261 non-admin users cannot search hbac rules
- fix hbac rule search for non-admin users
- fix selinuxusermap search for non-admin users
- Resolves: #1243652 Client has missing dependency on memcache
- do not import memcache on client
- Resolves: #1243835 [webui] user change password dialog does not work
- webui: fix user reset password dialog
- Resolves: #1244802 spec: selinux denial during kdcproxy user creation
- Fix selinux denial during kdcproxy user creation
- Resolves: #1246132 trust-fetch-domains: Do not chown keytab to the sssd user
- oddjob: avoid chown keytab to sssd if sssd user does not exist
- Resolves: #1246136 Adding a privilege to a permission avoids validation
- Validate adding privilege to a permission
- Resolves: #1246141 DNS Administrators cannot search in zones
- DNS: Consolidate DNS RR types in API and schema
- Resolves: #1246143 User plugin - user-find doesn't work properly with manager
option
- fix broken search for users by their manager
- ipa-kdb: Detect and block Bronze-Bit attacks
Resolves: RHEL-9984
- Fix for CVE-2023-5455
Resolves: RHEL-12578
- Temporarily move ipa-backup and ipa-restore functionality
back to make them available in public Beta (#1003933)
- Added patch to fix problem reported by ldapmodify
- Add dependency for python-krbV
- Resolves: #1438833 [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic key for
host
- Make sure remote hosts have our keys
- Resolves: #1442815 Replica install fails during migration from older IPA
master
- Refresh Dogtag RestClient.ca_host property
- Remove the cachedproperty class
- Resolves: #1444787 Update warning message when KRA installation fails
- kra install: update installation failure message
- Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
- ipa-server-install with external CA: fix pkinit cert issuance
- Resolves: #1445397 GET in KerberosSession.finalize_kerberos_acquisition()
must use FreeIPA CA
- kerberos session: use CA cert with full cert chain for obtaining cookie
- Resolves: #1447375 ipa-client-install: extra space in pkinit_anchors
definition
- ipa-client-install: remove extra space in pkinit_anchors definition
- Resolves: #1447703 Fix SELinux contex of http.keytab during upgrade
- Use proper SELinux context with http.keytab
- Fix upgrade issue with AD trust when no trust yet established
Fixes: RHBZ#1708874
Related: RHBZ#1684528
- Resolves: #1131907 [ipa-client-install] cannot write certificate file
'/etc/ipa/ca.crt.new': must be string or buffer, not None
- Resolves: #1195775 unsaved changes dialog internally inconsistent
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- Stageusedr-activate: show username instead of DN
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Prevent to rename certprofile profile id
- Resolves: #1222047 IPA to AD Trust: IPA ERROR 4016: Remote Retrieve Error
- Resolves: #1224769 copy-schema-to-ca.py does not overwrites schema files
- copy-schema-to-ca: allow to overwrite schema files
- Resolves: #1241941 kdc component installation of IPA failed
- spec file: Update minimum required version of krb5
- Resolves: #1242036 Replica install fails to update DNS records
- Fix DNS records installation for replicas
- Resolves: #1242884 Upgrade to 4.2.0 fails when enabling kdc proxy
- Start dirsrv for kdcproxy upgrade
- ipa-kdb: fix error handling of is_master_host()
Resolves: RHBZ#2214638
- ipatests: enable firewall rule for http service on acme client
Resolves: RHBZ#2230256
- User plugin: improve error related to non existing idp
Resolves: RHBZ#2224572
- Prevent admin user from being deleted
Resolves: RHBZ#1821181
- Fix memory leak in the OTP last token plugin
Resolves: RHBZ#2227783
- Fix Fedora package changelog after merging systemd changes
- Backport latest test fixes in python3-ipatests
Resolves: RHBZ#2060841
- extdom: user getorigby{user|group}name if available
Resolves: RHBZ#2062379
- Set the mode on ipaupgrade.log during RPM post snipppet
Resolves: RHBZ#2061957
- test_krbtpolicy: skip SPAKE-related tests in FIPS mode
Resolves: RHBZ#1909630
- Fixed kdcproxy_version to 0.4-3
- Fixed krb5_version to 1.17-7
Related: RHBZ#1684528
- Handle NFS configuration file changes. nfs-utils moved the
configuration file from /etc/sysconfig/nfs to /etc/nfs.conf.
Resolves: RHBZ#1676981
- webui: Allow grace login limit
Resolves: RHBZ#2109243
- check_repl_update: in progress is a boolean
Resolves: RHBZ#2117303
- Disabling gracelimit does not prevent LDAP binds
Resolves: RHBZ#2109236
- Set passwordgracelimit to match global policy on group pw policies
Resolves: RHBZ#2115475
- Add Requires on krb5-pkinit-openssl
- Upstream release FreeIPA 4.9.6
Related: RHBZ#1945038
- Revise PKINIT upgrade code
Resolves: RHBZ#1886837
- ipa-cert-fix man page: add note about certmonger renewal
Resolves: RHBZ#1780317
- Certificate Serial Number issue
Resolves: RHBZ#1919384
- Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
- Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to
handle PKINIT certificates/anchors
- certdb: add named trust flag constants
- certdb, certs: make trust flags argument mandatory
- certdb: use custom object for trust flags
- install: trust IPA CA for PKINIT
- client install: fix client PKINIT configuration
- install: introduce generic Kerberos Augeas lens
- server install: fix KDC PKINIT configuration
- ipapython.ipautil.run: Add option to set umask before executing command
- certs: do not export keys world-readable in install_key_from_p12
- certs: do not export CA certs in install_pem_from_p12
- server install: fix KDC certificate validation in CA-less
- replica install: respect --pkinit-cert-file
- cacert manage: support PKINIT
- server certinstall: support PKINIT
- Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
option
- certs: do not export CA certs in install_pem_from_p12
- server install: fix KDC certificate validation in CA-less
- Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
decommissioned
- ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname
- Resolves: #1451712 KRA installation fails on server that was originally
installed as CA-less
- ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
- Resolves: #1441499 ipa cert-show does not raise error if no file name
specified
- ca/cert-show: check certificate_out in options
- Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
- Remove pkinit-anonymous command
- Resolves: #1449523 Provide an API command to retrieve PKINIT status
in the FreeIPA topology
- Allow for multivalued server attributes
- Refactor the role/attribute member reporting code
- Add an attribute reporting client PKINIT-capable servers
- Add the list of PKINIT servers as a virtual attribute to global config
- Add `pkinit-status` command
- test_serverroles: Get rid of MockLDAP and use ldap2 instead
- Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
- Fix rare race condition with missing ccache file
- Resolves: #1455045 Simple service uninstallers must be able to handle
missing service files gracefully
- only stop/disable simple service if it is installed
- Resolves: #1455541 after upgrade login from web ui breaks
- krb5: make sure KDC certificate is readable
- Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
command "ipa cert-request --add" after upgrade
- Change python-cryptography to python2-cryptography
- Require krb5 release 1.18.2-25 or later
Resolves: RHBZ#2234711
- Rebase ipa to 4.9.12
Resolves: RHBZ#2196425
- user or group name: explain the supported format
Resolves: RHBZ#2150217
- Allow insecure binds for migration
Resolves: RHBZ#1731963
- Trust add tries to add same value of --base-id for sub domain,
causing an error (#1033068)
- Improved error reporting for adding trust case (#1029856)
- Do not fetch a principal two times, remove potential memory leak (#1070924)
- Depend on krb5-kdb-version-devel for BuildRequires
- Update nss dependency to 3.44.0-4
- Reset per-indicator Kebreros policy
Resolves: RHBZ#1784761
- Resolves: #1339233 CA installed on replica is always marked as renewal master
- Related: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.3.1.201605241723GIT1b427d3
- Pull upstream changelog 722
- Add Conflicts mod_ssl (435360)
- Use default ssh host key algorithms
Resolves: RHBZ#1756432
- Do not run trust upgrade code if master lacks Samba bindings
Resolves: RHBZ#1757064
- Finish group membership management UI
Resolves: RHBZ#1773528
- Add ipa-host-net-manage script
- Use the OpenSSL certificate parser in cert-find
Resolves: RHBZ#2209947
- Add a- heck into ipa-cert-fix tool to avoid updating certs if CA is close to expire
Resolves: RHEL-4941
- Fix rpminspect's 'patches' warnings
Resolves: RHEL-22497
- replica install failing with avc denial for custodia component
Resolves: RHBZ#1857157
- Upstream pre release FreeIPA 4.9.0rc1
Resolves: RHBZ#1891832
- Requirements and design for libpwquality integration
Resolves: RHBZ#1340463
- When parsing options require name/value pairs
Resolves: RHBZ#1357495
- WebUI: Fix issue with opening links in new tab/window
Resolves: RHBZ#1484088
- Use a state to determine if a 389-ds upgrade is in progress
Resolves: RHBZ#1569011
- Unlock user accounts after a password reset and replicate that unlock to
all IdM servers
Resolves: RHBZ#1784657
- Set the certmonger subject with a string, not an object
Resolves: RHBZ#1810148
- Implement ACME certificate enrolment
Resolves: RHBZ#1851835
- [WebUI] Backport jQuery patches from newer versions of the library (e.g.
3.5.0)
Resolves: RHBZ#1859249
- It is not possible to edit KDC database when the FreeIPA server is running
Resolves: RHBZ#1875001
- Fix nsslapd-db-lock tuning of BDB backend
Resolves: RHBZ#1882340
- ipa-kdb: support subordinate/superior UPN suffixes
Resolves: RHBZ#1891056
- wgi/plugins.py: ignore empty plugin directories
Resolves: RHBZ#1894800
- Default to systemd for Fedora 16 and onwards
- Update to upstream 3.2.0 GA
- ipa-client-install fails if /etc/ipa does not exist (#961483)
- Certificate status is not visible in Service and Host page (#956718)
- ipa-client-install removes needed options from ldap.conf (#953991)
- Handle socket.gethostbyaddr() exceptions when verifying hostnames (#953957)
- Add triggerin scriptlet to support OpenSSH 6.2 (#953617)
- Require nss 3.14.3-12.0 to address certutil certificate import
errors (#953485)
- Require pki-ca 10.0.2-3 to pull in fix for sslget and mixed IPv4/6
environments. (#953464)
- ipa-client-install removes 'sss' from /etc/nsswitch.conf (#953453)
- ipa-server-install --uninstall doesn't stop dirsrv instances (#953432)
- Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for
socket based connections (#960222)
- Require libsss_nss_idmap-python
- Add Conflicts on nss-pam-ldapd < 0.8.4. The mapping from uniqueMember to
member is now done automatically and having it in the config file raises
an error.
- Add backup and restore tools, directory.
- require at least systemd 38 which provides the journal (we no longer
need to require syslog.target)
- Update Requires on policycoreutils to 2.1.14-37
- Update Requires on selinux-policy to 3.12.1-42
- Update Requires on 389-ds-base to 1.3.1.0
- Remove a Requires for java-atk-wrapper
- Preserve user: fix the confusing summary
Resolves: RHBZ#2022028
- Only calculate LDAP password grace when the password is expired
Related: RHBZ#782917
- Resolves: #1260663 crash of ipa-dnskeysync-replica component during
ipa-restore
- IPA Restore: allows to specify files that should be removed
- Resolves: #1261806 Installing ipa-server package breaks httpd
- Handle timeout error in ipa-httpd-kdcproxy
- Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
- Server Upgrade: backup CS.cfg when dogtag is turned off
- ipa-server-install crashes when AD subpackage is not installed (#1026434)
- Resolves: #1228671 pkispawn fails in ipa-ca-install and ipa-kra-install
- Related: #1204809 Rebase ipa to 4.2
- Fix minimum version of slapi-nis
- Require python-sss and python-sss-murmur (provided by sssd-1.13.0)
- Drop conflicts on mod_nss
- Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
- Drop a slew of conditionals on older Fedora releases (< 12)
- Add a few conditionals against RHEL 6
- Add Requires of nss-tools on ipa-client
- Upstream release FreeIPA 4.9.3
Resolves: RHBZ#1945038
- Fix systemd-user HBAC rule
Resolves: RHBZ#1664974
- sudo rule for "admins" members should be created by default (#1609873)
- New upstream release 1.2.1
- Updated to current upstream state of 3.0.0 beta 2 development
- Wrong directories created on full restore (#1186398)
- ipa-restore crashes if replica is unreachable (#1186396)
- idoverrideuser-add option --sshpubkey does not work (#1185410)
- Missing objectclasses when empty password passed to host-add (#1052979)
- sudoOrder missing in sudoers (#1052983)
- Missing examples in sudorule help (#1049464)
- Client automount does not uninstall when fstore is empty (#910899)
- Error not clear for invalid realm given to trust-fetch-domains (#1052981)
- trust-fetch-domains does not add idrange for subdomains found (#1049926)
- Add option to show if an AD subdomain is enabled/disabled (#1052973)
- ipa-adtrust-install still failed with long NetBIOS names (#1030517)
- Error not clear for invalid relam given to trustdomain-find (#1049455)
- renewed client cert not recognized during IPA CA renewal (#1033273)
- Revert bind-pkcs11-utils configuration in freeipa.spec.
Resolves: RHBZ#2026732
- Replace TurboGears requirement with python-cherrypy
- Update to upstream 3.2.1
- Drop dogtag-pki-server-theme requires, it won't be build for RHEL-7.0
- Remove ipa-idoverride-memberof as superceded by ipa-server 4.8.7
Resolves: RHBZ#1846434
- Respin after the tarball has been re-released upstream
New hash is 506c9c92dcaf9f227cba5030e999f177
- Allow Web-based migration to work with tightened SE Linux policy (#769440)
- Rebuild slapi plugins against re-enterant version of libldap
- Remove strict dependencies to krb5-server version in order to allow
update of krb5 to 1.17 and change dependency to KDB DAL version.
Resolves: RHBZ#1700121
- Fixed: rhbz#1643445 - External CA step 2 fails with pki_client_database_dir is missing
- Fixed: rhbz#1642834 - Smart card advise script uses hard-coded Python interpreter
- Resolves: #1277696 IPA certificate auto renewal fail with "Invalid
Credential"
- cert renewal: make renewal of ipaCert atomic
- Resolves: #1278330 installer options are not validated at the beginning of
installation
- install: fix command line option validation
- Resolves: #1282845 sshd_config change on ipa-client-install can prevent sshd
from starting up
- client install: do not corrupt OpenSSH config with Match sections
- Resolves: #1282935 ipa upgrade causes vault internal error
- install: export KRA agent PEM file in ipa-kra-install
- Resolves: #1283429 Default CA ACL rule is not created during
ipa-replica-install
- TLS and Dogtag HTTPS request logging improvements
- Avoid race condition caused by profile delete and recreate
- Do not erroneously reinit NSS in Dogtag interface
- Add profiles and default CA ACL on migration
- disconnect ldap2 backend after adding default CA ACL profiles
- do not disconnect when using existing connection to check default CA ACLs
- Resolves: #1283430 ipa-kra-install: fails to apply updates
- suppress errors arising from adding existing LDAP entries during KRA
install
- Resolves: #1283748 Caching of ipaconfig does not work in framework
- fix caching in get_ipa_config
- Resolves: #1283943 IPA DNS Zone/DNS Forward Zone details missing after
upgrade from RHEL 7.0 to RHEL 7.2
- upgrade: fix migration of old dns forward zones
- Fix upgrade of forwardzones when zone is in realmdomains
- Resolves: #1284413 ipa-cacert-manage renew fails on nonexistent ldap
connection
- ipa-cacert-renew: Fix connection to ldap.
- Resolves: #1284414 ipa-otptoken-import fails on nonexistent ldap connection
- ipa-otptoken-import: Fix connection to ldap.
- Resolves: #1286635 IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using
"yum update ipa* sssd"
- Set minimal required version for openssl
- Resolves: #1286781 ipa-nis-manage does not update ldap with all NIS maps
- Upgrade: Fix upgrade of NIS Server configuration
- Resolves: #1289311 umask setting causes named-pkcs11 issue with directory
permissions on /var/lib/ipa/dnssec
- DNS: fix file permissions
- Explicitly call chmod on newly created directories
- Fix: replace mkdir with chmod
- Resolves: #1290142 Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
- Fix version comparison
- use FFI call to rpmvercmp function for version comparison
- Resolves: #1292595 In IPA-AD trust environment some secondary IPA based Posix
groups are missing
- ipa-kdb: map_groups() consider all results
- Resolves: #1293870 User should be notified for wrong password in password
reset page
- Fixed login error message box in LoginScreen page
- Resolves: #1296196 Sysrestore did not restore state if a key is specified in
mixed case
- Allow to used mixed case for sysrestore
- Resolves: #1296214 DNSSEC key purging is not handled properly
- DNSSEC: Improve error reporting from ipa-ods-exporter
- DNSSEC: Make sure that current state in OpenDNSSEC matches key state in
LDAP
- DNSSEC: Make sure that current key state in LDAP matches key state in BIND
- DNSSEC: remove obsolete TODO note
- DNSSEC: add debug mode to ldapkeydb.py
- DNSSEC: logging improvements in ipa-ods-exporter
- DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP
- DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
- DNSSEC: ipa-ods-exporter: add ldap-cleanup command
- DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removal
- DNSSEC: Log debug messages at log level DEBUG
- Resolves: #1296216 ipa-server-upgrade fails if certmonger is not running
- prevent crash of CA-less server upgrade due to absent certmonger
- always start certmonger during IPA server configuration upgrade
- Resolves: #1297811 The ipa -e skip_version_check=1 still issues
incompatibility error when called against RHEL 6 server
- ipalib: assume version 2.0 when skip_version_check is enabled
- Resolves: #1298289 install fails when locale is "fr_FR.UTF-8"
- Do not decode HTTP reason phrase from Dogtag
- Resolves: #1300252 shared certificateProfiles container is missing on a
freshly installed RHEL7.2 system
- upgrade: unconditional import of certificate profiles into LDAP
- Resolves: #1301674 --setup-dns and other options is forgotten for using an
external PKI
- installer: Propagate option values from components instead of copying them.
- installer: Fix logic of reading option values from cache.
- Resolves: #1301687 issues with migration from RHEL 6 self-signed to RHEL 7 CA
IPA setup
- ipa-ca-install: print more specific errors when CA is already installed
- cert renewal: import all external CA certs on IPA CA cert renewal
- CA install: explicitly set dogtag_version to 10
- fix standalone installation of externally signed CA on IPA master
- replica install: validate DS and HTTP server certificates
- replica install: improvements in the handling of CA-related IPA config
entries
- Resolves: #1301901 [RFE] compat tree: show AD members of IPA groups
- slapi-nis: update configuration to allow external members of IPA groups
- Resolves: #1305533 ipa trust-add succeded but after that ipa trust-find
returns "0 trusts matched"
- upgrade: fix config of sidgen and extdom plugins
- trusts: use ipaNTTrustPartner attribute to detect trust entries
- Warn user if trust is broken
- fix upgrade: wait for proper DS socket after DS restart
- Insure the admin_conn is disconnected on stop
- Fix connections to DS during installation
- Fix broken trust warnings
- Resolves: #1321092 Installers fail when there are multiple versions of the
same certificate
- certdb: never use the -r option of certutil
- Related: #1317381 Crash during IPA upgrade due to slapd
- spec file: update minimum required version of slapi-nis
- Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112
CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws
[rhel-7.3]
- Rebuild against newer Samba version
- RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
(#1169591)
- CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
(#1172578)
- Re-arrange doc and defattr to clean up rpmlint warnings
- Remove conditionals on older releases
- Move some man pages into admintools subpackage
- Remove some explicit Requires in client that aren't needed
- Consistent use of buildroot vs RPM_BUILD_ROOT
- Update to upstream 3.3.1 (#991064)
- Update minimum version of bind-dyndb-ldap to 3.5
- Remove release from krb5-server in strict sub-package to allow for rebuilds.
- Fix krb5-kdb-server -> krb5-kdb-version
Related: RHBZ#1700121
- Unified spec file
- Update to upstream 3.1.2
- CVE-2012-4546: Incorrect CRLs publishing
- CVE-2012-5484: MITM Attack during Join process
- CVE-2013-0199: Cross-Realm Trust key leak
- Updated strict dependencies to 389-ds-base = 1.3.0.2 and
pki-ca = 10.0.1
- IPA Replicate creation fails with error "Update failed! Status: [10 Total
update abortedLDAP error: Referral]" (#1166265)
- running ipa-server-install --setup-dns results in a crash (#1072502)
- DNS zones are not migrated into forward zones if 4.0+ replica is added
(#1175384)
- gid is overridden by uid in default trust view (#1168904)
- When migrating warn user if compat is enabled (#1177133)
- Clean up debug log for trust-add (#1168376)
- No error message thrown on restore(full kind) on replica from full backup
taken on master (#1175287)
- ipa-restore proceed even IPA not configured (#1175326)
- Data replication not working as expected after data restore from full backup
(#1175277)
- IPA externally signed CA cert expiration warning missing from log (#1178128)
- ipa-upgradeconfig fails in CA-less installs (#1181767)
- IPA certs fail to autorenew simultaneouly (#1173207)
- More validation required on ipa-restore's options (#1176034)
- Installer did not detect different server and IPA domain (#1026845)
- Allow kernel keyring CCACHE when supported (#1026861)
- Resolves: #1442233 IPA client commands fail when pointing to replica
- httpinstance: wait until the service entry is replicated
- Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
not indexed
- Fix index definition for ipaAnchorUUID
- Resolves: #1438016 gssapi errors after IPA server upgrade
- Avoid possible endless recursion in RPC call
- rpc: preparations for recursion fix
- rpc: avoid possible recursion in create_connection
- Resolves: #1446087 services entries missing krbCanonicalName attribute.
- Changing cert-find to do not use only primary key to search in LDAP.
- Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
- ipa-kdb: reload certificate mapping rules periodically
- Resolves: #1455541 after upgrade login from web ui breaks
- kdc.key should not be visible to all
- Resolves: #1435606 Add pkinit_indicator option to KDC configuration
- ipa-kdb: add pkinit authentication indicator in case of a successful
certauth
- Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
issuance when ipa-ca records are not resolvable
- Turn off OCSP check
- Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
server_del - TypeError: 'NoneType' object is not iterable
- fix incorrect suffix handling in topology checks
- Hardening for CVE-2020-25717
- Related: RHBZ#2019668
- Require python-wehjit >= 0.2.2
- Resolves: #837369 [RFE] Switch to client promotion to replica model
- Resolves: #1199516 [RFE] Move replication topology to the shared tree
- Resolves: #1206588 [RFE] Visualize FreeIPA server replication topology
- Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
- Resolves: #1212713 ipa-csreplica-manage: it could be nice to have also
list-ruv / clean-ruv / abort-clean-ruv for o=ipaca backend
- Resolves: #1267206 ipa-server-install uninstall should warn if no
installation found
- Resolves: #1295865 The Domain option is not correctly set in idmapd.conf when
ipa-client-automount is executed.
- Resolves: #1327092 URI details missing and OCSP-URI details are incorrectly
displayed when certificate generated using IPA on RHEL 7.2up2.
- Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
because of missing dependencies
- Related: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.3.1.201605191449GITf8edf37
- Update to upstream 4.6.90.pre1
- Resolves: #1355753 adding two way non transitive(external) trust displays
internal error on the console
- Always fetch forest info from root DCs when establishing two-way trust
- factor out `populate_remote_domain` method into module-level function
- Always fetch forest info from root DCs when establishing one-way trust
- Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
after `ipa-replica-install`
- Track lightweight CAs on replica installation
- Resolves: #1357488 ipa command stuck forever on higher versioned client with
lower versioned server
- compat: Save server's API version in for pre-schema servers
- compat: Fix ping command call
- schema cache: Store and check info for pre-schema servers
- Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
- Fix man page ipa-replica-manage: remove duplicate -c option
from --no-lookup
- Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
when revoking certificate
- cert: include CA name in cert command output
- WebUI add support for sub-CAs while revoking certificates
- Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
- Add support for additional options taken from table facet
- WebUI: Fix showing certificates issued by sub-CA
- Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
internactively
- dns: normalize record type read interactively in dnsrecord_add
- dns: prompt for missing record parts in CLI
- dns: fix crash in interactive mode against old servers
- Resolves: #1370519 Certificate revocation in service-del and host-del isn't
aware of Sub CAs
- cert: fix cert-find --certificate when the cert is not in LDAP
- Make host/service cert revocation aware of lightweight CAs
- Resolves: #1371901 Use OAEP padding with custodia
- Use RSA-OAEP instead of RSA PKCS#1 v1.5
- Resolves: #1371915 When establishing external two-way trust, forest root
Administrator account is used to fetch domain info
- do not use trusted forest name to construct domain admin principal
- Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
certificate request
- Fix CA ACL Check on SubjectAltNames
- Resolves: #1373272 CLI always sends default command version
- cli: use full name when executing a command
- Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
- Fix ipa-certupdate for CA-less installation
- Resolves: #1373540 client-install with IPv6 address fails on link-local
address (always)
- Fix parse errors with link-local addresses
- man page: update ipa-server-upgrade.1
Resolves: RHBZ#1973273
- Fall back to krbprincipalname when validating host auth indicators
Resolves: RHBZ#1979625
- Add dependency for sssd-winbind-idmap to server-trust-ad
Resolves: RHBZ#1982211
- Fix replica installation failing on certificate subject (#983075)
- Rebase ipa to 4.9.11
Resolves: RHBZ#2141316
- updates: fix memberManager ACI to allow managers from a specified group
Resolves: RHBZ#2056009
- Defer creating the final krb5.conf on clients
Resolves: RHBZ#2148259
- Exclude installed policy module file from RPM verification
Resolves: RHBZ#2149567
- Spec file: ipa-client depends on krb5-pkinit-openssl
Resolves: RHBZ#2149889
- When IdM server trusts multiple AD forests, IPA client returns invalid group
membership info (#1079498)
- IPA server in debug mode fails to run because time.perf_counter_ns is
Python 3.7+
Resolves: RHBZ#1974822
- Add checks to prevent assigning authentication indicators to internal IPA
services
Resolves: RHBZ#1979625
- Unable to set ipaUserAuthType with stageuser-add
Resolves: RHBZ#1979605
- Replica installation fails for RHEL 6.4 master (#1004680)
- Server uninstallation crashes if DS is not available (#998069)
- Updated to upstream 3.1.0 GA
- Set minimum for sssd to 1.9.2
- Set minimum for pki-ca to 10.0.0-1
- Set minimum for 389-ds-base to 1.3.0
- Set minimum for selinux-policy to 3.11.1-60
- Remove unneeded dogtag package requires
- Updated to upstream 3.0.0 rc 1
- Update BR for 389-ds-base to 1.2.11.14
- Update BR for krb5 to 1.10
- Update BR for samba4-devel to 4.0.0-139 (rc1)
- Add BR for python-polib
- Update BR and Requires on sssd to 1.9.0
- Update Requires on policycoreutils to 2.1.12-5
- Update Requires on 389-ds-base to 1.2.11.14
- Update Requires on selinux-policy to 3.11.1-21
- Update Requires on dogtag to 10.0.0-0.33.a1
- Update Requires on certmonger to 0.60
- Update Requires on tomcat to 7.0.29
- Update minimum version of bind to 9.9.1-10.P3
- Update minimum version of bind-dyndb-ldap to 1.1.0-0.16.rc1
- Remove Requires on authconfig from python sub-package
- Update Requires on krb5-server to 1.11
- Moved directory install/static to install/ui
- Fix ipa-pwd-extop global configuration caching (#1187342)
- group-detach does not add correct objectclasses (#1187540)
- Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
- Keep NSS trust flags of existing certificates
- Resolves: #1360813 ipa-server-certinstall does not update all certificate
stores and doesn't set proper trust permissions
- Add cert checks in ipa-server-certinstall
- Resolves: #1371479 cert-find --all does not show information about revocation
- cert: add revocation reason back to cert-find output
- Resolves: #1375133 WinSync users who have First.Last casing creates users who
can have their password set
- ipa passwd: use correct normalizer for user principals
- Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
- Properly handle LDAP socket closures in ipa-otpd
- Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
- Make httpd publish its CA certificate on DL1
- ipatests: remove additional check for failed units.
Resolves: RHBZ#2053024
- ipa-cldap: fix memory leak.
Resolves: RHBZ#2032738
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Resolves: #1382053 Need to have validation for idrange names
- idrange-add: properly handle empty --dom-name option
- Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
helper when installing replica
- dsinstance: reconnect ldap2 after DS is restarted by certmonger
- httpinstance: avoid httpd restart during certificate request
- dsinstance, httpinstance: consolidate certificate request code
- install: request service certs after host keytab is set up
- renew agent: revert to host keytab authentication
- renew agent, restart scripts: connect to LDAP after kinit
- Resolves: #1436987 ipasam: gidNumber attribute is not created in the trusted
domain entry
- ipa-sam: create the gidNumber attribute in the trusted domain entry
- Upgrade: add gidnumber to trusted domain entry
- Resolves: #1438679 [ipa-replica-install] - IncorrectPasswordException:
Incorrect client security database password
- Add pki_pin only when needed
- Resolves: #1438348 Console output message while adding trust should be
mapped with texts changed in Samba.
- ipaserver/dcerpc: unify error processing
- Resolves: #1438366 ipa trust-fetch-domains: ValidationError: invalid
'Credentials': Missing credentials for cross-forest communication
- trust: always use oddjobd helper for fetching trust information
- Resolves: #1441192 Add the name of URL parameter which will be check for
username during cert login
- WebUI: cert login: Configure name of parameter used to pass username
- Resolves: #1437879 [copr] Replica install failing
- Create system users for FreeIPA services during package installation
- Resolves: #1441316 WebUI cert auth fails after ipa-adtrust-install
- Fix s4u2self with adtrust
- Require samba 4.14.5-13 with IPA DC server role fixes
- Related: RHBZ#2021443
- Update to upstream 3.2.2
- Drop ipa-server-selinux subpackage
- Drop redundant directory /var/cache/ipa/sessions
- Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
- Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
issues when there are still old parts of software (like entitlements plugin)
- Version bump for release
- Add versioned dependency of samba-client-libs to ipa-server
- Related: RHBZ#2021443
- Upstream release FreeIPA 4.8.7
- Require new samba build 4.12.3-0
Related: RHBZ#1818765
- New client-epn sub package
Resolves: RHBZ#913799
python3-ipalib-4.9.13-20.module+el8.10.0+2067+377bdd64.noarch.rpm | - Resolves: #846033 [RFE] Documentation for JSONRPC IPA API
- Resolves: #989091 Ability to manage IdM/IPA directly from a standard LDAP
client
- Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
users in IdM
- Resolves: #1115294 [RFE] Add support for DNSSEC
- Resolves: #1145748 [RFE] IPA running with One Way Trust
- Resolves: #1199520 [RFE] Introduce single upgrade tool - ipa-server-upgrade
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Resolves: #1200728 [RFE] Replicate PKI Profile information
- Resolves: #1200735 [RFE] Allow issuing certificates for user accounts
- Resolves: #1204054 SSSD database is not cleared between installs and
uninstalls of ipa
- Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
Trusts
- Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
- Resolves: #1204504 [RFE] Add access control so hosts can create their own
services
- Resolves: #1206534 [RFE] Offer Kerberos over HTTP (kdcproxy) by default
- Resolves: #1206613 [RFE] Configure IPA to be a trust agent by default
- Resolves: #1209476 package ipa-client does not require package dbus-python
- Resolves: #1211589 [RFE] Add option to skip the verify_client_version
- Resolves: #1211608 [RFE] Generic support for unknown DNS RR types (RFC 3597)
- Resolves: #1215735 ipa-replica-prepare automatically adds a DNS zone
- Resolves: #1217010 OTP Manager field is not exposed in the UI
- Resolves: #1222475 krb5kdc : segfault at 0 ip 00007fa9f64d82bb sp
00007fffd68b2340 error 6 in libc-2.17.so
- Related: #1204809 Rebase ipa to 4.2
- Update to upstream 4.2.0
- Move /etc/ipa/kdcproxy to the server subpackage
- Hardening for CVE-2020-25717
- Rebuild against samba-4.14.5-11.el8
- Resolves: RHBZ#2021443
- PKI database is ugraded during replica installation (#1075118)
- Resolves: #1254689 Storing big file as a secret in vault raises traceback
- vault: Limit size of data stored in vault
- Resolves: #1255880 ipactl status should distinguish between different
pki-tomcat services
- ipactl: Do not start/stop/restart single service multiple times
- Upstream pre release FreeIPA 4.9.0rc3
Related: RHBZ#1891832
- Updated to upstream 3.0.0 GA
- Set minimum for samba to 4.0.0-153.
- Make sure server-trust-ad subpackage alternates winbind_krb5_locator.so
plugin to /dev/null since they cannot be used when trusts are configured
- Restrict krb5-server to 1.10.
- Update BR for 389-ds-base to 1.3.0
- Add directory /var/lib/ipa/pki-ca/publish for CRL published by pki-ca
- Add Requires on zip for generating FF browser extension
- Resolves: #1614301 Remove --no-sssd and --noac options
- Resolves: #1613879 Disable Domain Level 0
- New patch sets to disable domain level 0
- New adapted patch to disable DL0 specific tests (pytest_ipa vs.
pytest_plugins)
- Adapted branding patch in ipa-replica-install.1 due to DL0 removal
- Set mode of /etc/ipa/ca.crt to 0644 in CA-less installations
Resolves: RHBZ#1870202
- Resolves: #1475238 Use CommonNameToSANDefault in default profile
(new installs only)
- Restore old version of caIPAserviceCert for upgrade only
- Remove ipa-server-selinux obsoletes as upgrades from version prior to
3.3.0 are not allowed
- Wrap server-trust-ad subpackage description better
- Add (noreplace) flag for %{_sysconfdir}/tmpfiles.d/ipa.conf
- Change permissions on default_encoding_utf8.so to fix ipa-python Provides
- Use default crypto policy for TLS and enable TLS 1.3 support
Resolves: RHBZ#1777809
- Covscan fixes
Resolves: RHBZ#1777920
- Change pki_version to 10.8.0
Related: RHBZ#1748987
- Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
- Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
- Related: #1356134 'kinit -E' does not work for IPA user
- Add bash completion script and own /etc/bash_completion.d in case it
doesn't already exist
- Bump up minimum version of python-nss to pick up nss_is_initialize() API
- Updated to upstream 3.0.0 beta 1
- Resolves: #1416454 replication race condition prevents IPA to install
- wait_for_entry: use only DN as parameter
- Wait until HTTPS principal entry is replicated to replica
- Use proper logging for error messages
- Unable to remove replica by ipa-replica-manage (#1001662)
- Before uninstalling a server, warn about active replicas (#998069)
- Move initialization of Guests mapping after cifs/ principal is created
- Related: rhbz#1623895
- Upstream release FreeIPA 4.9.1
Related: RHBZ#1891832
- Fix mapping of BUILTIN\Guests to 'nobody' group during upgrade
to not use generated Samba config at this point
- Related: rhbz#1623895
- Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
- Increase default timeout for IPA services (#1033273)
- Error while running trustdomain-find (#1054376)
- group-show lists SID instead of name for external groups (#1054391)
- Fix IPA server NetBIOS name in samba configuration (#1030517)
- dnsrecord-mod produces missing API version warning (#1054869)
- Hide trust-resolve command as internal (#1052860)
- Add Trust domain Web UI (#1054870)
- ipasam cannot delete multiple child trusted domains (#1056120)
- Require 389-ds-base-legacy-tools for setup tools
- ipatests: Update ipa-adtrust-install test
Resolves: RHEL-40894
- Conditionally restart also dirsrv and httpd when upgrading
- IPA extdom plugin fails when encountering large groups (#1193759)
- CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
(#1202998)
- Added auto* BuildRequires
- Added httpd SELinux policy so CRLs can be read
- Revert DNSResolver Fix use of nameservers with ports.
Related: RHBZ#2141316
- Fix NetBIOS name generation in CLDAP plugin (#1030517)
- ipa-kdb: Fix double free in ipadb_reinit_mspac()
Resolves: RHEL-25742
- kra: set RSA-OAEP as default wrapping algo when FIPS is enabled
Resolves: RHEL-12153
- Vault: improve vault server archival/retrieval calls error handling
Resolves: RHEL-12153
- Vault: add support for RSA-OAEP wrapping algo
Resolves: RHEL-12153
- Fix postin scriplet for F-15/F-16
- Deletion of active subdomain range should not be allowed (#1075615)
- Fallback to global policy in ipa lockout plugin (#912725)
- Migration does not add users to default group (#903232)
- ipa-kdb: Make AD-SIGNEDPATH optional with krb5 DAL 8 and older
Resolves: RHEL-12198
- Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
tracked
- cert renewal: Include KRA users in Dogtag LDAP update
- cert renewal: Automatically update KRA agent PEM file
- Resolves: #1257163 renaming certificatte profile with --rename option leads
to integrity issues
- certprofile: remove 'rename' option
- Resolves: #1257968 kinit stop working after ipa-restore
- Backup: back up the hosts file
- Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
- DNSSEC: remove "DNSSEC is experimental" warnings
- Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
- Installer: do not modify /etc/hosts before user agreement
- Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
zone
- DNSSEC: backup and restore opendnssec zone list file
- DNSSEC: remove ccache and keytab of ipa-ods-exporter
- DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
- DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
- DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
key master
- DNSSEC: Fix key metadata export
- DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
- Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
- Using LDAPI to setup CA and KRA agents.
- Resolves: #1259848 server closes connection and refuses commands after
deleting user that is still logged in
- ldap: Make ldap2 connection management thread-safe again
- Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
'ra_certprofile' while ipa-ca-install
- load RA backend plugins during standalone CA install on CA-less IPA master
- Remove dependency on nss_ldap/nss-pam-ldapd
- The official client is sssd and that's what we use by default.
- Resolves: #1461177 ipa-otptoken-import - XML file is missing PBKDF2
parameters!
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
search in cn=ad, cn=trusts,dc=example,dc=com
- Resolves: #1467887 iommu platform support for ipxe
- Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic key for
host
- Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
4.5
- Resolves: #1480102 ipa-server-upgrade failes with "This entry already
exists"
- Resolves: #1482802 Unable to set ca renewal master on replica
- Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
(ipa-server-upgrade)
- Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
thus startup of Web UI fails
- Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
to self-signed CA
- Resolves: #1469246 Replica install fails to configure IPA-specific
temporary files/directories
- Resolves: #1469480 bind package is not automatically updated during
ipa-server upgrade process
- Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
installs only)
- Resolves: #1477703 IPA upgrade fails for latest ipa package
- Prevent multilib failures in *.pyo and *.pyc files
- Update dependencies for samba, 389-ds and sssd
Resolves: RHBZ#1792848
- Remove v1-style /etc/ipa/ipa.conf, replacing with /etc/ipa/default.conf
- Removed python-asset based webui
- Improve server affinity for CA-less deployments
Resolves: RHEL-22283
- host: update system: Manage Host Keytab permission
Resolves: RHEL-22286
- adtrustinstance: make sure NetBIOS name defaults are set properly
Resolves: RHEL-21938
- ipatests: Fix healthcheck report when nsslapd accesslog logbuffering is set to off
Resolves: RHEL-19672
- Resolves: #1377973 ipa-server-install fails when the provided or resolved
IP address is not found on local interfaces
- Only warn when specified server IP addresses don't match intf
- Resolves: #1438016 gssapi errors after IPA server upgrade
- Bump version of python-gssapi
- Resolves: #1457942 certauth: use canonical principal for lookups
- ipa-kdb: use canonical principal in certauth plugin
- Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
breaking older clients
- Add code to be able to set default kinit lifetime
- Revert setting sessionMaxAge for old clients
- Add missing entry for /var/cache/ipa/kpasswd (444624)
- Added patch to fix permissions problems with the Apache NSS database.
- Added patch to fix problem with DNS querying where the query could be
returned as the answer.
- Fix spec error where patch1 was in the wrong section
- Update to upstream 3.3.3 (#991064)
- Rebuild against samba4 beta7
- [WebUI] IPA Error 3007: RequirmentError" while adding members in
"User ID overrides" tab (updated)
Resolves: RHBZ#1757045
- ipa-client-install: use the authselect backup during uninstall
Resolves: RHBZ#1810179
- Replace SSLCertVerificationError with CertificateError for py36
Resolves: RHBZ#1858318
- Fix AVC denial during ipa-adtrust-install --add-agents
Resolves: RHBZ#1859213
- ipa-server-install fails if --subject parameter is other than default
realm (#983075)
- do not allow configuring bind-dyndb-ldap without persistent search (#967876)
- Lockout plugin crashed during ipa-server-install (#912725)
- Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
- ldap: limit the retro changelog to dns subtree
- Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
of "CA:FALSE" IPA CA CSR
- Include the CA basic constraint in CSRs when renewing a CA
- Resolves: #1493145 ipa-replica-install might fail because of an already
existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
- Checks if replica-s4u2proxy.ldif should be applied
- Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
- ds: ignore time skew during initial replication step
- ipa-replica-manage: implicitly ignore initial time skew in force-sync
- Resolves: #1500218 Replica installation at domain-level 0 fails against
upgraded ipa-server
- Fix ipa-replica-conncheck when called with --principal
- Resolves: #1506188 server-del doesn't remove dns-server configuration
from ldap
- Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
- Fix an integer underflow bug in libotp
- Resolves: #1262996 ipa vault internal error on replica without KRA
- install: always export KRA agent PEM file
- vault: select a server with KRA for vault operations
- Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
- do not overwrite files with local users/groups when restoring authconfig
- Renamed patch 1011 to 0138, as it was merged upstream
- Resolves: #1469246 Replica install fails to configure IPA-specific
temporary files/directories
- replica install: drop-in IPA specific config to tmpfiles.d
- Resolves: #1469480 bind package is not automatically updated during
ipa-server upgrade process
- Bumped Required version of bind-dyndb-ldap and bind package
- Set minimum version of sssd to 1.5.1
- Update to upstream freeipa-2.0.0.rc1
- Move server-only binaries from admintools subpackage to server
- Resolves: #1455946 Provide a tooling automating the configuration
of Smart Card authentication on a FreeIPA master
- smart-card advises: configure systemwide NSS DB also on master
- smart-card advises: add steps to store smart card signing CA cert
- Allow to pass in multiple CA cert paths to the smart card advises
- add a class that tracks the indentation in the generated advises
- delegate the indentation handling in advises to dedicated class
- advise: add an infrastructure for formatting Bash compound statements
- delegate formatting of compound Bash statements to dedicated classes
- Fix indentation of statements in Smart card advises
- Use the compound statement formatting API for configuring PKINIT
- smart card advises: use a wrapper around Bash `for` loops
- smart card advise: use password when changing trust flags on HTTP cert
- smart-card-advises: ensure that krb5-pkinit is installed on client
- Resolves: #1475238 Use CommonNameToSANDefault in default profile
(new installs only)
- Add CommonNameToSANDefault to default cert profile
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s
during search in cn=ad,cn=trusts,dc=example,dc=com
- NULL LDAP context in call to ldap_search_ext_s during search
- Fixed share/ipa/wsgi.py so .pyc, .pyo files are included
- No need to create /var/log/ipa_error.log since we aren't using
TurboGears any more.
- Update to upstream 2.1.0
- Upstream pre release FreeIPA 4.9.0rc2
Related: RHBZ#1891832
- Synchronize spec file with upstream and Fedora
Related: RHBZ#1891832
- Traceback while doing ipa-backup
Resolves: RHBZ#1901068
- ipa-client-install changes system wide ssh configuration
Resolves: RRBZ#1544379
- ipa-kdb: support subordinate/superior UPN suffixes
Resolves: RHBZ#1891056
- KRA Transport and Storage Certificates do not renew
Resolves: RHBZ#1872603
- Move where the restore state is marked during IPA server upgrade
Resolves: RHBZ#1569011
- Intermittent IdM Client Registration Failures
Resolves: RHBZ#1812871
- Nightly test failure in test_acme.py::TestACME::test_third_party_certs
(updates-testing)
Resolves: RHBZ#1903025
- Add IPA RA Agent to ACME group on the CA
Resolves: RHBZ#1902727
- Resolves: #1356102 Server uninstall does not stop tracking lightweight sub-CA
with certmonger
- uninstall: untrack lightweight CA certs
- Resolves: #1351807 ipa-nis-manage config.get_dn missing
- ipa-nis-manage: Use server API to retrieve plugin status
- Resolves: #1353452 ipa-compat-manage command failed,
exception: NotImplementedError: config.get_dn()
- ipa-compat-manage: use server API to retrieve plugin status
- Resolves: #1353899 ipa-advise: object of type 'type' has no len()
- ipa-advise: correct handling of plugin namespace iteration
- Resolves: #1356134 'kinit -E' does not work for IPA user
- kdb: check for local realm in enterprise principals
- Resolves: #1353072 ipa unknown command vault-add
- Enable vault-* commands on client
- vault-add: set the default vault type on the client side if none was given
- Resolves: #1353995 Default CA can be used without a CA ACL
- caacl: expand plugin documentation
- Resolves: #1356144 host-find should not print SSH keys by default, only
SSH fingerprints
- host-find: do not show SSH key by default
- Resolves: #1353506 ipa migrate-ds command fails for IPA in RHEL 7.3
- Removed unused method parameter from migrate-ds
- Expand the token auth/sync windows (#919228)
- Access is not rejected for disabled domain (#1172598)
- krb5kdc crash in ldap_pvt_search (#1170695)
- RHEL7.1 IPA server httpd avc denials after upgrade (#1164896)
- Ensure that /etc/ipa exists before moving user-modifiable html files there
- Put html files into /etc/ipa/html instead of /etc/ipa
- Replica CA installation: ignore skew during initial replication
Resolves RHEL-80995
- Update to upstream version 1.1.0
- Patch for indexing memberof attribute
- Patch for indexing uidnumber and gidnumber
- Patch to change DNA default values for replicas
- Patch to fix uninitialized variable in ipa-getkeytab
- Fix --external-ca-profile not passed to CSR
Resolves: RHBZ#1731813
- Upgrade: fix replica agreement, fix backported patch
Related: RHBZ#2216551
- Enforce uniqueness across krbprincipalname and krbcanonicalname
ipa-kdb: enforce PAC presence on TGT for TGS-REQ
ipatests: extend test for unique krbcanonicalname
Resolves: RHEL-110061
- Resolve: #1455946 Provide a tooling automating the configuration
of Smart Card authentication on a FreeIPA master
- server certinstall: update KDC master entry
- pkinit manage: introduce ipa-pkinit-manage
- server upgrade: do not enable PKINIT by default
- Extend the advice printing code by some useful abstractions
- Prepare advise plugin for smart card auth configuration
- Resolve: #1461053 allow to modify list of UPNs of a trusted forest
- trust-mod: allow modifying list of UPNs of a trusted forest
- WebUI: add support for changing trust UPN suffixes
- Rebuilt for glibc bug#747377
- Update to upstream freeipa-2.0.0.rc2
- Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
- Set minimum version of sssd to 1.5.1
- Patch to include SuiteSpotGroup when setting up 389-ds instances
- Move a lot of BuildRequires so this will build with ONLY_CLIENT enabled
- Added support for ipa_kpasswd and ipa_pwd_extop
- Rebase to upstream release 4.8.4
- Removed upstream patches 0001 to 0008 that are part of version 4.8.3-3
Resolves: RHBZ#1782658
Resolves: RHBZ#1782169
Resolves: RHBZ#1783046
Related: RHBZ#1748987
- Update to upstream GA release
- Automatically apply updates when the package is upgraded
- Remove ipa_webgui, its functions rolled into ipa_httpd
- kdb: keeep ipadb_get_connection() from succeding with null LDAP context
Resolves: RHEL-58453
- CVE-2019-14867: Denial of service in IPA server due to wrong use of ber_scanf()
Resolves: RHBZ#1767304
- CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
Resolves: RHBZ#1776939
- Removed python-cherrypy from BuildRequires and Requires
- Added Requires python-assets, python-wehjit
- Resolves: #1609883 ipaserver/plugins/cert.py: Add reason to raise of
errors.NotFound
- Resolves: #1615765 do-not-use-RC4-in-FIPS-mode
- Move fips_enabled to a common library to share across different plugins
- ipasam: do not use RC4 in FIPS mode
- Marked with wrong license. IPA is GPLv2.
- Update to upstream 3.2.0 Prerelease 1
- Use upstream reference spec file as a base for Fedora spec file
- Change Requires from fedora-ds-base to 389-ds-base
- Set minimum level of 389-ds-base to 1.2.6 for the replication
version plugin.
- Resolves: #747612 [RFE] IPA should support and manage DNS sites
- Resolves: #826790 Disabling password expiration (--maxlife=0 and --minlife=0)
in the default global_policy in IPA sets user's password expiration
(krbPasswordExpiration) to be 90 days
- Resolves: #896699 ipa-replica-manage -H does not delete DNS SRV records
- Resolves: #1084018 [RFE] Add IdM user password change support for legacy
client compat tree
- Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
aliases)
- Fix incorrect check for principal type when evaluating CA ACLs
- Resolves: #1146860 [RFE] Offer OTP generation for host enrollment in the UI
- Resolves: #1238190 ipasam unable to lookup group in directory yet manual
search works
- Resolves: #1250110 search by users which don't have read rights for all attrs
in search_attributes fails
- Resolves: #1263764 Show Certificate displays in useless format
- Resolves: #1272491 [WebUI] Certificate action dropdown does not display all
the options after adding new certificate
- Resolves: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.4.0
- Resolves: #1294503 IPA fails to issue 3rd party certs
- Resolves: #1298242 [RFE] API compatibility - compatibility of clients
- Resolves: #1298848 [RFE] Centralized topology management
- Resolves: #1298966 [RFE] Extend Smart Card support
- Resolves: #1315146 Multiple clients cannot join domain simultaneously:
/var/run/httpd/ipa/clientcaches race condition?
- Resolves: #1318903 ipa server install failing when SUBCA signs the cert
- Resolves: #1319003 ipa-winsync-migrate: Traceback should be fixed with proper
console output
- Resolves: #1324055 IPA always qualify requests for admin
- Resolves: #1328552 [RFE] Allow users to authenticate with alternative names
- Resolves: #1334582 Inconsistent UI and CLI options for removing certificate
hold
- Resolves: #1346321 Exclude o=ipaca subtree from Retro Changelog (syncrepl)
- Resolves: #1349281 Fix `Conflicts` with ipa-python
- Resolves: #1350695 execution of copy-schema script fails
- Resolves: #1351118 upgrade failed for RHEL-7.3 from RHEL-7.2.z
- Resolves: #1351153 AVC seen on Replica during ipa-server upgrade test
execution to 7.3
- Resolves: #1351276 ipa-server-install with dns cannot resolve itself to
create ipa-ca entry
- Related: #1343422 [RFE] Add GssapiImpersonate option
- Pull upstream changelog 698
- Fix ownership of /var/log/ipa_error.log during install (435119)
- Add pwpolicy command and man page
- Fix requirement for python3-kdcproxy, add no autoreqprov for ipatests sub
package
Related: RHBZ#1891832
- ipa-csreplica-manage connect fails (#1157735)
- error message which is not understandable when IDNA2003 characters are
present in --zonemgr (#1163849)
- Fix warning message should not contain CLI commands (#1114013)
- Renewing the CA signing certificate does not extend its validity period end
(#1163498)
- RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
httpd (#1159330)
- Make sure ipa-server depends on krb5-kdb-version to pick up
right MIT Kerberos KDB ABI
Related: RHBZ#1700121
- User field separator uses '$$' within ipaSELInuxUserMapOrder
Fixes: RHBZ#1729099
- Require the Python interpreter directly instead of using the package name
- Related: rhbz#1619153
- DNS install check: Fix overlapping DNS zone from the master itself
Resolves: RHBZ#1784003
- Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
Trusts
- winsync-migrate: Convert entity names to posix friendly strings
- winsync-migrate: Properly handle collisions in the names of external groups
- Resolves: #1261074 Adjust Firefox configuration to new extension signing
policy
- webui: use manual Firefox configuration for Firefox >= 40
- Resolves: #1263337 IPA Restore failed with installed KRA
- ipa-backup: Add mechanism to store empty directory structure
- Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
and private key in world readable file [rhel-7.2]
- install: fix KRA agent PEM file permissions
- Resolves: #1265086 Mark IdM API Browser as experimental
- WebUI: add API browser is experimental warning
- Resolves: #1265277 Fix kdcproxy user creation
- install: create kdcproxy user during server install
- platform: add option to create home directory when adding user
- install: fix kdcproxy user home directory
- Resolves: #1265559 GSS failure after ipa-restore
- destroy httpd ccache after stopping the service
- Resolves: #1432630 python2-jinja2 needed for python2-ipaclient
- Remove csrgen
- Resolves: #1432903 Set GssProxy options to enable caching of ldap tickets
- Add options to allow ticket caching
- Update to upstream version 1.2.0
- Set fedora-ds-base minimum version to 1.1.3 for winsync header
- Set the minimum version for SELinux policy
- Remove references to Fedora 7
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650139
- Added support for libipa-dna-plugin
- Rebuild to samba 4.17.2.
Related: RHBZ#2132051
- Update to upstream 4.7.0 GA
- ipatests: fix TestOTPToken::test_check_otpd_after_idle_timeout
Related: RHBZ#2053024
- Resolves: #1477703 IPA upgrade fails for latest ipa package
- Restore old version of caIPAserviceCert for upgrade only
- Reinstalling ipa server hangs when configuring certificate
server (#1018804)
- Allow longer dirsrv startup with systemd:
- IPAdmin class will wait until dirsrv instance is available up to 10 seconds
- Helps with restarts during upgrade for ipa-ldap-updater
- Fix pylint warnings from F16 and Rawhide
- selinux don't audit rules deny fetching trust topology
Resolves: RHBZ#1845596
- fix iPAddress cert issuance for >1 host/service
Resolves: RHBZ#1846352
- Specify cert_paths when calling PKIConnection
Resolves: RHBZ#1849155
- Update crypto policy to allow AD-SUPPORT when installing IPA
Resolves: RHBZ#1851139
- Add version to ipa-idoverride-memberof obsoletes
Related: RHBZ#1846434
- Resolves: #1365858 ipa-ca-install fails on replica when IPA Master is
installed without CA
- Set up DS TLS on replica in CA-less topology
- Resolves: #1398600 IPA replica install fails with dirsrv errors.
- Do not configure PKI ajp redirection to use "::1"
- Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
ca-del, ca-disable and ca-enable commands
- ca: correctly authorise ca-del, ca-enable and ca-disable
- Rebuild for Python 2.6
- Allow ipa-tests to work with older version (1.7.7) of python-paramiko
- Resolves: #1477367 ipa-server-upgrade timeouts on wait_for_open ports
expecting IPA services listening on IPv6 ports
- Make sure upgrade also checks for IPv6 stack
- control logging of host_port_open from caller
- log progress of wait_for_open_ports
- Resolves: #1477243 ipa help command returns traceback when no cache
is present
- Store help in Schema before writing to disk
- Disable pylint in get_help function because of type confusion.
- Require samba packages instead of obsoleted samba4 packages
- Fixed License in specfile
- Include files from /usr/lib/python*/site-packages/ipaserver
- Set the N-V-R so rc1 is an update to beta2.
- Resolves: #1452216 Replica installation grants HTTP principal
access in WebUI
- Make sure we check ccaches in all rpcserver paths
- Mass rebuild 2013-12-27
- Drop Requires of python-krbV on ipa-client
- Resolves: #828866 [RFE] enhance --subject option for ipa-server-install
- Resolves: #1160555 ipa-server-install: Cannot handle double hyphen "--" in
hostname
- Resolves: #1286288 Insufficient 'write' privilege to the 'ipaExternalMember'
attribute
- Resolves: #1321652 ipa-server-install fails when using external certificates
that encapsulate RDN components in double quotes
- Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
revocation reasons
- Resolves: #1340880 ipa-server-install: improve prompt on interactive
installation
- Resolves: #1353841 ipa-replica-install fails to install when resolv.conf
incomplete entries
- Resolves: #1356104 cert-show command does not display Subject Alternative
Names
- Resolves: #1357511 Traceback message seen when ipa is provided with invalid
configuration file name
- Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
converted from CA-less to CA-full
- Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
- Resolves: #1367572 improve error message in ipa migrate-ds: mention ipa
config-mod --enable-migration=TRUE
- Resolves: #1367868 Add options to retrieve lightweight CA certificate/chain
- Resolves: #1371927 Implement ca-enable/disable commands.
- Resolves: #1372202 Add Users into User Group editors fails to show Full names
- Resolves: #1373091 Adding an auth indicator from the CLI creates an extra
check box in the UI
- Resolves: #1375596 Ipa-server WebUI - long user/group name show wrong error
message
- Resolves: #1375905 "Normal" group type in the UI is confusing
- Resolves: #1376040 IPA client ipv6 - invalid --ip-address shows traceback
- Resolves: #1376630 IDM admin password gets written to
/root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
- Resolves: #1376729 ipa-server-install script option --no_hbac_allow should
match other options
- Resolves: #1378461 IPA Allows Password Reuse with History value defined when
admin resets the password.
- Resolves: #1379029 conncheck failing intermittently during single step
replica installs
- Resolves: #1379858 [RFE] better debugging for ipa-replica-conncheck
- Resolves: #1384310 ipa dnsrecord-add fails with Keyerror stack trace
- Resolves: #1392778 Update man page for ipa-adtrust-install by
removing --no-msdcs option
- Resolves: #1392858 Rebase to FreeIPA 4.5+
- Rebase to 4.5.0
- Resolves: #1399133 Delete option shouldn't be available for hosts applied to
view.
- Resolves: #1399190 [RFE] Certificates issued by externally signed IdM CA
should contain full trust chain
- Resolves: #1400416 RFE: Provide option to take backup of IPA server before
uninstalling IPA server
- Resolves: #1400529 cert-request is not aware of Kerberos principal aliases
- Resolves: #1401526 IPA WebUI certificates are grayed out on overview page but
not on details page
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- Resolves: #1404750 ipa-client-install fails to get CA cert via LDAP when
non-FQDN name of IPA server is first in /etc/hosts
- Resolves: #1409628 [RFE] Semi-automatic integration with external DNS using
nsupdate
- Resolves: #1413742 Backport request for bug/issue Change IP address
validation errors to warnings
- Resolves: #1415652 IPA replica install log shows password in plain text
- Resolves: #1427897 different behavior regarding system wide certs in master
and replica.
- Resolves: #1430314 The ipa-managed-entries command failed, exception:
AttributeError: ldap2
- Throw zonemgr error message before installation proceeds (#1163849)
- Winsync: Setup is broken due to incorrect import of certificate (#1169867)
- Enable last token deletion when password auth type is configured (#919228)
- ipa-otp-lasttoken loads all user's tokens on every mod/del (#1166641)
- add --hosts and --hostgroup options to allow/retrieve keytab methods
(#1007367)
- Extend host-show to add the view attribute in set of default attributes
(#1168916)
- Prefer TCP connections to UDP in krb5 clients (#919228)
- [WebUI] Not able to unprovisioning service in IPA 4.1 (#1168214)
- webui: increase notification duration (#1171089)
- RHEL7.1 ipa automatic CA cert renewal stuck in submitting state (#1166931)
- RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
(#1170003)
- Improve validation of --instance and --backend options in ipa-restore
(#951581)
- RHEL7.1 ipa replica unable to replicate to rhel6 master (#1167964)
- Disable TLS 1.2 in nss.conf until mod_nss supports it (#1156466)
- Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
error observed during ipa upgrade with latest package.
- ipa-server-install: fix uninstall
- Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
replica
- ca install: merge duplicated code for DM password
- installutils: add DM password validator
- ca, kra install: validate DM password
- Rebase to upstream release 4.8.2
- Removed upstream patches 0001 to 0010 that are part of version 4.8.2
- Updated branding patch
Resolves: RHBZ#1748987
- Update dependency for bind-dndb-ldap to 11.2-2
Related: RHBZ#1762813
- Upstream release FreeIPA 4.9.5
Related: RHBZ#1945038
- IPA to allow setting a new range type
Resolves: RHBZ#1688267
- ipa-server-install displays debug output when --debug output is not
specified.
Resolves: RHBZ#1943151
- ACME fails to generate a cert on migrated RHEL8.4 server
Resolves: RHBZ#1934991
- Switch ipa-client to use the JSON API
Resolves: RHBZ#1937856
- IDM - Allow specifying permanent logging settings for BIND
Resolves: RHBZ#1951511
- Cache LDAP data within a request
Resolves: RHBZ#1953656
- ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4
Resolves: RHBZ#1957768
- Rebuild for broken deps
- Fix 389-ds-base strict dep to be 1.3.0.5 and krb5-server 1.11.1
- Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
- Re-adding existing trust fails (#1033216)
- IPA uninstall exits with a samba error (#1033075)
- Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
- Fixed ownership of /usr/share/ipa/ui/js (#1026260)
- ipa-tests: support external names for hosts (#1032668)
- ipa-client-install fail due fail to obtain host TGT (#1029354)
- Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
by abusing password policy
- ipa-kdb: search for password policies globally
- Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream
- [ipa-python] ipalib.errors.LDAPError: failed to decode certificate:
(SEC_ERROR_INVALID_ARGS) security library: invalid arguments. (#1194312)
- Set krb5 DAL version to 7.0 (#1580711)
- Rebuild aclocal and configure during build
- hbactest does not work for external users (#848531)
- Resolves: #1443869 Command "openssl pkcs12 ..." failed during IPA upgrade
- Fix CAInstance.import_ra_cert for empty passwords
- New upstream release 4.8.0
- New subpackage: freeipa-client-samba
- Added command ipa-cert-fix with man page
- New sysconfdir sysconfig/certmonger
- Updated pki_version, certmonger_version, sssd_version and kdcproxy_version
Related: RHBZ#1684528
- Update to upstream 2.2.0 beta 1 (2.1.90.rc1)
- Set minimum n-v-r for pki-ca and pki-silent to 9.0.18.
- Add Conflicts on mod_ssl
- Update minimum n-v-r of 389-ds-base to 1.2.10.4
- Update minimum n-v-r of sssd to 1.8.0
- Update minimum n-v-r of slapi-nis to 0.38
- Update minimum n-v-r of pki-* to 9.0.18
- Update conflicts on bind-dyndb-ldap to < 1.1.0-0.9.b1
- Update conflicts on bind to < 9.9.0-1
- Drop requires on krb5-server-ldap
- Add patch to remove escaping arguments to pkisilent
- Re-add accidentally removed patches for #1170695 and #1164896
- Fix wrong path in packaging freeipa-systemd-upgrade
- Create systemd-user HBAC service and rule
Resolves: RHBZ#1664974
- ipaserver/dcerpc: fix exclusion entry with a forest trust domain info returned
Resolves: RHBZ#1664023
- trustdomain-find with pkey-only fails (#1068611)
- Invalid credential cache in trust-add (#1069182)
- ipa-replica-install prints unexpected error (#1069722)
- Too big font in input fields in details facet in Firefox (#1069720)
- trust-add for POSIX AD does not fetch trustdomains (#1070925)
- Misleading trust-add error message in some cases (#1070926)
- Access is not rejected for disabled domain (#1070924)
- Set minimum level of sssd to 1.1.1 to pull in required hbac fixes.
- Add OTP patches
- Add patch to set KRB5CCNAME for 389-ds-base
- Resolves: #1431520 ipa cert-find runs a large number of searches, so IPA
WebUI is slow to display user details page
- cert: defer cert-find result post-processing
- Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
helper when installing replica
- server-install: No double Kerberos install
- Resolves: #1437502 ipa-replica-install fails with requirement to
use --force-join that is a client install option.
- Add the force-join option to replica install
- replicainstall: better client install exception handling
- Resolves: #1437953 Server CA-less impossible option check
- server-install: remove broken no-pkinit check
- Resolves: #1441160 FreeIPA client <= 4.4 fail to parse 4.5 cookies
- Add debug log in case cookie retrieval went wrong
- Resolves: #1441548 ipa server install fails with --external-ca option
- ext. CA: correctly write the cert chain
- Resolves: #1441718 Conversion of CA-less server to CA fails on CA instance
spawn
- Fix CA-less to CA-full upgrade
- Resolves: #1442133 Do not link libkrad, liblber, libldap_r and
libsss_nss_idmap to every binary in IPA
- configure: fix AC_CHECK_LIB usage
- Resolves: #1442815 Replica install fails during migration from older IPA
master
- Fix RA cert import during DL0 replication
- Related: #1442004 Building IdM/FreeIPA internally on all architectures -
filtering unsupported packages
- Build all subpackages on all architectures
- Hardening for CVE-2020-25717
- Harden processing of trusted domains' users in S4U operations
- Resolves: RHBZ#2021443
- Updated to upstream 2.2.0 GA
- Update minimum n-v-r of certmonger to 0.53
- Update minimum n-v-r of slapi-nis to 0.40
- Add Requires in client to oddjob-mkhomedir and python-krbV
- Update minimum selinux-policy to 3.10.0-110
- 4.7.1
- Fixes: rhbz#1633105 - rebase to 4.7.1
- Fix otptoken_sync plugin
Resolves: RHBZ#1777811
- Fix automount behavior with authselect
Resolves: RHBZ#1740167
- Require mod_nss-1.0.7-2 for mod_proxy fixes
- Pull upstream changelog 678
- Add new subpackage, ipa-server-selinux
- Add Requires: authconfig to ipa-python (bz #433747)
- Package i18n files
- Fix breakage caused by python-kerberos update to 1.1
- Fix Requires for krb5-server that was missing for Fedora versions > 9
- Remove quotes around test for fedora version to package egg-info
- Load ipa_dogtag.pp in post install
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- user-undel: Fix error messages.
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Prohibit deletion of predefined profiles
- Resolves: #1232819 testing ipa-restore on fresh system install fails
- Backup/resore authentication control configuration
- Resolves: #1243331 pkispawn fails when migrating to 4.2 server from 3.0
server
- Require Dogtag PKI >= 10.2.6
- Resolves: #1245225 Asymmetric vault drops traceback when the key is not
proper
- Asymmetric vault: validate public key in client
- Resolves: #1248399 Missing DNSSEC related files in backup
- fix typo in BasePathNamespace member pointing to ods exporter config
- ipa-backup: archive DNSSEC zone file and kasp.db
- Resolves: #1248405 PassSync should be disabled after ipa-winsync-migrate is
finished
- winsync-migrate: Add warning about passsync
- winsync-migrate: Expand the man page
- Resolves: #1248524 User can't find any hosts using "ipa host-find $HOSTNAME"
- adjust search so that it works for non-admin users
- Resolves: #1250093 ipa certprofile-import accepts invalid config
- Require Dogtag PKI >= 10.2.6
- Resolves: #1250107 IPA framework should not allow modifying trust on AD trust
agents
- trusts: Detect missing Samba instance
- Resolves: #1250111 User lifecycle - preserved users can be assigned
membership
- ULC: Prevent preserved users from being assigned membership
- Resolves: #1250145 Add permission for user to bypass caacl enforcement
- Add permission for bypassing CA ACL enforcement
- Resolves: #1250190 idrange is not added for sub domain
- idranges: raise an error when local IPA ID range is being modified
- trusts: harden trust-fetch-domains oddjobd-based script
- Resolves: #1250928 Man page for ipa-server-install is out of sync
- install: Fix server and replica install options
- Resolves: #1251225 IPA default CAACL does not allow cert-request for services
after upgrade
- Fix default CA ACL added during upgrade
- Resolves: #1251561 ipa vault-add Unknown option: ipavaultpublickey
- validate mutually exclusive options in vault-add
- Resolves: #1251579 ipa vault-add --user should set container owner equal to
user on first run
- Fixed vault container ownership.
- Resolves: #1252517 cert-request rejects request with correct
krb5PrincipalName SAN
- Fix KRB5PrincipalName / UPN SAN comparison
- Resolves: #1252555 ipa vault-find doesn't work for services
- vault: Add container information to vault command results
- Add flag to list all service and user vaults
- Resolves: #1252556 Missing CLI param and ACL for vault service operations
- Added CLI param and ACL for vault service operations.
- Resolves: #1252557 certprofile: improve profile format documentation
- certprofile-import: improve profile format documentation
- certprofile: add profile format explanation
- Resolves: #1253443 ipa vault-add creates vault with invalid type
- vault: validate vault type
- Resolves: #1253480 ipa vault-add-owner does not fail when adding an existing
owner
- baseldap: Allow overriding member param label in LDAPModMember
- vault: Fix param labels in output of vault owner commands
- Resolves: #1253511 ipa vault-find does not use criteria
- vault: Fix vault-find with criteria
- Resolves: #1254038 ipa-replica-install pk12util error returns exit status 10
- install: Fix replica install with custom certificates
- Resolves: #1254262 ipa-dnskeysync-replica crash cannot contact kdc
- improve the handling of krb5-related errors in dnssec daemons
- Resolves: #1254412 when dirsrv is off ,upgrade from 7.1 to 7.2 fails with
starting CA and named-pkcs11.service
- Server Upgrade: Start DS before CA is started.
- Resolves: #1254637 Add ACI and permission for managing user userCertificate
attribute
- add permission: System: Manage User Certificates
- Resolves: #1254641 Remove CSR allowed-extensions restriction
- cert-request: remove allowed extensions check
- Resolves: #1254693 vault --service does not normalize service principal
- vault: normalize service principal in service vault operations
- Resolves: #1254785 ipa-client-install does not properly handle dual stacked
hosts
- client: Add support for multiple IP addresses during installation.
- Add dependency to SSSD 1.13.1
- client: Add description of --ip-address and --all-ip-addresses to man page
- Remove dependency on python-paramiko (#1002884)
- Broken redirection when deleting last entry of DNS resource
record (#1006360)
- "an internal error has occurred" during ipa host-del --updatedns (#1198431)
- Renamed patch 1013 to 0114, as it was merged upstream
- Fax number not displayed for user-show when kinit'ed as normal user.
(#1198430)
- Replication agreement with replica not disabled when ipa-restore done without
IPA installed (#1199060)
- Limit deadlocks between DS plugin DNA and slapi-nis (#1199128)
- Build radius separately
- Fix a few minor issues
- Broke invididual Requires and BuildRequires onto separate lines and
reordered them
- Added python-tgexpandingformwidget as a dependency
- Require at least fedora-ds-base 1.1
- Server install failure during client enrollment shouldn't
roll back (#1023086)
- nsds5ReplicaStripAttrs are not set on agreements (#1023085)
- ipa-server conflicts with mod_ssl (#1018172)
- Update to upstream 3.3.2 (#991064)
- Add delegation info to MS-PAC (#915799)
- Warn about incompatibility with AD when IPA realm and domain
differs (#1009044)
- Allow PKCS#12 files with empty password in install tools (#1002639)
- Privilege "SELinux User Map Administrators" did not list
permissions (#997085)
- SSH key upload broken when client joins an older server (#1009024)
- Set minimum pki-ca and pki-silent versions to 9.0.0
- Set krbCanonicalName admin@REALM on the admin user
Resolves: RHEL-89895
- Rebuild against samba4 beta4
- Resolves: #1361119 UPN-based search for AD users does not match an entry in
slapi-nis map cache
- support multiple uid values in schema compatibility tree
- Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
version to 1.0.7-4 so we pick up the NSS fixes.
- Add selinux-policy-base(post) to Requires (446496)
- Resolves: #1296140 Remove redhat-access-plugin-ipa support
- Obsolete and conflict redhat-access-plugin-ipa
- Resolves: #1351119 Multiple issues while uninstalling ipa-server
- server uninstall fails to remove krb principals
- Resolves: #1351758 ipa commands not showing expected error messages
- frontend: copy command arguments to output params on client
- Show full error message for selinuxusermap-add-hostgroup
- Resolves: #1352883 Traceback on adding default automember group and hostgroup
set
- allow 'value' output param in commands without primary key
- Resolves: #1353888 Fix the help for ipa otp and other topics
- schema: Fix subtopic -> topic mapping
- Resolves: #1354348 ipa trustconfig-show throws internal error.
- allow 'value' output param in commands without primary key
- Resolves: #1354381 ipa trust-add with raw option gives internal error.
- trust-add: handle `--all/--raw` options properly
- Resolves: #1354493 Replica install fails with old IPA master
- DNS install: Ensure that DNS servers container exists
- Resolves: #1354628 ipa hostgroup-add-member does not return error message
when adding itself as member
- frontend: copy command arguments to output params on client
- Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
- messages: specify message type for ResultFormattingError
- Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
secret key
- expose `--secret` option in radiusproxy-* commands
- prevent search for RADIUS proxy servers by secret
- Resolves: #1356099 Bug in the ipapwd plugin
- Heap corruption in ipapwd plugin
- Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
client changes
- Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
- Resolves: #1356964 Renaming a user removes all of his principal aliases
- Preserve user principal aliases during rename operation
- Require slapi-nis 0.47.7 delivering a core feature of 3.3.0 release
- ipa man page format the EXAMPLES section
Resolves: RHBZ#2129895
- Fix canonicalization issue in Web UI
Resolves: RHBZ#2127035
- Remove idnssoaserial argument from dns zone API.
Resolves: RHBZ#2108630
- Warn for permissions with read/write/search/compare and no attrs
Resolves: RHBZ#2098187
- Add PKINIT support to ipa-client-install
Resolves: RHBZ#2075452
- Generate CNAMEs for TXT+URI location krb records
Resolves: RHBZ#2104185
- Vault: fix interoperability issues with older RHEL systems
Resolves: RHBZ#2144737
- Fix typo on ipaupgrade.log chmod during RPM %post snipppet
Resolves: RHBZ#2140994
- Set minimum of python-pyasn1 to 0.0.9a so we have support for the ASN.1
Any type
- Remove ipa-server dependency from ipa-selinux subpackage
- Related: RHBZ#1891832
- clean up spec
- Depend on sssd >= 1.6.2 for better user experience
- webui: Do not allow empty pagination size
Resolves: RHBZ#2094672
- [WebUI] IPA Error 3007: RequirmentError" while adding members in
"User ID overrides" tab
Resolves: RHBZ#1757045
- EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in
freeipa-client-epn
Resolves: RHBZ#1847999
- FreeIPA - Utilize 256-bit AJP connector passwords
Resolves: RHBZ#1849914
- ipa: typo issue in ipanthomedirectoryrive deffinition
Resolves: RHBZ#1851411
- FreeIPA 4.8.0 tarball lacks two update files that are in git
Resolves: RHBZ#1741170
- Proxy PKI URI /ca/ee/ca/profileSubmit to enable replication with future
PKI versions (#1080865)
- kdb: apply combinatorial logic for ticket flags (CVE-2024-3183)
Resolves: RHEL-29927
- kdb: fix vulnerability in GCD rules handling (CVE-2024-2698)
Resolves: RHEL-29692
- Drop workaround for building on AArch64 (#1482244)
- Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)
- schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
build fails (#1167196)
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
- "ipa trust-add ... " cmd says : (Trust status: Established and verified)
while in the logs we see "WERR_ACCESS_DENIED" during verification step.
(#1144121)
- POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
(#1156466)
- Add support/hooks for a one-time password system like SecureID in IPA
(#919228)
- Tracebacks with latest build for --zonemgr cli option (#1167270)
- ID Views: Support migration from the sync solution to the trust solution
(#891984)
- Remove posixAccount from service_find search filter
Resolves: RHBZ#1731437
- Fix repeated uninstallation of ipa-client-samba crashes
Resolves: RHBZ#1732529
- WebUI: Add PKINIT status field to 'Configuration' page
Resolves: RHBZ#1518153
- Resolve user/group names in idoverride*-find
Resolves: RHBZ#1657745
- Configure CA replication to use TLS instead of SSL
- New command automember-find-orphans to find and remove orphan automemeber
rules has been added
Resolves: RHBZ#1638373
- Moved ipa/idm logos and background to redhat-logos-ipa-80.4:
header-logo.png, login-screen-background.jpg, login-screen-logo.png,
product-name.png
New requirement to redhat-logos-ipa >= 80.4 in ipa-server-common
Resolves: RHBZ#1626507
- Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
users in IdM
- store certificates issued for user entries as
- user-show: add --out option to save certificates to file
- Resolves: #1145748 [RFE] IPA running with One Way Trust
- Fix upgrade of sidgen and extdom plugins
- Resolves: #1195339 ipa-client-install changes the label on various files
which causes SELinux denials
- Use 'mv -Z' in specfile to restore SELinux context
- Resolves: #1198796 Text in UI should describe differing LDAP vs Krb behavior
for combinations of "User authentication types"
- webui: add LDAP vs Kerberos behavior description to user auth
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- ULC: Fix stageused-add --from-delete command
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- certprofile-import: do not require profileId in profile data
- Give more info on virtual command access denial
- Allow SAN extension for cert-request self-service
- Add profile for DNP3 / IEC 62351-8 certificates
- Work around python-nss bug on unrecognised OIDs
- Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
- Validate vault's file parameters
- Fixed missing KRA agent cert on replica.
- Resolves: #1225866 display browser config options that apply to the browser.
- webui: add Kerberos configuration instructions for Chrome
- Remove ico files from Makefile
- Resolves: #1246342 Unapply idview raises internal error
- idviews: Check for the Default Trust View only if applying the view
- Resolves: #1248102 [webui] regression - incorrect/no failed auth messages
- webui: fix regressions failed auth messages
- Resolves: #1248396 Internal error in DomainValidator.__search_in_dc
- dcerpc: Fix UnboundLocalError for ccache_name
- Resolves: #1249455 ipa trust-add failed CIFS server configuration does not
allow access to \\pipe\lsarpc
- Fix selector of protocol for LSA RPC binding string
- dcerpc: Simplify generation of LSA-RPC binding strings
- Resolves: #1250192 Error in ipa trust-fecth-domains
- Fix incorrect type comparison in trust-fetch-domains
- Resolves: #1251553 Winsync setup fails with unexpected error
- replication: Fix incorrect exception invocation
- Resolves: #1251854 ipa aci plugin is not parsing aci's correctly.
- ACI plugin: correctly parse bind rules enclosed in
- Resolves: #1252414 Trust agent install does not detect available replicas to
add to master
- adtrust-install: Correctly determine 4.2 FreeIPA servers
- Introduce upgrade script to recover existing configuration after systemd migration
as user has no means to recover FreeIPA from systemd migration
- Upgrade script:
- recovers symlinks in Dogtag instance install
- recovers systemd configuration for FreeIPA's directory server instances
- recovers freeipa.service
- migrates directory server and KDC configs to use proper keytabs for systemd services
- Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
- Remove references to admin server in ipa-server-setupssl
- Generate a client certificate for the XML-RPC server to connect to LDAP with
- Create a keytab for Apache
- Create an ldif with a test user
- Provide a certmap.conf for doing SSL client authentication
- Update to 4.7.90-pre1
Related: RHBZ#1684528
- Removed patches 0002 to 0031 as these are upsteram and part of 4.7.90-pre1
- Added new patches 0001-revert-minssf-defaults.patch and
0001-Correct-default-fontawesome-path-broken-by-da2cf1c5.patch
- Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
- Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
- Resolves: #1341249 Subsequent external CA installation fails
- install: fix external CA cert validation
- Resolves: #1353831 ipa-server-install fails in container because of
hostnamectl set-hostname
- server-install: Fix --hostname option to always override api.env values
- install: Call hostnamectl set-hostname only if --hostname option is used
- Resolves: #1356091 ipa-cacert-manage --help and man differ
- Improvements for the ipa-cacert-manage man and help
- Resolves: #1360631 ipa-backup is not keeping the
/etc/tmpfiles.d/dirsrv-.conf
- ipa-backup: backup /etc/tmpfiles.d/dirsrv-.conf
- Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
file is needed
- Update ipa-replica-install documentation
- Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
not rpm-require it
- client: RPM require initscripts to get *-domainname.service
- Resolves: #1364197 caacl: error when instantiating rules with service
principals
- caacl: fix regression in rule instantiation
- Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
- parameters: move the `confirm` kwarg to Param
- Resolves: #1364464 Topology graph: ca and domain adders shows question marks
instead of plus icon
- Fix unicode characters in ca and domain adders
- Resolves: #1365083 Incomplete output returned for command ipa vault-add
- client: add missing output params to client-side commands
- Resolves: #1365526 build fails during "make check"
- ipa-kdb: Fix unit test after packaging changes in krb5
- Rebase to security release 4.8.3 (CVE-2019-14867, CVE-2019-10195)
Resolves: RHBZ#1767304
Resolves: RHBZ#1776939
- Support KDC ticket policies for authentication indicators
Resolves: RHBZ#1777564
- Fix misleading errors during client install rollback
Resolves: RHBZ#1658283
- ipa-advise: update url of cacerdir_rehash tool
Resolves: RHBZ#1658287
- Handle NTP configuration in a replica server installation
Resolves: RHBZ#1651679
- Fix defects found by static analysis
Resolves: RHBZ#1658182
- ipa-replica-install --setup-adtrust: check for package ipa-server-trust-ad
Resolves: RHBZ#1658294
- ipaldap: invalid modlist when attribute encoding can vary
Resolves: RHBZ#1658302
- Allow ipaapi and Apache user to access SSSD IFP
Resolves: RHBZ#1639910
- Add sysadm_r to default SELinux user map order
Resolves: RHBZ#1658303
- certdb: ensure non-empty Subject Key Identifier and validate server cert sig
Resolves: RHBZ#1641988
- ipa-replica-install: password and admin-password options mutually exclusive
Resolves: RHBZ#1658309
- ipa upgrade: handle double-encoded certificates
Resolves: RHBZ#1658310
- PKINIT: fix ipa-pkinit-manage enable|disable
Resolves: RHBZ#1658313
- Enable LDAP debug output in client to display TLS errors in join
Resolves: RHBZ#1658316
- rpc: always read response
Resolves: RHBZ#1639890
- ipa vault-retrieve: fix internal error
Resolves: RHBZ#1658485
- Move ipa's systemd tmpfiles from /var/run to /run
Resolves: RHBZ#1658487
- Fix authselect invocations to work with 1.0.2
Resolves: RHBZ#1654291
- ipa-client-automount and NFS unit name changes
Resolves: RHBZ#1645501
- Fix compile issue with new 389-ds
Resolves: RHBZ#1659448
- ipatests: fix test_topology
Resolves: RHBZ#2232351
- Installer: activate nss and pam services in sssd.conf
Resolves: RHBZ#2216532
- Update to upstream 4.1.0 (#1109726)
- Re-enable otptoken_yubikey plugin
- Convert to autotools-based build
- Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
because of missing dependencies
- Rebuild with krb5-1.14.1
- Update to upstream 3.3.0 (#991064)
- Set 0.14 as minimum version for slapi-nis
- ipa-client-automount fails with incompatibility error when installed against
older IPA server (#1083108)
- Server installation fails using external signed certificates with
"IndexError: list index out of range" (#1111320)
- Add rhino to BuildRequires to fix Web UI build error
- Abstracted client class to work directly or over RPC
- Fix S4U2Self regression for cross-realm requester SID buffer
- Related: RHBZ#2021443
- Add dep for freeipa-admintools and acl
- Add Requires: python-nss to ipa-python sub-package
- Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
- python2-ipalib: add missing python dependency
- installer service: fix typo in service entry
- upgrade: add missing suffix to http instance
- Resolves: #1444791 Update man page of ipa-kra-install
- ipa-kra-install manpage: document domain-level 1
- Resolves: #1441493 ipa cert-show raises stack traces when
--certificate-out=/tmp
- cert-show: writable files does not mean dirs
- Resolves: #1441192 Add the name of URL parameter which will be check for
username during cert login
- Bump version of ipa.conf file
- Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
- Turn on NSSOCSP check in mod_nss conf
- Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
template on
- renew agent: respect CA renewal master setting
- server upgrade: always fix certmonger tracking request
- cainstance: use correct profile for lightweight CA certificates
- renew agent: allow reusing existing certs
- renew agent: always export CSR on IPA CA certificate renewal
- renew agent: get rid of virtual profiles
- ipa-cacert-manage: add --external-ca-type
- Resolves: #1441593 error adding authenticator indicators to host
- Fixing adding authenticator indicators to host
- Resolves: #1449525 Set directory ownership in spec file
- Added plugins directory to ipaclient subpackages
- ipaclient: fix missing RPM ownership
- Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
- otptoken-add-yubikey: When --digits not provided use default value
- Upstream release FreeIPA 4.9.2
Related: RHBZ#1891832
- Rebuild for broken deps in rawhide
- Fix 389-ds-base strict dep to be 1.3.0.3
- Move ipa-tests package to separate srpm (#1032668)
- Don't always override the port in import_included_profiles
Fixes: RHBZ#2022483
- Remove ipa-join errors from behind the debug option
Fixes: RHBZ#2048558
- Enable the ccache sweep timer during installation
Fixes: RHBZ#2051575
- ipa-replica-install never checks for 7389 port (#1075165)
- Non-terminated string may be passed to LDAP search (#1075091)
- ipa-sam may fail to translate group SID into GID (#1073829)
- Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
- Update to upstream version 1.0.0
- rpcserver: validate Kerberos principal name before running kinit
Resolves: RHEL-26153
- Vault: add additional fallback to RSA-OAEP wrapping algo
Resolves: RHEL-28259
- Set min version of 389-ds-base to 1.2.8
- Set min version of mod_nss 1.0.8-10
- Set min version of selinux-policy to 3.9.7-27
- Add dogtag themes to Requires
- Update to upstream freeipa-2.0.0.pre2
- Resolves: #1339483 ipa-server-install fails with ERROR pkinit_cert_files
- Fix incorrect rebase of patch 1001
- Fixed weekday in 4.8.4-2 changelog date
Related: RHBZ#1784003
- adtrust: print DNS records for external DNS case after role is enabled
Resolves: RHBZ#1665051
- AD user without override receive InternalServerError with API
Resolves: RHBZ#1782572
- ipa-client-automount fails after repeated installation/uninstallation
Resolves: RHBZ#1790886
- install/updates: move external members past schema compat update
Resolves: RHBZ#1803165
- kdb: make sure audit_as_req callback signature change is preserved
Resolves: RHBZ#1803786
- Resolves: #1449189 ipa-kra-install timeouts on replica
- kra: promote: Get ticket before calling custodia
- Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
- Fix ipa-server-install in pure IPv6 environment
- Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
reachable via the forest root
- trust: make sure ID range is created for the child domain even if it exists
- ipa-kdb: simplify trusted domain parent search
- Resolves: #1335567 Update Warning in IdM Web UI API browser
- WebUI: add API browser is tech preview warning
- Resolves: #1348560 Mulitple domain Active Directory Trust conflict
- ipaserver/dcerpc: reformat to make the code closer to pep8
- trust: automatically resolve DNS trust conflicts for triangle trusts
- Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
certificate revocation
- cert-revoke: fix permission check bypass (CVE-2016-5404)
- Resolves: #1353936 custodia.conf and server.keys file is world-readable.
- Remove Custodia server keys from LDAP
- Secure permissions of Custodia server.keys
- Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
converted from CA-less to CA-full
- custodia: include known CA certs in the PKCS#12 file for Dogtag
- custodia: force reconnect before retrieving CA certs from LDAP
- Resolves: #1362333 ipa vault container owner cannot add vault
- Fix: container owner should be able to add vault
- Resolves: #1365546 External trust with root domain is transitive
- trust: make sure external trust topology is correctly rendered
- Resolves: #1365572 IPA server broken after upgrade
- Require pki-core-10.3.3-7
- Resolves: #1367864 Server assumes latest version of command instead of
version 1 for old / 3rd party clients
- rpcserver: assume version 1 for unversioned command calls
- rpcserver: fix crash in XML-RPC system commands
- Resolves: #1367773 thin client ignores locale change
- schema cache: Fallback to 'en_us' when locale is not available
- Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
- Fail on topology disconnect/last role removal
- Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
- otptoken, permission: Convert custom type parameters on server
- Resolves: #1369414 ipa server-del fails with Python stack trace
- Handled empty hostname in server-del command
- Resolves: #1369761 ipa-server must depend on a version of httpd that support
mod_proxy with UDS
- Require httpd 2.4.6-31 with mod_proxy Unix socket support
- Resolves: #1370512 Received ACIError instead of DuplicatedError in
stageuser_tests
- Raise DuplicatedEnrty error when user exists in delete_container
- Resolves: #1371479 cert-find --all does not show information about revocation
- cert: add missing param values to cert-find output
- Renamed patch 1011 to 0100, as it was merged upstream
- Add BuildRequires for authconfig
- Add explicit dependency for libvert-libev
Resolves: RHBZ#2104929
- ipatests: Backport test fixes in python3-ipatests.
Resolves: RHBZ#2057505
- Rely on sssd-krb5 to include SSSD-generated krb5 configuration
Resolves: RHBZ#2214563
- Refactor ipatests for unique krbcanonicalname
Resolves: RHEL-110061
- Move ipalib to ipa-python subpackage
- Bump minimum version of slapi-nis to 0.15
- Remove client-epn left over files for ONLY_CLIENT
Related: RHBZ#1847999
- Resolves: #1252556 Missing CLI param and ACL for vault service operations
- vault: fix private service vault creation
- Update to upstream 2.1.4 (CVE-2011-3636)
- Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
by abusing password policy
- password policy: Add explicit default password policy for hosts and
services
- Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
certprofile-mod
- certprofile-mod: correctly authorise config update
- Update to upstream 4.1.0 Alpha 1 (#1109726)
- PKI service restart after CA renewal failed (#1040018)
- Preverse mode on ipa-keytab-util
- Version bump for relase and rpm name change
- Resolves: #1318186 Misleading error message during external-ca IPA master
install
- httpinstance: make sure NSS database is backed up
- Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
CA certificate chain in ... incomplete"
- httpinstance: make sure NSS database is backed up
- Resolves: #1393726 Enumerate all available request type options in ipa
cert-request help
- Hide request_type doc string in cert-request help
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- spec file: bump libsss_nss_idmap-devel BuildRequires
- server: make sure we test for sss_nss_getlistbycert
- Resolves: #1437378 ipa-adtrust-install produced an error and failed on
starting smb when hostname is not FQDN
- adtrust: make sure that runtime hostname result is consistent with the
configuration
- Resolves: #1437555 ipa-replica-install with DL0 fails to get annonymous
keytab
- Always check and create anonymous principal during KDC install
- Remove duplicate functionality in upgrade
- Resolves: #1437946 Upgrade to FreeIPA 4.5.0 does not configure anonymous
principal for PKINIT
- Upgrade: configure PKINIT after adding anonymous principal
- Remove unused variable from failed anonymous PKINIT handling
- Split out anonymous PKINIT test to a separate method
- Ensure KDC is propery configured after upgrade
- Resolves: #1437951 Remove pkinit-related options from server/replica-install
on DL0
- Fix the order of cert-files check
- Don't allow setting pkinit-related options on DL0
- replica-prepare man: remove pkinit option refs
- Remove redundant option check for cert files
- Resolves: #1438490 CA-less installation fails on publishing CA certificate
- Get correct CA cert nickname in CA-less
- Remove publish_ca_cert() method from NSSDatabase
- Resolves: #1438838 Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
- IPA-KDB: use relative path in ipa-certmap config snippet
- Resolves: #1439038 Allow erasing ipaDomainResolutionOrder attribute
- Allow erasing ipaDomainResolutionOrder attribute
- Upstream release FreeIPA 4.8.6
- New SELinux sub package to provide own module
- Depend on selinux-policy-devel 3.14.3-43 for build due to a makefile issue in
SELinux external policy support
Related: RHBZ#1818765
- CAless installation: set the perms on KDC cert file
Resolves: RHBZ#1863616
- EPN: handle empty attributes
Resolves: RHBZ#1866938
- IPA-EPN: enhance input validation
Resolves: RHBZ#1866291
- EPN: enhance input validation
Resolves: RHBZ#1863079
- Require new samba build 4.12.3-52
Related: RHBZ#1868558
- Require new selinux-policy build 3.14.3-52
Related: RHBZ#1869311
- Resolves: #1398670 Check IdM Topology for broken record caused by replication
conflict before upgrading it
- Check for conflict entries before raising domain level
- package the sessions dir /var/cache/ipa/sessions
- Pull upstream changelog 597
- Add call to /usr/sbin/upgradeconfig to post install
- Resolves: #1262996 ipa vault internal error on replica without KRA
- upgrade: make sure ldap2 is connected in export_kra_agent_pem
- Resolves: #1270608 IPA upgrade fails for server with CA cert signed by
external CA
- schema: do not derive ipaVaultPublicKey from ipaPublicKey
- dcerpc: invalidate forest trust intfo cache when filtering out realm domains
Resolves: RHEL-28559
- Backport latests test fixes in python3-tests
ipatests: add xfail for autoprivate group test with override
ipatests: remove xfail thanks to sssd 2.9.4
ipatests: adapt for new automembership fixup behavior
ipatests: Fixes for test_ipahealthcheck_ipansschainvalidation testcases
test_xmlrpc: adopt to automember plugin message changes in 389-ds
Resolves: RHEL-29908
- Config plugin: return EmptyModlist when no change is applied.
Resolves: RHBZ#2031825
- Custodia: use a stronger encryption algo when exporting keys.
Resolves: RHBZ#2032806
- ipa-kdb: do not remove keys for hardened auth-enabled users.
Resolves: RHBZ#2033342
- ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus
Resolves: RHBZ#2049167
- Backport latest test fxes in python3 ipatests.
Resolves: RHBZ#2048509
- Removed unused patch files that were part of 4.9.8 rebase.
- Upstream final release FreeIPA 4.9.0
Related: RHBZ#1891832
- Add end to end integration tests for external IdP
Resolves: RHBZ#2106346
- Upstream release FreeIPA 4.9.8
Related: RHBZ#2015607
- Hardening for CVE-2020-25717
- Resolves: #1419735 ipa-replica-install fails promotecustodia.create_replica
with cert errors (untrusted)
- added ssl verification using IPA trust anchor
- Resolves: #1428472 batch param compatibility is incorrect
- compat: fix `Any` params in `batch` and `dnsrecord`
- Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream
- rebuild with new openssl
- Rebase ipa to 4.9.13
Resolves: RHEL-16936
- Remove the IPA DNA plugin, use the DS one
- Drop requires on python-configobj (not used any more)
- Drop ipa-ldap-updater message, upgrades are done differently now
- Update minimum selinux-policy to 3.9.16-18
- Update minimum pki-ca and pki-selinux to 9.0.7
- Update minimum 389-ds-base to 1.2.8.0-1
- Update to upstream 2.0.1
- Remove radius subpackages
- Pull upstream changelog 641
- Require minimum version of krb5-server on F-7 and F-8
- Package some new files
- Add ipa init script
- Update to upstream 4.0.3 (#1109726)
- Update Requires on selinux-policy to 3.13.1-4
- Add missing part of backported CVE-2024-3183 fix
Resolves: RHEL-29927
- Drop BuildRequires on mozldap-devel
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
- Updated upstream pull (596) to fix bug in ipa_webgui that was causing the
UI to not start.
- Remove duplicate %files entries on share/ipa/static
- Add python default encoding shared library
- Winsync agreement cannot be created (#1023085)
- Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
aliases)
- harden the check for trust namespace overlap in new principals
- Resolves: #1351142 CLI is not using session cookies for communication with
IPA API
- Fix session cookies
- Resolves: #1353888 Fix the help for ipa otp and other topics
- help: Add dnsserver commands to help topic 'dns'
- Resolves: #1354406 host-del updatedns options complains about missing ptr
record for host
- Host-del: fix behavior of --updatedns and PTR records
- Resolves: #1355718 ipa-replica-manage man page example output differs actual
command output
- Minor fix in ipa-replica-manage MAN page
- Resolves: #1358229 Traceback message should be fixed, seen while editing
winsync migrated user information in Default trust view.
- baseldap: Fix MidairCollision instantiation during entry modification
- Resolves: #1358849 CA replica install logs to wrong log file
- unite log file name of ipa-ca-install
- Resolves: #1359130 ipa-server-install command fails to install IPA server.
- DNS Locations: fix update-system-records unpacking error
- Resolves: #1359237 AVC on dirsrv config caused by IPA installer
- Use copy when replacing files to keep SELinux context
- Resolves: #1359692 ipa-client-install join fail with traceback against
RHEL-6.8 ipa-server
- compat: fix ping call
- Resolves: #1359738 ipa-replica-install --domain= option
does not work
- replica-install: Fix --domain
- Resolves: #1360778 Vault commands are available in CLI even when the server
does not support them
- Revert "Enable vault-* commands on client"
- client: fix hiding of commands which lack server support
- Related: #1281704 Rebase to softhsm 2.1.0
- Remove the workaround for softhsm bug #1293340
- Related: #1298288 [RFE] Improve performance in large environments.
- Create indexes for krbCanonicalName attribute
- Use OpenJDK 8 to bootstrap on AArch64 until RH1482244 is resolved in
buildroot
- Resolves: #1470177 - Rebase IPA to latest 4.5.x version
- Resolves: #1398594 ipa topologysuffix-verify should only warn about
maximum number of replication agreements.
- Resolves: #1404236 Web UI: Change "Host Based" and "Role Based"
to "Host-Based" and "Role-Based"
- Resolves: #1409786 Second phase of --external-ca ipa-server-install
setup fails when dirsrv is not running
- Resolves: #1451576 ipa cert-request failed to generate certificate from csr
- Resolves: #1452086 Pagination Size under Customization in IPA WebUI
accepts negative values
- Resolves: #1458169 --force-join option is not mentioned in
ipa-replica-install man page
- Resolves: #1463186 IPA shouldn't allow objectclass if not all in lower case
- Resolves: #1478322 user-show command fails when sizelimit is configured
to number <= number of entity which is user member of
- Resolves: #1496775 Enterprise principals should be able to trigger
a refresh of the trusted domain data in the KDC
- Resolves: #1502533 Changing cert-find to go through the proxy
instead of using the port 8080
- Resolves: #1502663 pkinit-status command fails after an upgrade from
a pre-4.5 IPA
- Resolves: #1498168 Error when trying to modify a PTR record
- Resolves: #1457876 ipa-backup fails silently
- Resolves: #1493531 In case full PKINIT configuration is failing during
server/replica install the error message should be more meaningful.
- Resolves: #1449985 Suggest CA installation command in KRA installation
warning
- Display server name in ipa command's verbose mode (#1061703)
- Remove sourcehostcategory from default HBAC rule (#1061187)
- dnszone-add cannot add classless PTR zones (#1058688)
- Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)
- Add ipa-rmkeytab tool
- ipaclient-install: chmod needs octal permissions (#1609880)
- Added Require mod_wsgi, added share/ipa/wsgi.py
- Improve otptoken help messages (#919228)
- Ensure users exist when assigning tokens to them (#919228)
- Enable QR code display by default in otptoken-add (#919228)
- Show warning instead of error if CA did not start (#1158410)
- CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
- Traceback when adding zone with long name (#1164859)
- Backup & Restore mechanism (#951581)
- ignoring user attributes in migrate-ds does not work if uppercase characters
are returned by ldap (#1159816)
- Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
- Failure when installing on dual stacked system with external ca (#1128380)
- ipa-server should keep backup of CS.cfg (#1059135)
- Tracebacks with latest build for --zonemgr cli option (#1167270)
- webui: use domain name instead of domain SID in idrange adder dialog
(#891984)
- webui: normalize idview tab labels (#891984)
- Unable to add trust successfully with --trust-secret (#1075704)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Resolves: #1258965 ipa vault: set owner of vault container
- baseldap: make subtree deletion optional in LDAPDelete
- vault: add vault container commands
- vault: set owner to current user on container creation
- vault: update access control
- vault: add permissions and administrator privilege
- install: support KRA update
- Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
- config: allow user/host attributes with tagging options
- Resolves: #1262315 Unable to establish winsync replication
- winsync: Add inetUser objectclass to the passsync sysaccount
- Update SELinux policy to allow ipa_kpasswd to connect ldap and
read /dev/urandom. (#759679)
- Adopt to samba4 beta6 (libsecurity -> libsamba-security)
- Add dependency to samba4-winbind
- Resolves: #1298288 [RFE] Improve performance in large environments.
- cert: speed up cert-find
- Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
authentication
- service: add flag to allow S4U2Self
- Add 'trusted to auth as user' checkbox
- Added new authentication method
- Resolves: #1353881 ipa-replica-install suggests about
non-existent --force-ntpd option
- Don't show --force-ntpd option in replica install
- Resolves: #1354441 DNS forwarder check is too strict: unable to add
sub-domain to already-broken domain
- DNS: allow to add forward zone to already broken sub-domain
- Resolves: #1356146 performance regression in CLI help
- schema: Speed up schema cache
- frontend: Change doc, summary, topic and NO_CLI to class properties
- schema: Introduce schema cache format
- schema: Generate bits for help load them on request
- help: Do not create instances to get information about commands and topics
- schema cache: Do not reset ServerInfo dirty flag
- schema cache: Do not read fingerprint and format from cache
- Access data for help separately
- frontent: Add summary class property to CommandOverride
- schema cache: Read server info only once
- schema cache: Store API schema cache in memory
- client: Do not create instance just to check isinstance
- schema cache: Read schema instead of rewriting it when SchemaUpToDate
- Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
- server install: do not prompt for cert file PIN repeatedly
- Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
cache directory: [Errno 13] Permission denied: '/home/test_user'
- schema: Speed up schema cache
- Resolves: #1366604 `cert-find` crashes on invalid certificate data
- cert: do not crash on invalid data in cert-find
- Resolves: #1366612 Middle replica uninstallation in line topology works
without '--ignore-topology-disconnect'
- Fail on topology disconnect/last role removal
- Resolves: #1366626 caacl-add-service: incorrect error message when service
does not exists
- Fix ipa-caalc-add-service error message
- Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
does not happen to run during dnf upgrade
- DNS server upgrade: do not fail when DNS server did not respond
- Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
with CA
- Add warning about only one existing CA server
- Set servers list as default facet in topology facet group
- Resolves: #1367773 thin client ignores locale change
- schema check: Check current client language against cached one
- Resolves: #1434032 Run ipa-custodia with custom SELinux context
- Require correct custodia version
- Fix: DNS installer adds invalid zonemgr email (#1056202)
- ipaplatform: Use the dirsrv service, not target (#951581)
- Fix: DNS policy upgrade raises asertion error (#1161128)
- Fix upgrade referint plugin (#1161128)
- Upgrade: fix trusts objectclass violationi (#1161128)
- group-add doesn't accept gid parameter (#1149124)
- Remove redundat Requires versions that are already in Fedora 17
- Replace python-crypto Requires with m2crypto
- Add missing Requires(post) for client and server-trust-ad subpackages
- Restart httpd service when server-trust-ad subpackage is installed
- Bump selinux-policy Requires to pick up PKI/LDAP port labeling fixes
- Fix SELinux code
- Resolves: #1378353 Replica install fails with old IPA master sometimes during
replication process
- spec file: bump minimal required version of 389-ds-base
- Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
- Fix missing file that fails DL1 replica installation
- Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
- WebUI: services without canonical name are shown correctly
- Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
- trustdomain-del: fix the way how subdomain is searched
- kdb: PAC generator: do not fail if canonical principal is missing
Resolves: RHEL-23630
- ipa-kdb: Fix memory leak during PAC verification
Resolves: RHEL-22644
- Fix session cookie access
Resolves: RHEL-23622
- Do not ignore staged users in sidgen plugin
Resovlves: RHEL-23626
- ipa-kdb: Disable Bronze-Bit check if PAC not available
Resolves: RHEL-22313
- krb5kdc: Fix start when pkinit and otp auth type are enabled
Resolves: RHEL-4874
- hbactest was not collecting or returning messages
Resolves: RHEL-12780
- Resolves: #712109 "krbExtraData not allowed" is logged in DS error log while
setting password for default sudo binddn.
- Resolves: #747612 [RFE] IPA should support and manage DNS sites
- Resolves: #768316 [RFE] ipa-getkeytab should auto-detect the ipa server name
- Resolves: #825391 [RFE] Replica installation should provide a means for
inheriting nssldap security access settings
- Resolves: #921497 Incorrect *.py[co] files placement
- Resolves: #1029640 RHEL7 IPA to add DNA Plugin config for dnaRemote support
- Resolves: #1029905 389 DS cache sizes not replicated to IPA replicas
- Resolves: #1196958 IPA replica installation failing with high number of users
(160000).
- Resolves: #1219402 IPA suggests to uninstall a client when the user needs to
uninstall a replica
- Resolves: #1224057 [RFE] TGS authorization decisions in KDC based on
Authentication Indicator
- Resolves: #1234222 [WebUI] UI error message is not appropriate for "Kerberos
principal expiration"
- Resolves: #1234223 [WebUI] General invalid password error message appearing
for "Locked user"
- Resolves: #1254267 ipa-server-install failure applying ldap updates with
limits exceeded
- Resolves: #1258626 realmdomains-mod --add-domain command throwing error when
doamin already is in forwardzone.
- Resolves: #1259020 ipa-server-adtrust-install doesn't allow
NetBIOS-name=EXAMPLE-TEST.COM (dash character)
- Resolves: #1260993 DNSSEC signing enablement on dnszone should throw error
message when DNSSEC master not installed
- Resolves: #1262747 dnssec options missing in ipa-dns-install man page
- Resolves: #1265900 Fail installation immediately after dirsrv fails to
install using ipa-server-install
- Resolves: #1265915 idoverrideuser-find fails if any SID anchor is not
resolvable anymore
- Resolves: #1268027 ipa-dnskeysync-replica crash with backtrace -
LimitsExceeded: limits exceeded for this query
- Resolves: #1269089 Certificate of managed-by host/service fails to resubmit
- Resolves: #1269200 ipa-server crashing while trying to preserve admin user
- Resolves: #1271321 Reduce ioblocktimeout and idletimeout defaults
- Resolves: #1271579 Automember rule expressions disappear from tables on
single expression delete
- Resolves: #1275816 Incomplete ports for IPA ad-trust
- Resolves: #1276351 [RFE] Remove
/usr/share/ipa/updates/50-lockout-policy.update file from IPA releases
- Resolves: #1277109 Add tool tips for Revert, Refresh, Undo, and Undo All in
the IPA UI
- Resolves: #1278426 Better error message needed for invalid ca-signing-algo
option
- Resolves: #1279932 ipa-client-install --request-cert needs workaround in
anaconda chroot
- Resolves: #1282521 Creating a user w/o private group fails when doing so in
WebUI
- Resolves: #1283879 ipa-winsync-migrate: Traceback message should be replaced
by "IPA is not configured on this system"
- Resolves: #1285071 ipa-kra-install fails on replica looking for admin cert
file
- Resolves: #1287194 [RFE] Support of UPN for trusted domains
- Resolves: #1288967 Normalize Manager entry in ipa user-add
- Resolves: #1289487 Priority field missing in Password Policy detail tab
- Resolves: #1291140 ipa client should configure kpasswd_server directive in
krb5.conf
- Resolves: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.4.0.alpha1
- Resolves: #1298848 [RFE] Centralized topology management
- Resolves: #1300576 Browser setup page includes instructions for Internet
Explorer
- Resolves: #1301586 ipa host-del --updatedns should remove related dns
entries.
- Resolves: #1304618 Residual Files After IPA Server Uninstall
- Resolves: #1305144 ipa-python does not require its dependencies
- Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
- Resolves: #1313798 Console output post ipa-winsync-migrate command should be
corrected.
- Resolves: #1314786 [RFE] External Trust with Active Directory domain
- Resolves: #1319023 Include description for 'status' option in man page for
ipactl command.
- Resolves: #1319912 ipa-server-install does not completely change hostname and
named-pkcs11 fails
- Resolves: #1320891 IPA Error 3009: Validation error: Invalid 'ptrrecord':
Reverse zone in-addr.arpa. requires exactly 4 IP address compnents, 5 given
- Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
revocation reasons
- Resolves: #1328549 "ipa-kra-install" command reports incorrect message when
it is executed on server already installed with KRA.
- Resolves: #1329209 ipa-nis-manage enable: change service name from 'portmap'
to 'rpcbind'
- Resolves: #1329275 ipa-nis-manage command should include status option
- Resolves: #1330843 'man ipa' should be updated with latest commands
- Resolves: #1333755 ipa cert-request causes internal server error while
requesting certificate
- Resolves: #1337484 EOF is not handled for ipa-client-install command
- Resolves: #1338031 Insufficient 'write' privilege on some attributes for the
members of the role which has "User Administrators" privilege.
- Resolves: #1343142 IPA DNS should do better verification of DNS zones
- Resolves: #1347928 Frontpage exposes runtime error with no cookies enabled in
browser
- Use NSS protocol range API to set available TLS protocols (#1156466)
- Updated to upstream 3.0.0 rc 2
- Include new FF configuration extension
- Set minimum Requires of selinux-policy to 3.11.1-33
- Set minimum Requires dogtag to 10.0.0-0.43.b1
- Add new optional strict sub-package to allow users to limit other
package upgrades.
- Add ipa-idrange-fix
Resolves: RHEL-56920
- Unconditionally add MS-PAC to global config on update
Resolves: RHEL-49437
- ipatests: Update ipa-adtrust-install test
Resolves: RHEL-40894
- Require python-qrcode version 5.3 or later
Related: RHEL-15090
- ipa-kdb: Rework ipadb_reinit_mspac()
Resolves: RHEL-25742
- ipatests: wait for replica update in test_dns_locations
Resolves: RHEL-22373
- ipatests: fix tasks.wait_for_replication() method
Resolves: RHEL-25708
- Resolves: #805188 [RFE] "ipa migrate-ds" ldapsearches with scope=1
- Resolves: #1019272 With 20000+ users, adding a user to a group intermittently
throws Internal server error
- Resolves: #1035494 Unable to add Kerberos principal via kadmin.local
- Resolves: #1045153 ipa-managed-entries --list -p still requires
DM password
- Resolves: #1125950 ipa-server-install --uinstall doesn't remove port 7389
from ldap_port_t
- Resolves: #1132540 [RFE] Expose service delegation rules in UI and CLI
- Resolves: #1145584 ipaserver/install/cainstance.py creates pkiuser not
matching uidgid
- Resolves: #1176036 IDM client registration failure in a high load environment
- Resolves: #1183116 Remove Requires: subscription-manager
- Resolves: #1186054 permission-add does not prompt to enter --right option in
interactive mode
- Resolves: #1187524 Replication agreement with replica not disabled when
ipa-restore done without IPA installed
- Resolves: #1188195 Fax number not displayed for user-show when kinit'ed as
normal user.
- Resolves: #1189034 "an internal error has occurred" during ipa host-del
--updatedns
- Resolves: #1193554 ipa-client-automount: failing with error LDAP server
returned UNWILLING_TO_PERFORM. This likely means that minssf is enabled.
- Resolves: #1193759 IPA extdom plugin fails when encountering large groups
- Resolves: #1194312 [ipa-python] ipalib.errors.LDAPError: failed to decode
certificate: (SEC_ERROR_INVALID_ARGS) security library: invalid arguments.
- Resolves: #1194633 Default trust view can be deleted in lower case
- Resolves: #1196455 ipa-server-install step [8/27]: starting certificate
server instance - confusing CA staus message on TLS error
- Resolves: #1198263 Limit deadlocks between DS plugin DNA and slapi-nis
- Resolves: #1199527 [RFE] Use datepicker component for datetime fields
- Resolves: #1200867 [RFE] Make OTP validation window configurable
- Resolves: #1200883 [RFE] Switch apache to use mod_auth_gssapi
- Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using
get_user_grouplist() [rhel-7.2]
- Resolves: #1204637 slow group operations
- Resolves: #1204642 migrate-ds: slow add o users to default group
- Resolves: #1208461 IPA CA master server update stuck on checking getStatus
via https
- Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
- Resolves: #1211708 ipa-client-install gets stuck during NTP sync
- Resolves: #1215197 ipa-client-install ignores --ntp-server option during time
sync
- Resolves: #1215200 ipa-client-install configures IPA server as NTP source
even if IPA server has not ntpd configured
- Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
- Related: #1204809 Rebase ipa to 4.2
- Update to upstream 4.2.0.alpha1
- ipatests: NAMED_CRYPTO_POLICY_FILE not defined for RHEL
Resolves: RHBZ#1982956
- Add sssd and certmonger as a Requires on ipa-client
- Rebase to upstream release 4.9.10
Remove upstream patches 0002 to 0016 that are part of version 4.9.10
Remove patches 1101 that is part of version 4.9.10
Rename patch 0001 to 1002 as it will be used in future RHEL 8 releases
Add patches 0001 and 0002 to fix build on RHEL 8.7
Resolves: RHBZ#2079466
Resolves: RHBZ#2063155
Resolves: RHBZ#1958777
Resolves: RHBZ#2068088
Resolves: RHBZ#2004646
Resolves: RHBZ#782917
Resolves: RHBZ#2059396
Resolves: RHBZ#2092015
- Handle new samba exception types.
Resolves: RHEL-17623
- Deprecate --serial-autoincrement option (#1016645)
- CA installation always failed on replica (#1005446)
- Re-initializing a winsync connection exited with error (#994980)
- Update to upstream 3.2.0 Beta 1
- Add a Requires for java-atk-wrapper until we can determine which package
should be pulling it in, dogtag or tomcat.
- Add redhat-access-plugin-ipa dependency
- extdom: unify error code handling especially LDAP_NO_SUCH_OBJECT
Resolves: RHBZ#1741530
- Resolves: #800545 [RFE] Support SUDO command rename
- Reworked the renaming mechanism
- Allow renaming of the sudorule objects
- Resolves: #872671 IPA WebUI login for AD Trusted User fails
- WebUI: check principals in lowercase
- WebUI: add method for disabling item in user dropdown menu
- WebUI: Add support for login for AD users
- Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
certificates on smart cards (pkinit)
- ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
- IPA certauth plugin
- ipa-kdb: do not depend on certauth_plugin.h
- spec file: bump krb5-devel BuildRequires for certauth
- Resolves: #1264370 RFE: disable last successful authentication by default in
ipa.
- Set "KDC:Disable Last Success" by default
- Resolves: #1318186 Misleading error message during external-ca IPA master
install
- certs: do not implicitly create DS pin.txt
- httpinstance: clean up /etc/httpd/alias on uninstall
- Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
CA certificate chain in ... incomplete"
- certs: do not implicitly create DS pin.txt
- httpinstance: clean up /etc/httpd/alias on uninstall
- Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
- configure: fix --disable-server with certauth plugin
- rpcserver.login_x509: Actually return reply from __call__ method
- spec file: Bump requires to make Certificate Login in WebUI work
- Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
- extdom: do reverse search for domain separator
- extdom: improve cert request
- Resolves: #1430363 [RFE] HBAC rule names command rename
- Reworked the renaming mechanism
- Allow renaming of the HBAC rule objects
- Resolves: #1433082 systemctl daemon-reload needs to be called after
httpd.service.d/ipa.conf is manipulated
- tasks: run `systemctl daemon-reload` after httpd.service.d updates
- Resolves: #1434032 Run ipa-custodia with custom SELinux context
- Use Custodia 0.3.1 features
- Resolves: #1434384 RPC client should use HTTP persistent connection
- Use connection keep-alive
- Add debug logging for keep-alive
- Increase Apache HTTPD's default keep alive timeout
- Resolves: #1434729 man ipa-cacert-manage install needs clarification
- man ipa-cacert-manage install needs clarification
- Resolves: #1434910 replica install against IPA v3 master fails with ACIError
- Fixing replica install: fix ldap connection in domlvl 0
- Resolves: #1435394 Ipa-kra-install fails with weird output when backspace is
used during typing Directory Manager password
- ipapython.ipautil.nolog_replace: Do not replace empty value
- Resolves: #1435397 ipa-replica-install can't install replica file produced by
ipa-replica-prepare on 4.5
- replica prepare: fix wrong IPA CA nickname in replica file
- Resolves: #1435599 WebUI: in self-service Vault menu item is shown even if
KRA is not installed
- WebUI: Fix showing vault in selfservice view
- Resolves: #1435718 As a ID user I cannot call a command with --rights option
- ldap2: use LDAP whoami operation to retrieve bind DN for current connection
- Resolves: #1436319 "Truncated search results" pop-up appears in user details
in WebUI
- WebUI: Add support for suppressing warnings
- WebUI: suppress truncation warning in select widget
- Resolves: #1436333 Uninstall fails with No such file or directory:
'/var/run/ipa/services.list'
- Create temporaty directories at the begining of uninstall
- Resolves: #1436334 WebUI: Adding certificate mapping data using certificate
fails
- WebUI: Allow to add certs to certmapping with CERT LINES around
- Resolves: #1436338 CLI doesn't work after ipa-restore
- Backup ipa-specific httpd unit-file
- Backup CA cert from kerberos folder
- Resolves: #1436342 Bump samba version, required for FIPS mode and privilege
separation
- Bump samba version for FIPS and priv. separation
- Resolves: #1436642 [ipalib/rpc.py] - "maximum recursion depth exceeded" with
ipa vault commands
- Avoid growing FILE ccaches unnecessarily
- Handle failed authentication via cookie
- Work around issues fetching session data
- Prevent churn on ccaches
- Resolves: #1436657 Add workaround for pki_pin for FIPS
- Generate PIN for PKI to help Dogtag in FIPS
- Resolves: #1436714 [vault] cache KRA transport cert
- Simplify KRA transport cert cache
- Resolves: #1436723 cert-find does not find all certificates without
sizelimit=0
- cert: do not limit internal searches in cert-find
- Resolves: #1436724 Renewal of IPA RA fails on replica
- dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
- Resolves: #1436753 Master tree fails to install
- httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not
available
- webui IdP: Remove arrow notation due to uglify-js limitation
Related: RHBZ#2141316
- Use java-1.8.0-openjdk-devel
- Update to upstream 2.2.0 alpha 1 (2.1.90.pre1)
- Support krb5 1.18
Resolves: RHBZ#1817579
- Fix ipa-replica-install crashes
- Fix ipa-server-install and ipa-dns-install logging
- Set minimum version of pki-ca to 9.0.17 to fix sslget problem
caused by FEDORA-2011-17400 update (#771357)
- Set minimum version of certmonger to 0.26 (to pck up #621670)
- Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
- Set minimum version of pki-ca to 1.3.6
- Set minimum version of sssd to 1.2.1
- diffstat was missing as a build dependency causing multilib problems
- Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
Resolves: RHBZ#1790663
- Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
certificates on smart cards (pkinit)
- spec file: bump krb5 Requires for certauth fixes
- Resolves: #1438729 Configure local PKINIT on DL0 or when '--no-pkinit' option
is used
- separate function to set ipaConfigString values on service entry
- Allow for configuration of all three PKINIT variants when deploying KDC
- API for retrieval of master's PKINIT status and publishing it in LDAP
- Use only anonymous PKINIT to fetch armor ccache
- Stop requesting anonymous keytab and purge all references of it
- Use local anchor when armoring password requests
- Upgrade: configure local/full PKINIT depending on the master status
- Do not test anonymous PKINIT after install/upgrade
- Resolves: #1442427 ipa.ipaserver.install.plugins.adtrust.
update_tdo_gidnumber: ERROR Default SMB Group not found
- upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
installed
- Resolves: #1442932 ipa restore fails to restore IPA user
- restore: restart/reload gssproxy after restore
- Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
- Fix CA/server cert validation in FIPS
- Resolves: #1444947 Deadlock between topology and schema-compat plugins
- compat-manage: behave the same for all users
- Move the compat plugin setup at the end of install
- compat: ignore cn=topology,cn=ipa,cn=etc subtree
- Resolves: #1445358 ipa vault-add raises TypeError
- vault: piped input for ipa vault-add fails
- Resolves: #1445382 ipa vault-retrieve fails to retrieve data from vault
- Vault: Explicitly default to 3DES CBC
- Resolves: #1445432 uninstall ipa client automount failed with RuntimeWarning
- automount install: fix checking of SSSD functionality on uninstall
- Resolves: #1446137 pki_client_database_password is shown in
ipaserver-install.log
- Hide PKI Client database password in log file
- Prepare spec file for release
- Using git snapshot 80e87e75bd6ab56e3e20c49ece55bd4d52f1a503
- Version bump for release
- Add missing ipa-selinux package
Resolves: RHBZ#1853263
- Remove unnecessary moving of v1 CA serial number file in post script
- Add Obsoletes for server-selinxu subpackage
- Using git snapshot 442d6ad30ce1156914e6245aa7502499e50ec0da
- PassSync does not sync passwords due to missing ACIs (#1181093)
- ipa-replica-manage list does not list synced domain (#1181010)
- Do not assume certmonger is running in httpinstance (#1181767)
- ipa-replica-manage disconnect fails without password (#1183279)
- Put LDIF files to their original location in ipa-restore (#1175277)
- DUA profile not available anonymously (#1184149)
- IPA replica missing data after master upgraded (#1176995)
- Included LICENSE and README in all packages for documentation
- Move user-modifiable content to /etc/ipa and linked back to
/usr/share/ipa/html
- Changed some references to /usr to the {_usr} macro and /etc
to {_sysconfdir}
- Added popt-devel to BuildRequires for Fedora 8 and higher and
popt for Fedora 7
- Package the egg-info for Fedora 9 and higher for ipa-python
- Updated to upstream 3.0.0 beta 2
- 2.1.3
- Force to use 389-ds 1.2.10-0.8.a7 or above
- Improve upgrade script to handle systemd 389-ds change
- Fix freeipa to work with python-ldap 2.4.6
- Fix bug #702633
- Resolves: #1256840 [webui] majority of required fields is no longer marked as
required
- fix missing information in object metadata
- Resolves: #1256842 [webui] no option to choose trust type when creating a
trust
- webui: add option to establish bidirectional trust
- Resolves: #1256853 Clear text passwords in KRA install log
- Removed clear text passwords from KRA install log.
- Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
discouraged
- vault: change default vault type to symmetric
- Resolves: #1257163 renaming certificatte profile with --rename option leads
to integrity issues
- certprofile: prevent rename (modrdn)
- Allow the admin user to be disabled
Resolves: RHEL-34756
- ipa-otptoken-import: open the key file in binary mode
Resolves: RHEL-39616
- ipa-crlgen-manage: manage the cert status task execution time
Resolves: RHEL-30280
- idrange-add: add a warning because 389ds restart is required
Resolves: RHEL-28996
- PKINIT certificate: fix renewal on hidden replica
Resolves: RHEL-4913, RHEL-45908
- Mass rebuild 2014-01-24
- Require certmonger 0.79.7-1
Related: RHBZ#1708095
- Do not check if port 8443 is available in step 2 of external CA install
(#1129481)
- Resolves: #1249226 IPA dnssec-validation not working for AD dnsforwardzone
- DNSSEC: fix forward zone forwarders checks
- Resolves: #1250190 idrange is not added for sub domain
- trusts: format Kerberos principal properly when fetching trust topology
- Resolves: #1252334 User life cycle: missing ability to provision a stage user
from a preserved user
- Add user-stage command
- Resolves: #1252863 After applying RHBA-2015-1554 errata, IPA service fails to
start.
- spec file: Add Requires(post) on selinux-policy
- Resolves: #1254304 Changing vault encryption attributes
- Change internal rsa_(public|private)_key variable names
- Added support for changing vault encryption.
- Resolves: #1256715 Executing user-del --preserve twice removes the user
pernamently
- improve the usability of `ipa user-del --preserve` command
- Pull upstream changelog 608 which renamed several files
- Fix for CVE-2008-3274
- Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
- Add fix for bug #453185
- Rebuild against openldap libraries, mozldap ones do not work properly
- TurboGears is currently broken in rawhide. Added patch to not build
the UI locales and removed them from the ipa-server files section.
- Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
- Fix regression introduced in ipa-certupdate
- Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
- Do not initialize API in ipa-client-automount uninstall
- Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
client changes
- idrange: fix unassigned global variable
- Resolves: #1360792 Migrating users doesn't update krbCanonicalName
- re-set canonical principal name on migrated users
- Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
and 'bool' objects
- Fix ipa hbactest output
- Resolves: #1362260 ipa vault-mod no longer allows defining salt
- vault: add missing salt option to vault_mod
- Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
public key
- vault: Catch correct exception in decrypt
- Resolves: #1362537 ipa-server-install fails to create symlink from
/etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
- Correct path to HTTPD's systemd service directory
- Resolves: #1363756 Increase length of passwords generated by installer
- Increase default length of auto generated passwords
- Update to upstream 3.3.0 Beta 2 (#991064)
- Update Requires on pki-ca to 10.1.2-4 (#1129558)
- build: increase java stack size for all arches
- Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
- Fix dns zonemgr validation regression (#1056202)
- Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
- Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
(#886645)
- Add bind-dyndb-ldap working dir to IPA specfile
- Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
(#886645)
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
- Deadlock in schema compat plugin (#1161131)
- ipactl stop should stop dirsrv last (#1161129)
- Upgrade 3.3.5 to 4.1 failed (#1161128)
- CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)
- Fix status trust-add command status message (#910453)
- NetBIOS was not trimmed at 15 characters (#1030517)
- Harden CA subsystem certificate renewal on CA clones (#1040018)
- remove ipa-fix-CVE-2008-3274
- Resolves: #1382812 Creation of replica for disconnected environment is
failing with CA issuance errors; Need good steps.
- gracefully handle setting replica bind dn group on old masters
- Resolves: #1397439 ipa-ca-install on promoted replica hangs on creating a
temporary CA admin
- replication: ensure bind DN group check interval is set on replica config
- add missing attribute to ipaca replica during CA topology update
- Resolves: #1401088 IPA upgrade of replica without DNS fails during restart of
named-pkcs11
- bindinstance: use data in named.conf to determine configuration status
- Resolves: #1348948 IPA server install fails with build
ipa-server-4.4.0-0.el7.1.alpha1
- Revert "Increased mod_wsgi socket-timeout"
- Resolves: #1449189 ipa-kra-install timeouts on replica
- ipa-kra-install: fix check_host_keys
- Require python-wehjit >= 0.2.0
- Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
- Resolves: #1375269 ipa trust-fetch-domains throws internal error
- Set minimum level of 389-ds-base to 1.2.7 for enhanced memberof plugin
- Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
- ipa-sam: replace encode_nt_key() with E_md4hash()
- ipa_pwd_extop: do not generate NT hashes in FIPS mode
- Resolves: #1377973 ipa-server-install fails when the provided or resolved
IP address is not found on local interfaces
- Fix local IP address validation
- ipa-dns-install: remove check for local ip address
- refactor CheckedIPAddress class
- CheckedIPAddress: remove match_local param
- Remove ip_netmask from option parser
- replica install: add missing check for non-local IP address
- Remove network and broadcast address warnings
- Resolves: #1477178 - [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic
key for host
- Always check peer has keys before connecting
- Resolves: #1482802 - Unable to set ca renewal master on replica
- Fix ipa config-mod --ca-renewal-master
- Resolves: #1486283 - TypeError in renew_ca_cert prevents from swiching
back to self-signed CA
- Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
- Resolves: #1480102 - ipa-server-upgrade failes with "This entry already exists"
- Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
- Resolves: #1484826 - FreeIPA/IdM installations which were upgraded from
versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
thus startup of Web UI fails
- Adds whoami DS plugin in case that plugin is missing
- Resolves: #1478251 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
- Fixing how sssd.conf is updated when promoting a client to replica
- Resolves: #1461177 - ipa-otptoken-import - XML file is missing PBKDF2
parameters!
- ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
- Resolves: #1484428 - Updating from RHEL 7.3 fails with Server-Cert not found
(ipa-server-upgrade)
- Backport 4-5: Fix ipa-server-upgrade with server cert tracking
- kdb: Use-krb5_pac_full_sign_compat() when available
Resolves: RHBZ#2176406
- OTP: fix-data-type-to-avoid-endianness-issue
Resolves: RHBZ#2218293
- Upgrade: fix replica agreement
Resolves: RHBZ#2216551
- Upgrade: add PKI drop-in file if missing
Resolves: RHBZ#2215336
- Use the python-cryptography parser directly in cert-find
Resolves: RHBZ#2164349
- Backport test updates
Resolves: RHBZ#221884
- Initial rpm version
- SELinux Policy: let custodia replicate keys
Resolves: RHBZ#1868432
- Update slapi-nis dependency to pull 0.54-2 (#891984)
- ipa-restore: Don't crash if AD trust is not installed (#951581)
- Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
- Trust setting not restored for CA cert with ipa-restore command (#1159011)
- ipa-server-install fails when restarting named (#1162340)
- Rebuild against samba4 beta8
- Resolves: #1170770 [AD TRUST]IPA should detect inconsistent realm domains
that conflicts with AD DC
- trusts: Check for AD root domain among our trusted domains
- Resolves: #1195339 ipa-client-install changes the label on various files
which causes SELinux denials
- sysrestore: copy files instead of moving them to avoind SELinux issues
- Resolves: #1196656 [ipa-client][rhel71] enable debugging for spawned
commands / ntpd -qgc $tmpfile hangs
- enable debugging of ntpd during client installation
- Resolves: #1205264 Migration UI Does Not Work When Anonymous Bind is Disabled
- migration: Use api.env variables.
- Resolves: #1212719 abort-clean-ruv subcommand should allow
replica-certifyall: no
- Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand
- Resolves: #1216935 ipa trust-add shows ipa: ERROR: an internal error has
occurred
- dcerpc: Expand explanation for WERR_ACCESS_DENIED
- dcerpc: Fix UnboundLocalError for ccache_name
- Resolves: #1222778 idoverride group-del can delete user and user-del can
delete group
- dcerpc: Add get_trusted_domain_object_type method
- idviews: Restrict anchor to name and name to anchor conversions
- idviews: Enforce objectclass check in idoverride*-del
- Resolves: #1234919 Be able to request certificates without certmonger service
running
- cermonger: Use private unix socket when DBus SystemBus is not available.
- ipa-client-install: Do not (re)start certmonger and DBus daemons.
- Resolves: #1240939 Please add dependency on bind-pkcs11
- Create server-dns sub-package.
- ipaplatform: Add constants submodule
- DNS: check if DNS package is installed
- Resolves: #1242914 Bump minimal selinux-policy and add booleans to allow
calling out oddjobd-activated services
- selinux: enable httpd_run_ipa to allow communicating with oddjobd services
- Resolves: #1243261 non-admin users cannot search hbac rules
- fix hbac rule search for non-admin users
- fix selinuxusermap search for non-admin users
- Resolves: #1243652 Client has missing dependency on memcache
- do not import memcache on client
- Resolves: #1243835 [webui] user change password dialog does not work
- webui: fix user reset password dialog
- Resolves: #1244802 spec: selinux denial during kdcproxy user creation
- Fix selinux denial during kdcproxy user creation
- Resolves: #1246132 trust-fetch-domains: Do not chown keytab to the sssd user
- oddjob: avoid chown keytab to sssd if sssd user does not exist
- Resolves: #1246136 Adding a privilege to a permission avoids validation
- Validate adding privilege to a permission
- Resolves: #1246141 DNS Administrators cannot search in zones
- DNS: Consolidate DNS RR types in API and schema
- Resolves: #1246143 User plugin - user-find doesn't work properly with manager
option
- fix broken search for users by their manager
- ipa-kdb: Detect and block Bronze-Bit attacks
Resolves: RHEL-9984
- Fix for CVE-2023-5455
Resolves: RHEL-12578
- Temporarily move ipa-backup and ipa-restore functionality
back to make them available in public Beta (#1003933)
- Added patch to fix problem reported by ldapmodify
- Add dependency for python-krbV
- Resolves: #1438833 [ipa-replica-install] - 406 Client Error: Failed to
validate message: Incorrect number of results (0) searching forpublic key for
host
- Make sure remote hosts have our keys
- Resolves: #1442815 Replica install fails during migration from older IPA
master
- Refresh Dogtag RestClient.ca_host property
- Remove the cachedproperty class
- Resolves: #1444787 Update warning message when KRA installation fails
- kra install: update installation failure message
- Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
- ipa-server-install with external CA: fix pkinit cert issuance
- Resolves: #1445397 GET in KerberosSession.finalize_kerberos_acquisition()
must use FreeIPA CA
- kerberos session: use CA cert with full cert chain for obtaining cookie
- Resolves: #1447375 ipa-client-install: extra space in pkinit_anchors
definition
- ipa-client-install: remove extra space in pkinit_anchors definition
- Resolves: #1447703 Fix SELinux contex of http.keytab during upgrade
- Use proper SELinux context with http.keytab
- Fix upgrade issue with AD trust when no trust yet established
Fixes: RHBZ#1708874
Related: RHBZ#1684528
- Resolves: #1131907 [ipa-client-install] cannot write certificate file
'/etc/ipa/ca.crt.new': must be string or buffer, not None
- Resolves: #1195775 unsaved changes dialog internally inconsistent
- Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
- Stageusedr-activate: show username instead of DN
- Resolves: #1200694 [RFE] Support for multiple cert profiles
- Prevent to rename certprofile profile id
- Resolves: #1222047 IPA to AD Trust: IPA ERROR 4016: Remote Retrieve Error
- Resolves: #1224769 copy-schema-to-ca.py does not overwrites schema files
- copy-schema-to-ca: allow to overwrite schema files
- Resolves: #1241941 kdc component installation of IPA failed
- spec file: Update minimum required version of krb5
- Resolves: #1242036 Replica install fails to update DNS records
- Fix DNS records installation for replicas
- Resolves: #1242884 Upgrade to 4.2.0 fails when enabling kdc proxy
- Start dirsrv for kdcproxy upgrade
- ipa-kdb: fix error handling of is_master_host()
Resolves: RHBZ#2214638
- ipatests: enable firewall rule for http service on acme client
Resolves: RHBZ#2230256
- User plugin: improve error related to non existing idp
Resolves: RHBZ#2224572
- Prevent admin user from being deleted
Resolves: RHBZ#1821181
- Fix memory leak in the OTP last token plugin
Resolves: RHBZ#2227783
- Fix Fedora package changelog after merging systemd changes
- Backport latest test fixes in python3-ipatests
Resolves: RHBZ#2060841
- extdom: user getorigby{user|group}name if available
Resolves: RHBZ#2062379
- Set the mode on ipaupgrade.log during RPM post snipppet
Resolves: RHBZ#2061957
- test_krbtpolicy: skip SPAKE-related tests in FIPS mode
Resolves: RHBZ#1909630
- Fixed kdcproxy_version to 0.4-3
- Fixed krb5_version to 1.17-7
Related: RHBZ#1684528
- Handle NFS configuration file changes. nfs-utils moved the
configuration file from /etc/sysconfig/nfs to /etc/nfs.conf.
Resolves: RHBZ#1676981
- webui: Allow grace login limit
Resolves: RHBZ#2109243
- check_repl_update: in progress is a boolean
Resolves: RHBZ#2117303
- Disabling gracelimit does not prevent LDAP binds
Resolves: RHBZ#2109236
- Set passwordgracelimit to match global policy on group pw policies
Resolves: RHBZ#2115475
- Add Requires on krb5-pkinit-openssl
- Upstream release FreeIPA 4.9.6
Related: RHBZ#1945038
- Revise PKINIT upgrade code
Resolves: RHBZ#1886837
- ipa-cert-fix man page: add note about certmonger renewal
Resolves: RHBZ#1780317
- Certificate Serial Number issue
Resolves: RHBZ#1919384
- Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
- Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to
handle PKINIT certificates/anchors
- certdb: add named trust flag constants
- certdb, certs: make trust flags argument mandatory
- certdb: use custom object for trust flags
- install: trust IPA CA for PKINIT
- client install: fix client PKINIT configuration
- install: introduce generic Kerberos Augeas lens
- server install: fix KDC PKINIT configuration
- ipapython.ipautil.run: Add option to set umask before executing command
- certs: do not export keys world-readable in install_key_from_p12
- certs: do not export CA certs in install_pem_from_p12
- server install: fix KDC certificate validation in CA-less
- replica install: respect --pkinit-cert-file
- cacert manage: support PKINIT
- server certinstall: support PKINIT
- Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
option
- certs: do not export CA certs in install_pem_from_p12
- server install: fix KDC certificate validation in CA-less
- Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
decommissioned
- ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname
- Resolves: #1451712 KRA installation fails on server that was originally
installed as CA-less
- ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
- Resolves: #1441499 ipa cert-show does not raise error if no file name
specified
- ca/cert-show: check certificate_out in options
- Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
- Remove pkinit-anonymous command
- Resolves: #1449523 Provide an API command to retrieve PKINIT status
in the FreeIPA topology
- Allow for multivalued server attributes
- Refactor the role/attribute member reporting code
- Add an attribute reporting client PKINIT-capable servers
- Add the list of PKINIT servers as a virtual attribute to global config
- Add `pkinit-status` command
- test_serverroles: Get rid of MockLDAP and use ldap2 instead
- Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
- Fix rare race condition with missing ccache file
- Resolves: #1455045 Simple service uninstallers must be able to handle
missing service files gracefully
- only stop/disable simple service if it is installed
- Resolves: #1455541 after upgrade login from web ui breaks
- krb5: make sure KDC certificate is readable
- Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
command "ipa cert-request --add" after upgrade
- Change python-cryptography to python2-cryptography
- Require krb5 release 1.18.2-25 or later
Resolves: RHBZ#2234711
- Rebase ipa to 4.9.12
Resolves: RHBZ#2196425
- user or group name: explain the supported format
Resolves: RHBZ#2150217
- Allow insecure binds for migration
Resolves: RHBZ#1731963
- Trust add tries to add same value of --base-id for sub domain,
causing an error (#1033068)
- Improved error reporting for adding trust case (#1029856)
- Do not fetch a principal two times, remove potential memory leak (#1070924)
- Depend on krb5-kdb-version-devel for BuildRequires
- Update nss dependency to 3.44.0-4
- Reset per-indicator Kebreros policy
Resolves: RHBZ#1784761
- Resolves: #1339233 CA installed on replica is always marked as renewal master
- Related: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.3.1.201605241723GIT1b427d3
- Pull upstream changelog 722
- Add Conflicts mod_ssl (435360)
- Use default ssh host key algorithms
Resolves: RHBZ#1756432
- Do not run trust upgrade code if master lacks Samba bindings
Resolves: RHBZ#1757064
- Finish group membership management UI
Resolves: RHBZ#1773528
- Add ipa-host-net-manage script
- Use the OpenSSL certificate parser in cert-find
Resolves: RHBZ#2209947
- Add a- heck into ipa-cert-fix tool to avoid updating certs if CA is close to expire
Resolves: RHEL-4941
- Fix rpminspect's 'patches' warnings
Resolves: RHEL-22497
- replica install failing with avc denial for custodia component
Resolves: RHBZ#1857157
- Upstream pre release FreeIPA 4.9.0rc1
Resolves: RHBZ#1891832
- Requirements and design for libpwquality integration
Resolves: RHBZ#1340463
- When parsing options require name/value pairs
Resolves: RHBZ#1357495
- WebUI: Fix issue with opening links in new tab/window
Resolves: RHBZ#1484088
- Use a state to determine if a 389-ds upgrade is in progress
Resolves: RHBZ#1569011
- Unlock user accounts after a password reset and replicate that unlock to
all IdM servers
Resolves: RHBZ#1784657
- Set the certmonger subject with a string, not an object
Resolves: RHBZ#1810148
- Implement ACME certificate enrolment
Resolves: RHBZ#1851835
- [WebUI] Backport jQuery patches from newer versions of the library (e.g.
3.5.0)
Resolves: RHBZ#1859249
- It is not possible to edit KDC database when the FreeIPA server is running
Resolves: RHBZ#1875001
- Fix nsslapd-db-lock tuning of BDB backend
Resolves: RHBZ#1882340
- ipa-kdb: support subordinate/superior UPN suffixes
Resolves: RHBZ#1891056
- wgi/plugins.py: ignore empty plugin directories
Resolves: RHBZ#1894800
- Default to systemd for Fedora 16 and onwards
- Update to upstream 3.2.0 GA
- ipa-client-install fails if /etc/ipa does not exist (#961483)
- Certificate status is not visible in Service and Host page (#956718)
- ipa-client-install removes needed options from ldap.conf (#953991)
- Handle socket.gethostbyaddr() exceptions when verifying hostnames (#953957)
- Add triggerin scriptlet to support OpenSSH 6.2 (#953617)
- Require nss 3.14.3-12.0 to address certutil certificate import
errors (#953485)
- Require pki-ca 10.0.2-3 to pull in fix for sslget and mixed IPv4/6
environments. (#953464)
- ipa-client-install removes 'sss' from /etc/nsswitch.conf (#953453)
- ipa-server-install --uninstall doesn't stop dirsrv instances (#953432)
- Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for
socket based connections (#960222)
- Require libsss_nss_idmap-python
- Add Conflicts on nss-pam-ldapd < 0.8.4. The mapping from uniqueMember to
member is now done automatically and having it in the config file raises
an error.
- Add backup and restore tools, directory.
- require at least systemd 38 which provides the journal (we no longer
need to require syslog.target)
- Update Requires on policycoreutils to 2.1.14-37
- Update Requires on selinux-policy to 3.12.1-42
- Update Requires on 389-ds-base to 1.3.1.0
- Remove a Requires for java-atk-wrapper
- Preserve user: fix the confusing summary
Resolves: RHBZ#2022028
- Only calculate LDAP password grace when the password is expired
Related: RHBZ#782917
- Resolves: #1260663 crash of ipa-dnskeysync-replica component during
ipa-restore
- IPA Restore: allows to specify files that should be removed
- Resolves: #1261806 Installing ipa-server package breaks httpd
- Handle timeout error in ipa-httpd-kdcproxy
- Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
- Server Upgrade: backup CS.cfg when dogtag is turned off
- ipa-server-install crashes when AD subpackage is not installed (#1026434)
- Resolves: #1228671 pkispawn fails in ipa-ca-install and ipa-kra-install
- Related: #1204809 Rebase ipa to 4.2
- Fix minimum version of slapi-nis
- Require python-sss and python-sss-murmur (provided by sssd-1.13.0)
- Drop conflicts on mod_nss
- Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
- Drop a slew of conditionals on older Fedora releases (< 12)
- Add a few conditionals against RHEL 6
- Add Requires of nss-tools on ipa-client
- Upstream release FreeIPA 4.9.3
Resolves: RHBZ#1945038
- Fix systemd-user HBAC rule
Resolves: RHBZ#1664974
- sudo rule for "admins" members should be created by default (#1609873)
- New upstream release 1.2.1
- Updated to current upstream state of 3.0.0 beta 2 development
- Wrong directories created on full restore (#1186398)
- ipa-restore crashes if replica is unreachable (#1186396)
- idoverrideuser-add option --sshpubkey does not work (#1185410)
- Missing objectclasses when empty password passed to host-add (#1052979)
- sudoOrder missing in sudoers (#1052983)
- Missing examples in sudorule help (#1049464)
- Client automount does not uninstall when fstore is empty (#910899)
- Error not clear for invalid realm given to trust-fetch-domains (#1052981)
- trust-fetch-domains does not add idrange for subdomains found (#1049926)
- Add option to show if an AD subdomain is enabled/disabled (#1052973)
- ipa-adtrust-install still failed with long NetBIOS names (#1030517)
- Error not clear for invalid relam given to trustdomain-find (#1049455)
- renewed client cert not recognized during IPA CA renewal (#1033273)
- Revert bind-pkcs11-utils configuration in freeipa.spec.
Resolves: RHBZ#2026732
- Replace TurboGears requirement with python-cherrypy
- Update to upstream 3.2.1
- Drop dogtag-pki-server-theme requires, it won't be build for RHEL-7.0
- Remove ipa-idoverride-memberof as superceded by ipa-server 4.8.7
Resolves: RHBZ#1846434
- Respin after the tarball has been re-released upstream
New hash is 506c9c92dcaf9f227cba5030e999f177
- Allow Web-based migration to work with tightened SE Linux policy (#769440)
- Rebuild slapi plugins against re-enterant version of libldap
- Remove strict dependencies to krb5-server version in order to allow
update of krb5 to 1.17 and change dependency to KDB DAL version.
Resolves: RHBZ#1700121
- Fixed: rhbz#1643445 - External CA step 2 fails with pki_client_database_dir is missing
- Fixed: rhbz#1642834 - Smart card advise script uses hard-coded Python interpreter
- Resolves: #1277696 IPA certificate auto renewal fail with "Invalid
Credential"
- cert renewal: make renewal of ipaCert atomic
- Resolves: #1278330 installer options are not validated at the beginning of
installation
- install: fix command line option validation
- Resolves: #1282845 sshd_config change on ipa-client-install can prevent sshd
from starting up
- client install: do not corrupt OpenSSH config with Match sections
- Resolves: #1282935 ipa upgrade causes vault internal error
- install: export KRA agent PEM file in ipa-kra-install
- Resolves: #1283429 Default CA ACL rule is not created during
ipa-replica-install
- TLS and Dogtag HTTPS request logging improvements
- Avoid race condition caused by profile delete and recreate
- Do not erroneously reinit NSS in Dogtag interface
- Add profiles and default CA ACL on migration
- disconnect ldap2 backend after adding default CA ACL profiles
- do not disconnect when using existing connection to check default CA ACLs
- Resolves: #1283430 ipa-kra-install: fails to apply updates
- suppress errors arising from adding existing LDAP entries during KRA
install
- Resolves: #1283748 Caching of ipaconfig does not work in framework
- fix caching in get_ipa_config
- Resolves: #1283943 IPA DNS Zone/DNS Forward Zone details missing after
upgrade from RHEL 7.0 to RHEL 7.2
- upgrade: fix migration of old dns forward zones
- Fix upgrade of forwardzones when zone is in realmdomains
- Resolves: #1284413 ipa-cacert-manage renew fails on nonexistent ldap
connection
- ipa-cacert-renew: Fix connection to ldap.
- Resolves: #1284414 ipa-otptoken-import fails on nonexistent ldap connection
- ipa-otptoken-import: Fix connection to ldap.
- Resolves: #1286635 IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using
"yum update ipa* sssd"
- Set minimal required version for openssl
- Resolves: #1286781 ipa-nis-manage does not update ldap with all NIS maps
- Upgrade: Fix upgrade of NIS Server configuration
- Resolves: #1289311 umask setting causes named-pkcs11 issue with directory
permissions on /var/lib/ipa/dnssec
- DNS: fix file permissions
- Explicitly call chmod on newly created directories
- Fix: replace mkdir with chmod
- Resolves: #1290142 Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
- Fix version comparison
- use FFI call to rpmvercmp function for version comparison
- Resolves: #1292595 In IPA-AD trust environment some secondary IPA based Posix
groups are missing
- ipa-kdb: map_groups() consider all results
- Resolves: #1293870 User should be notified for wrong password in password
reset page
- Fixed login error message box in LoginScreen page
- Resolves: #1296196 Sysrestore did not restore state if a key is specified in
mixed case
- Allow to used mixed case for sysrestore
- Resolves: #1296214 DNSSEC key purging is not handled properly
- DNSSEC: Improve error reporting from ipa-ods-exporter
- DNSSEC: Make sure that current state in OpenDNSSEC matches key state in
LDAP
- DNSSEC: Make sure that current key state in LDAP matches key state in BIND
- DNSSEC: remove obsolete TODO note
- DNSSEC: add debug mode to ldapkeydb.py
- DNSSEC: logging improvements in ipa-ods-exporter
- DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP
- DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
- DNSSEC: ipa-ods-exporter: add ldap-cleanup command
- DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removal
- DNSSEC: Log debug messages at log level DEBUG
- Resolves: #1296216 ipa-server-upgrade fails if certmonger is not running
- prevent crash of CA-less server upgrade due to absent certmonger
- always start certmonger during IPA server configuration upgrade
- Resolves: #1297811 The ipa -e skip_version_check=1 still issues
incompatibility error when called against RHEL 6 server
- ipalib: assume version 2.0 when skip_version_check is enabled
- Resolves: #1298289 install fails when locale is "fr_FR.UTF-8"
- Do not decode HTTP reason phrase from Dogtag
- Resolves: #1300252 shared certificateProfiles container is missing on a
freshly installed RHEL7.2 system
- upgrade: unconditional import of certificate profiles into LDAP
- Resolves: #1301674 --setup-dns and other options is forgotten for using an
external PKI
- installer: Propagate option values from components instead of copying them.
- installer: Fix logic of reading option values from cache.
- Resolves: #1301687 issues with migration from RHEL 6 self-signed to RHEL 7 CA
IPA setup
- ipa-ca-install: print more specific errors when CA is already installed
- cert renewal: import all external CA certs on IPA CA cert renewal
- CA install: explicitly set dogtag_version to 10
- fix standalone installation of externally signed CA on IPA master
- replica install: validate DS and HTTP server certificates
- replica install: improvements in the handling of CA-related IPA config
entries
- Resolves: #1301901 [RFE] compat tree: show AD members of IPA groups
- slapi-nis: update configuration to allow external members of IPA groups
- Resolves: #1305533 ipa trust-add succeded but after that ipa trust-find
returns "0 trusts matched"
- upgrade: fix config of sidgen and extdom plugins
- trusts: use ipaNTTrustPartner attribute to detect trust entries
- Warn user if trust is broken
- fix upgrade: wait for proper DS socket after DS restart
- Insure the admin_conn is disconnected on stop
- Fix connections to DS during installation
- Fix broken trust warnings
- Resolves: #1321092 Installers fail when there are multiple versions of the
same certificate
- certdb: never use the -r option of certutil
- Related: #1317381 Crash during IPA upgrade due to slapd
- spec file: update minimum required version of slapi-nis
- Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112
CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws
[rhel-7.3]
- Rebuild against newer Samba version
- RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
(#1169591)
- CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
(#1172578)
- Re-arrange doc and defattr to clean up rpmlint warnings
- Remove conditionals on older releases
- Move some man pages into admintools subpackage
- Remove some explicit Requires in client that aren't needed
- Consistent use of buildroot vs RPM_BUILD_ROOT
- Update to upstream 3.3.1 (#991064)
- Update minimum version of bind-dyndb-ldap to 3.5
- Remove release from krb5-server in strict sub-package to allow for rebuilds.
- Fix krb5-kdb-server -> krb5-kdb-version
Related: RHBZ#1700121
- Unified spec file
- Update to upstream 3.1.2
- CVE-2012-4546: Incorrect CRLs publishing
- CVE-2012-5484: MITM Attack during Join process
- CVE-2013-0199: Cross-Realm Trust key leak
- Updated strict dependencies to 389-ds-base = 1.3.0.2 and
pki-ca = 10.0.1
- IPA Replicate creation fails with error "Update failed! Status: [10 Total
update abortedLDAP error: Referral]" (#1166265)
- running ipa-server-install --setup-dns results in a crash (#1072502)
- DNS zones are not migrated into forward zones if 4.0+ replica is added
(#1175384)
- gid is overridden by uid in default trust view (#1168904)
- When migrating warn user if compat is enabled (#1177133)
- Clean up debug log for trust-add (#1168376)
- No error message thrown on restore(full kind) on replica from full backup
taken on master (#1175287)
- ipa-restore proceed even IPA not configured (#1175326)
- Data replication not working as expected after data restore from full backup
(#1175277)
- IPA externally signed CA cert expiration warning missing from log (#1178128)
- ipa-upgradeconfig fails in CA-less installs (#1181767)
- IPA certs fail to autorenew simultaneouly (#1173207)
- More validation required on ipa-restore's options (#1176034)
- Installer did not detect different server and IPA domain (#1026845)
- Allow kernel keyring CCACHE when supported (#1026861)
- Resolves: #1442233 IPA client commands fail when pointing to replica
- httpinstance: wait until the service entry is replicated
- Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
not indexed
- Fix index definition for ipaAnchorUUID
- Resolves: #1438016 gssapi errors after IPA server upgrade
- Avoid possible endless recursion in RPC call
- rpc: preparations for recursion fix
- rpc: avoid possible recursion in create_connection
- Resolves: #1446087 services entries missing krbCanonicalName attribute.
- Changing cert-find to do not use only primary key to search in LDAP.
- Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
- ipa-kdb: reload certificate mapping rules periodically
- Resolves: #1455541 after upgrade login from web ui breaks
- kdc.key should not be visible to all
- Resolves: #1435606 Add pkinit_indicator option to KDC configuration
- ipa-kdb: add pkinit authentication indicator in case of a successful
certauth
- Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
issuance when ipa-ca records are not resolvable
- Turn off OCSP check
- Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
server_del - TypeError: 'NoneType' object is not iterable
- fix incorrect suffix handling in topology checks
- Hardening for CVE-2020-25717
- Related: RHBZ#2019668
- Require python-wehjit >= 0.2.2
- Resolves: #837369 [RFE] Switch to client promotion to replica model
- Resolves: #1199516 [RFE] Move replication topology to the shared tree
- Resolves: #1206588 [RFE] Visualize FreeIPA server replication topology
- Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
- Resolves: #1212713 ipa-csreplica-manage: it could be nice to have also
list-ruv / clean-ruv / abort-clean-ruv for o=ipaca backend
- Resolves: #1267206 ipa-server-install uninstall should warn if no
installation found
- Resolves: #1295865 The Domain option is not correctly set in idmapd.conf when
ipa-client-automount is executed.
- Resolves: #1327092 URI details missing and OCSP-URI details are incorrectly
displayed when certificate generated using IPA on RHEL 7.2up2.
- Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
because of missing dependencies
- Related: #1292141 Rebase to FreeIPA 4.4+
- Rebase to 4.3.1.201605191449GITf8edf37
- Update to upstream 4.6.90.pre1
- Resolves: #1355753 adding two way non transitive(external) trust displays
internal error on the console
- Always fetch forest info from root DCs when establishing two-way trust
- factor out `populate_remote_domain` method into module-level function
- Always fetch forest info from root DCs when establishing one-way trust
- Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
after `ipa-replica-install`
- Track lightweight CAs on replica installation
- Resolves: #1357488 ipa command stuck forever on higher versioned client with
lower versioned server
- compat: Save server's API version in for pre-schema servers
- compat: Fix ping command call
- schema cache: Store and check info for pre-schema servers
- Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
- Fix man page ipa-replica-manage: remove duplicate -c option
from --no-lookup
- Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
when revoking certificate
- cert: include CA name in cert command output
- WebUI add support for sub-CAs while revoking certificates
- Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
- Add support for additional options taken from table facet
- WebUI: Fix showing certificates issued by sub-CA
- Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
internactively
- dns: normalize record type read interactively in dnsrecord_add
- dns: prompt for missing record parts in CLI
- dns: fix crash in interactive mode against old servers
- Resolves: #1370519 Certificate revocation in service-del and host-del isn't
aware of Sub CAs
- cert: fix cert-find --certificate when the cert is not in LDAP
- Make host/service cert revocation aware of lightweight CAs
- Resolves: #1371901 Use OAEP padding with custodia
- Use RSA-OAEP instead of RSA PKCS#1 v1.5
- Resolves: #1371915 When establishing external two-way trust, forest root
Administrator account is used to fetch domain info
- do not use trusted forest name to construct domain admin principal
- Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
certificate request
- Fix CA ACL Check on SubjectAltNames
- Resolves: #1373272 CLI always sends default command version
- cli: use full name when executing a command
- Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
- Fix ipa-certupdate for CA-less installation
- Resolves: #1373540 client-install with IPv6 address fails on link-local
address (always)
- Fix parse errors with link-local addresses
- man page: update ipa-server-upgrade.1
Resolves: RHBZ#1973273
- Fall back to krbprincipalname when validating host auth indicators
Resolves: RHBZ#1979625
- Add dependency for sssd-winbind-idmap to server-trust-ad
Resolves: RHBZ#1982211
- Fix replica installation failing on certificate subject (#983075)
- Rebase ipa to 4.9.11
Resolves: RHBZ#2141316
- updates: fix memberManager ACI to allow managers from a specified group
Resolves: RHBZ#2056009
- Defer creating the final krb5.conf on clients
Resolves: RHBZ#2148259
- Exclude installed policy module file from RPM verification
Resolves: RHBZ#2149567
- Spec file: ipa-client depends on krb5-pkinit-openssl
Resolves: RHBZ#2149889
- When IdM server trusts multiple AD forests, IPA client returns invalid group
membership info (#1079498)
- IPA server in debug mode fails to run because time.perf_counter_ns is
Python 3.7+
Resolves: RHBZ#1974822
- Add checks to prevent assigning authentication indicators to internal IPA
services
Resolves: RHBZ#1979625
- Unable to set ipaUserAuthType with stageuser-add
Resolves: RHBZ#1979605
- Replica installation fails for RHEL 6.4 master (#1004680)
- Server uninstallation crashes if DS is not available (#998069)
- Updated to upstream 3.1.0 GA
- Set minimum for sssd to 1.9.2
- Set minimum for pki-ca to 10.0.0-1
- Set minimum for 389-ds-base to 1.3.0
- Set minimum for selinux-policy to 3.11.1-60
- Remove unneeded dogtag package requires
- Updated to upstream 3.0.0 rc 1
- Update BR for 389-ds-base to 1.2.11.14
- Update BR for krb5 to 1.10
- Update BR for samba4-devel to 4.0.0-139 (rc1)
- Add BR for python-polib
- Update BR and Requires on sssd to 1.9.0
- Update Requires on policycoreutils to 2.1.12-5
- Update Requires on 389-ds-base to 1.2.11.14
- Update Requires on selinux-policy to 3.11.1-21
- Update Requires on dogtag to 10.0.0-0.33.a1
- Update Requires on certmonger to 0.60
- Update Requires on tomcat to 7.0.29
- Update minimum version of bind to 9.9.1-10.P3
- Update minimum version of bind-dyndb-ldap to 1.1.0-0.16.rc1
- Remove Requires on authconfig from python sub-package
- Update Requires on krb5-server to 1.11
- Moved directory install/static to install/ui
- Fix ipa-pwd-extop global configuration caching (#1187342)
- group-detach does not add correct objectclasses (#1187540)
- Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
- Keep NSS trust flags of existing certificates
- Resolves: #1360813 ipa-server-certinstall does not update all certificate
stores and doesn't set proper trust permissions
- Add cert checks in ipa-server-certinstall
- Resolves: #1371479 cert-find --all does not show information about revocation
- cert: add revocation reason back to cert-find output
- Resolves: #1375133 WinSync users who have First.Last casing creates users who
can have their password set
- ipa passwd: use correct normalizer for user principals
- Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
- Properly handle LDAP socket closures in ipa-otpd
- Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
- Make httpd publish its CA certificate on DL1
- ipatests: remove additional check for failed units.
Resolves: RHBZ#2053024
- ipa-cldap: fix memory leak.
Resolves: RHBZ#2032738
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Resolves: #1382053 Need to have validation for idrange names
- idrange-add: properly handle empty --dom-name option
- Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
helper when installing replica
- dsinstance: reconnect ldap2 after DS is restarted by certmonger
- httpinstance: avoid httpd restart during certificate request
- dsinstance, httpinstance: consolidate certificate request code
- install: request service certs after host keytab is set up
- renew agent: revert to host keytab authentication
- renew agent, restart scripts: connect to LDAP after kinit
- Resolves: #1436987 ipasam: gidNumber attribute is not created in the trusted
domain entry
- ipa-sam: create the gidNumber attribute in the trusted domain entry
- Upgrade: add gidnumber to trusted domain entry
- Resolves: #1438679 [ipa-replica-install] - IncorrectPasswordException:
Incorrect client security database password
- Add pki_pin only when needed
- Resolves: #1438348 Console output message while adding trust should be
mapped with texts changed in Samba.
- ipaserver/dcerpc: unify error processing
- Resolves: #1438366 ipa trust-fetch-domains: ValidationError: invalid
'Credentials': Missing credentials for cross-forest communication
- trust: always use oddjobd helper for fetching trust information
- Resolves: #1441192 Add the name of URL parameter which will be check for
username during cert login
- WebUI: cert login: Configure name of parameter used to pass username
- Resolves: #1437879 [copr] Replica install failing
- Create system users for FreeIPA services during package installation
- Resolves: #1441316 WebUI cert auth fails after ipa-adtrust-install
- Fix s4u2self with adtrust
- Require samba 4.14.5-13 with IPA DC server role fixes
- Related: RHBZ#2021443
- Update to upstream 3.2.2
- Drop ipa-server-selinux subpackage
- Drop redundant directory /var/cache/ipa/sessions
- Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
- Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
issues when there are still old parts of software (like entitlements plugin)
- Version bump for release
- Add versioned dependency of samba-client-libs to ipa-server
- Related: RHBZ#2021443
- Upstream release FreeIPA 4.8.7
- Require new samba build 4.12.3-0
Related: RHBZ#1818765
- New client-epn sub package
Resolves: RHBZ#913799
python3-jwcrypto-0.5.0-2.module+el8.10.0+1818+2dfda7a6.noarch.rpm | - Drop Python 2 subpackages from RHEL 8, fixes RHBZ#1567152
- Bump dist to solve version sorting issue, fixes RHBZ#2097800
- Ship readme and license with python3 subpackage
- Move tests to %check
- New upstream release 0.5.0
- Fixes Coverity scan issue
- Address potential DoS with high compression ratio
Resolves: RHEL-28697
- Limit number of iterations for PBES
Resolves: RHEL-23036 RHEL-23037
- Initial packaging
- Security release 0.3.2
- Resolves: CVE-2016-6298
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- New release
- Fixes some key generation issues
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- Upstream release 0.4.1
- Rebuild for Python 3.6
- New release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Bugfix release 0.3.1
- Fix macro in changelog
- Remove the last remnants of the test suite
- Enable python3 build
- Fix F21 build error by adding buildrequire python-setuptools
- Move files into python3-jwcrypto subpackage
- Run test suite
- Do not install test suite
- Fix summary and description of python3-jwcrypto
- Upstream release 0.4.2
- Resolves: RHBZ #1476150
- Build Python 3 package on RHEL > 7, fixes RHBZ#1516813
- Modernize spec
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Run tests with bytes warning
python3-ldap-3.3.1-2.el8.x86_64.rpm | - Update to 2.3.6
- fix spec permissions + release tag order (bug 1099)
- rebuilt with new openssl
- update to 2.0.1
- 2.0.6
- In %check, use pytest directly rather than tox
- add LICENCE (#150842)
- simplify python reqs
- remove invalid rpath
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rebuild with GCC 4.3
- Python 2 binary package renamed to python2-ldap
See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
- Update to 2.2.0
- Update python-ldap-2.0.6-rpath.patch and rename it to
python-ldap-2.2.0-dirs.patch.
- imported into Red Hat's packaging system from Fedora.us; set release to 1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Rebuild for Python 2.6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- rebuild with new openssl
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- New upstream release 3.0.0b3 (RHBZ #1496470)
- New upstream release 2.4.25
- New upstream release 3.0.0b4 (RHBZ #1496470)
- rebuild against python 2.5
- rebuilt to pick up new libssl.so.5
- Initial Fedora packaging.
- New upstream release 3.0.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Stricter python version requirements.
- BuildRequire openssl-devel.
- Explicitly build *.pyo, install them as %ghost.
- Own more installed dirs.
- Remove $RPM_BUILD_ROOT at start of %install.
- Update to 2.3.10
- Change source URI to pypi.python.org.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- rebuilt with new openssl
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- rebuilt for new gcc4.1 snapshot and glibc changes
- New upstream release 3.0.0b2 (RHBZ #1496470)
- Require OpenLDAP with fix for NSS issue (see #1520990)
- Rebuild due to bug in RPM (RHBZ #1468476)
- Fix SASL get/set options on big endian platforms
- Resolves: #1931865
- New upstream release 3.1.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- New upstream release
- bump again for double-long bug on ppc(64)
- duh, build requires python-devel, not just python...
- Merge-review cleanup (#226343)
- Fix issue in pyasn1 patch
- Don't build the python2 subpackage
(fix for the previous commit)
- New upstream release 3.1.0
- Resolves: rhbz#1889615
- Apply fix for pyasn1 >= 0.3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Update to 2.3
- Spec file cleanups.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rewrote description; added requirement for openldap
- fix license tag
- update to 2.3.5
- New upstream release 3.0.0b1 (RHBZ #1496470)
- Resolves RHBZ #1489184
- Enable unittests
- Remove dsml module
- Package python3-ldap, which obsoletes python3-pyldap
- New upstream release fixes bug 1007820
- Dependency on pyasn1 was added to fix bug 995545
- rebuild
- New upstream release adds features required in bug 1122486
- Dependency on pyasn1-modules was added to fix bug 995545
- Rebuild against new openssl.
- Put back the epoch line... happy beehive?
- rebuild (#139161)
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650537
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Fix a build error.
- Update to 2.3.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- rebuilt
- Conditionalize, and don't build, the python2 subpackage
python3-libipa_hbac-2.9.4-5.el8_10.2.x86_64.rpm | - Decrease priority of sssd-libwbclient 20 -> 5
- It should be lower than priority of samba veriosn of libwbclient.
- https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18
- Add explicit requirement on selinux-policy version to address new SBUS
symlinks.
- Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
certificate EKU and perform an action based
on value when generating SSH key from a certificate
- Resolves: rhbz#752495 - Crash when apply settings
- Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
repository
- This just required a raise in release number
and changelog for the record.
- Only BuildRequire libcmocka on Fedora
- Resolves: rhbz#1256849 - SUDO: Support the IPA schema
- Use alternatives for libwbclient
- New upstream release 1.12.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.4
- Resolves: rhbz#1754996 - [sssd] Tier 0 Localization
- Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
- Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
file from package sssd-common-1.15.1-1.fc25.x86_64
- Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4
- Unify return type of list_active_domains for python{2,3}
- Fix incorrect tarball URL
- Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
of gen_new to avoid a subsequent switch call
failure
- Fix upgrade issues from old (pre-0.5.0) releases of SSSD
- Resolves: rhbz#1672780 - gdm login not prompting for username when smart
card maps to multiple users
- Resolves: rhbz#683267 - sssd 1.5.1-9 breaks AD authentication
- Fix broken ARM build
- Add missing DP_OPTION_TERMINATOR in AD provider options
- Backport upstream patches for 1.15.3 pre-release
- required for building freeipa-4.5.x in rawhide
- Resolves: rhbz#606887 - sssd stops on upgrade
- Fix nested group member filter sanitization for RFC2307bis
- Put translated tool manpages into the sssd-tools subpackage
- Fix regression with krb5_map_user
- Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
- Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
default if nonexistent domain is mentioned
- New upstream release 1.6.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
- Fixes a major cache performance issue introduced in 1.6.2
- Fixes a potential infinite-loop with certain LDAP layouts
- Related: rhbz#1638150 - session not recording for local user when groups defined
- Also add silence a Coverity warning, which is related to rhbz#1637131
- New upstream release 1.4.1
- Add support for netgroups to the proxy provider
- Fixes a minor bug with UIDs/GIDs >= 2^31
- Fixes a segfault in the kerberos provider
- Fixes a segfault in the NSS responder if a data provider crashes
- Correctly use sdap_netgroup_search_base
- Resolves: rhbz#1636397 - SSSD not fetching all sudo rules from AD
- Change the default ccache location to DIR:/run/user/${UID}/krb5cc
and patch man page accordingly
- Resolves: rhbz#851304
- Resolves: rhbz#1615590 - Do not rely on "python" for el8
- Install systemd unit file instead of sysv init script
- New upstream release 1.9.0 beta7
- obsoletes patches #1-#3
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
- Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
- Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
- Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
- Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
- Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade
- Rebuild for libldb 1.1.19
- Version 0.2.1
- New stable upstream version 1.2.1
- Resolves: rhbz#595529 - spec file should eschew %define in favor of
- %global
- Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
- to fail while restart.
- Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
- keyring
- Resolves: rhbz#599724 - sssd is broken on Rawhide
- Resolves: rhbz#1729055 - sssd does not pass correct rules to sudo
- New upstream release 1.5.6
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
- Fixed a serious memory leak in the memberOf plugin
- Fixed a regression with the negative cache that caused it to be essentially
- nonfunctional
- Fixed an issue where the user's full name would sometimes be removed from
- the cache
- Fixed an issue with password changes in the kerberos provider not working
- with kpasswd
- Fix regression on 64-bit platforms
- Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
suggests using * for backend sss
- New upstream release 1.6.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
- Fixes a serious issue with LDAP connections when the communication is
dropped (e.g. VPN disconnection, waking from sleep)
- SSSD is now less strict when dealing with users/groups with multiple names
when a definitive primary name cannot be determined
- The LDAP provider will no longer attempt to canonicalize by default when
using SASL. An option to re-enable this has been provided.
- Fixes for non-standard LDAP attribute names (e.g. those used by Active
Directory)
- Three HBAC regressions have been fixed.
- Fix for an infinite loop in the deref code
- New upstream release 1.10 beta2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
- BuildRequire libcmocka-devel in order to run all upstream tests during build
- BuildRequire libnl3 instead of libnl1
- No longer BuildRequire initscripts, we no longer use /sbin/service
- Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
older krb5-libs version
- This is to bump version to allow rebuild against rebased libldb.
- New upstream release 1.11.5.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5.1
- Backport patches from upstream 1.12.5 prerelease - contains many fixes
- New upstream release 1.9.0
- New upstream release 1.7.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
- Support for case-insensitive domains
- Support for multiple search bases in the LDAP provider
- Support for the native FreeIPA netgroup implementation
- Reliability improvements to the process monitor
- New DEBUG facility with more consistent log levels
- New tool to change debug log levels without restarting SSSD
- SSSD will now disconnect from LDAP server when idle
- FreeIPA HBAC rules can choose to ignore srchost options for significant
performance gains
- Assorted performance improvements in the LDAP provider
- Resolves: rhbz#1466503 - Snippets are not used when sssd.conf does not exist
- New upstream release 1.13.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.4
- New upstream release 1.5.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
- Fixes for support of FreeIPA v2
- Fixes for failover if DNS entries change
- Improved sss_obfuscate tool with better interactive mode
- Fix several crash bugs
- Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
- Delete users from the local cache if initgroups calls return 'no such user'
- (previously only worked for getpwnam/getpwuid)
- Use new Transifex.net translations
- Better support for automatic TGT renewal (now survives restart)
- Netgroup fixes
- New upstream release 1.8.0 beta 3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
- Fixed a regression in group enumeration since 1.7.0
- Fixed several memory-corruption bugs
- Finalized the ABI for the autofs support
- Fixed a regression in the proxy provider
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
- Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
- Resolves: rhbz#1803134 - Improve "unlock" time when user session already active
- Resolves: rhbz#1328108 - Protocol error with FreeIPA on CentOS 6
- Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
- doesn't require it
- Rebuild against libldb 1.10
- Build with _hardened_build macro
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- New upstream release 1.1.1
- Fixed the IPA provider (which was segfaulting at start)
- Fixed a bug in the SSSDConfig API causing some options to revert to
- their defaults
- This impacted the Authconfig UI
- Ensure that SASL binds to LDAP auto-retry when interrupted by a signal
- Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
- Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter
- Rebuild against new libtevent
- latest upstream release.
- also add a patch that fixes debugging output (potential segfault)
- Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
groups during getgrnam and getgrgid
- Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
in call to 'print'
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features
- Rebuild against PCRE 8.30
- CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Rebuild SSSD against ding-libs 0.3.0beta1
- Fix endianness bug in service map protocol
- Fix pre and post script requirements
- sssd-tools should require sssd-common, not sssd
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
- Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
- Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
- Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
- Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
- Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #
raise(): /usr/libexec/sssd/sssd_autofs killed by 6
- Fix segfault in TGT renewal
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
- Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
- Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
- Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
- Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
- Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]
- Only create the SELinux login file if there are SELinux mappings on
the IPA server
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
- Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)
- Add plugin for cifs-utils
- Resolves: rhbz#998544
- Fix memberOf install path
- Related: rhbz#1638006 - Files: The files provider always enumerates
which causes duplicate when running getent passwd
- New upstream release 1.14.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.1
- New upstream release 1.14 alpha
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0alpha
- Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
setnetgrent_result_timeout
- Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
or machine swaps
- Resolves: failure in glibc tests
https://sourceware.org/bugzilla/show_bug.cgi?id=22530
- Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
auth_provider ldap, login fails if the LDAP server
is not allowing anonymous binds
- Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
corrected with AD
- Resolves: upstream#3586 - Give a more detailed debug and system-log message
if krb5_init_context() failed
- Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
in /etc/systemd/system
- Backport few upstream features from 1.16.1
- Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
new ones (kcm)
- Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
- Resolves: rhbz#1646168 - sssctl access-report always prints an error message
- Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
configuration without having to restart the whole
sssd
- Resolves: rhbz#1640576 - sssctl reports incorrect information about local
user's cache entry expiration time
- Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
- Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys
- the cmocka toolkit exists only on selected arches
- Fixes a serious memory hierarchy bug causing unpredictable behavior in the
LDAP provider.
- New upstream release 1.11.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0
- Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
/usr/libexec/sssd/proxy_child killed by 6
- Fix building of sssd-nfs-idmap with libnfsidmap.so.1
- New upstream release 1.10
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0
- Backport more sbus2 fixes
- Related: rhbz#1623878 - crash related to sbus_router_destructor()
- Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
certificate EKU and perform an action based
on value when generating SSH key from a certificate
(additional patch)
- Solve a shutdown race-condition that sometimes left processes running
- Resolves: rhbz#606887 - SSSD stops on upgrade
- Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
with no specific host/hostgroup set
- Resolves: upstream#3621 - FleetCommander integration must not require
capability DAC_OVERRIDE
- Remove %files reference to sss_debuglevel copied from wrong upstreeam
spec file.
- Resolves: rhbz#1713368 - Add sssd-dbus package as a dependency of sssd-tools
- Resolves: RHEL-33957 - ad: refresh root domain when read directly
- Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
- Make sure to properly convert to systemd if upgrading from newer
- updates for Fedora 14
- Fix build issues: Update expided certificate in unit tests
- New upstream release 0.7.0
- New upstream release 1.14.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0
- Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
sssd_ifp killed by SIGSEGV
- New upstream version 1.2.91 (1.3.0rc1)
- Improved LDAP failover
- Synchronous sysdb API (provides performance enhancements)
- Better online reconnection detection
- New LDAP access provider allows for filtering user access by LDAP attribute
- Reduced default timeout for detecting offline status with LDAP
- GSSAPI ticket lifetime made configurable
- Better offline->online transition support in Kerberos
- Release new upstream version 1.1.91
- Enhancements when using SSSD with FreeIPA v2
- Support for deferred kinit
- Support for DNS SRV records for failover
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
- Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
- Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
- Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
- Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
- Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
- Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
- Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
- Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
- Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
- Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
- Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf
- Resolves: rhbz#1646113 - Missing concise documentation about valid options
for sssd-files-provider
- Fix typo in libwbclient-devel %preun
- Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
- Also sync. kcm multihost tests with master
- Switch unicode library from libunistring to Glib
- Drop unnecessary explicit Requires on keyutils
- Guarantee that versioned Requires include the correct architecture
connection timeout
- Resolves: rhbz#1139962 - Fedora 21, FreeIPA 4.0.2: sssd does not find user
private group from server
- New upstream release 1.5.5
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
- Fixes for several crash bugs
- LDAP group lookups will no longer abort if there is a zero-length member
- attribute
- Add automatic fallback to 'cn' if the 'gecos' attribute does not exist
- New upstream bugfix release 0.99.1
- Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
- Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
- Several segfault bugfixes
- Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
retrieve AD users through IPA Trust
- New upstream release 1.5.10
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
- Fixed a regression introduced in 1.5.9 that could result in blocking calls
- to LDAP
- Rebuilt for libnfsidmap.so.1
- Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
specified up to the seconds
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
if ID provider is authenticated with GSSAPI
- New upstream release 1.9.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Release SSSD 1.1.0 final
- Fix two potential segfaults
- Fix memory leak in monitor
- Better error message for unusable confdb
- New upstream release 1.6.4
- Rolls up previous patches applied to the 1.6.3 tarball
- Fixes a rare issue causing crashes in the failover logic
- Fixes an issue where SSSD would return the wrong PAM error code for users
that it does not recognize.
- Related: rhbz#1635595 - Cant login with smartcard with multiple certs
- New upstream release 1.9.0 beta 1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
- Add native support for autofs to the IPA provider
- Support for ID-mapping when connecting to Active Directory
- Support for handling very large (> 1500 users) groups in Active Directory
- Support for sub-domains (will be used for dealing with trust relationships)
- Add a new fast in-memory cache to speed up lookups of cached data on
repeated requests
- Backport important patches from upstream 1.13 prerelease
- Relax libldb BuildRequires to be greater-or-equal
- Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
- Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
- Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
- Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
inotify events, and no updates are triggered
- Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
on GDM login with smart-card
- Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
- Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
- Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
- Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
if LDAP entries do not contain AD forest root information
- Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
in SSSD-AD direct integration.
- Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
- Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
- Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma
- add missing configure check that broke stopping the daemon
- also fix default config to add a missing required option
- New upstream release 1.9.0 beta 6
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
- A new option, override_shell was added. If this option is set, all users
managed by SSSD will have their shell set to its value.
- Fixes for the support for setting default SELinux user context from FreeIPA.
- Fixed a regression introduced in beta 5 that broke LDAP SASL binds
- The SSSD supports the concept of a Primary Server and a Back Up Server in
failover
- A new command-line tool sss_seed is available to help prime the cache with
a user record when deploying a new machine
- SSSD is now able to discover and save the domain-realm mappings
between an IPA server and a trusted Active Directory server.
- Packaging changes to fix ldconfig usage in subpackages (#843995)
- Rebuild against libldb 1.1.9
- New upstream release 1.9.4
- Rebuild against libldb 1.1.4
- package git snapshot
- Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
access on the sock_file system_bus_socket
- Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
fails to download desktop profile data
- Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
- Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
after applying ID Views for them in IPA server
- Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
mapping is applied
- Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
differs from the default
- Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
- Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
- Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
- Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
- Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
- Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
- Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
- Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
- Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
- Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
- Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
- Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization
- Apply a number of patches from upstream to fix issues found post-beta,
in particular:
-- segfault with a high DEBUG level
-- Fix IPA password migration (upstream #1873)
-- Fix fail over when retrying SRV resolution (upstream #1886)
- Rebuild for libldb 1.1.18
- Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
pam libraries
- Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
prompts (e.g. Password + Token)
- Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
by remote host" if locale not available
- Resolves: rhbz#1733372 - permission denied on logs when running sssd as
non-root user
- Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
information
- Fix Obsoletes: to account for dist tag
- Convert post and pre scripts to run on the sssd-common subpackage
- Remove old conversion from SYSV
- Fix regression in endianness patch
- New upstream release 1.4.0
- Added support for netgroups to the LDAP provider
- Performance improvements made to group processing of RFC2307 LDAP servers
- Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
- Build-system improvements to support Gentoo
- Split out several libraries into the ding-libs tarball
- Manpage reviewed and updated
- Fix regressions and bugs in sssd upstream 1.12.2
- https://fedorahosted.org/sssd/ticket/{id}
- Regressions: #2471, #2475, #2483, #2487, #2529, #2535
- Bugs: #2287, #2445
- New upstream release 1.8.0
- Support for the service map in NSS
- Support for setting default SELinux user context from FreeIPA
- Support for retrieving SSH user and host keys from LDAP (Experimental)
- Support for caching autofs LDAP requests (Experimental)
- Support for caching SUDO rules (Experimental)
- Include the IPA AutoFS provider
- Fixed several memory-corruption bugs
- Fixed a regression in group enumeration since 1.7.0
- Fixed a regression in the proxy provider
- Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
- Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
logged at each login
- Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
/usr/sbin/sssd was killed by signal 11 (SIGSEGV)
- Resolves: rhbz#743133 - Performance regression with Kerberos authentication
against AD
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features
- Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc
- New upstream release 1.10 beta1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta1
- New upstream release 1.12.5
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.5
- Backport few upstream patches/fixes
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
- Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
- Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
- Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
- Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
- Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
- Resolves: rhbz#2098617 - Harden kerberos ticket validation
- Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
- Resolves: rhbz#1164156 - libsss_simpleifp should pull sssd-dbus
- Resolves: rhbz#1179379 - gzip: stdin: file size changed while
zipping when rotating logfile
- Include the 1.9.2 tarball
- Resolves: rhbz#1578014 - sssd does not work under non-root user
- Note: Actually the patches were in the 2.0.0-37, this one just adds this
changelog because it was missing.
- Use mcpath insted of mcachepath macro to be consistent with
upsteam spec file
- Add missing %license macro
- New upstream release
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
- Fix two minor manpage bugs
- Include the IPA AutoFS provider
- Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
and libtevent to avoid an issue in GPO processing
- Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
- against LDAP
- Resolves: upstream#3618 - selinux_child segfaults in a docker container
- Check the validity of naming context
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- New upstream release 1.15.3
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_3.html
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Resolves: rhbz#1726945 - negative cache does not use values from
'filter_users' config option for known domains
- Related: rhbz#1637131 - pam_unix unable to match fully qualified username
provided by sssd during smartcard auth using gdm
- New upstream release 1.5.1
- Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Vast performance improvements when enumerate = true
- All PAM actions will now perform a forced initgroups lookup instead of just
- a user information lookup
- This guarantees that all group information is available to other
- providers, such as the simple provider.
- For backwards-compatibility, DNS lookups will also fall back to trying the
- SSSD domain name as a DNS discovery domain.
- Support for more password expiration policies in LDAP
- 389 Directory Server
- FreeIPA
- ActiveDirectory
- Support for ldap_tls_{cert,key,cipher_suite} config options
-Assorted bugfixes
- Resolves: #967012 - [abrt] sssd-1.9.5-1.fc18: sss_mmap_cache_gr_invalidate_gid:
Process /usr/libexec/sssd/sssd_nss was killed by
signal 11 (SIGSEGV)
- Resolves: #996214 - sssd proxy_child segfault
- Resolves: rhbz#1687281
Rebase sssd in RHEL-8.1 to the latest upstream release
- Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
- Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
- Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working
- Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
- cached password with predicatable filename
- Backport important patches from upstream 1.13 prerelease
- Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
attribute for group name
- Resolves: upstream #2335 - Investigate using the krb5 responder
for driving the PAM conversation with OTPs
- Enable cmocka tests for secondary architectures
- Split internal helper libraries into a shared object
- Significantly reduce disk-space usage
- Resolves: rhbz#1687281
Rebase sssd in RHEL-8.1 to the latest upstream release
-Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
UnknownProperty: Unknown property
- Re-add manpage translations
- Resolves: rhbz#632615 - the krb5 locator plugin isn't packaged for multilib
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Patch SSSDConfig API to address
- https://bugzilla.redhat.com/show_bug.cgi?id=549482
- Fix slow login with ipa and SELinux
- Resolves: upstream #2624 - Only set the selinux context if the context
differs from the local one
for match rules sss-certmap
- Resolves: RHEL-39085 - [RfE] SSSD Failover Enhancements
- Rebuild for new libldb
- Don't duplicate libsss_autofs.so in two packages
- Set explicit package contents instead of globbing
- New upstream release 1.5.3
- Support for libldb >= 1.0.0
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
- Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user
- Change selinux policy requirement to Conflicts: with the old version,
rather than Requires: the supported version.
- New upstream release 0.5.0
- Backport extended NSS API from upstream master branch
- Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
with smart card
- New upstream release 1.9.0 rc1
- Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
- Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
- Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
- Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
- Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
- Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
- Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
- Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
- Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
- Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
- Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
- Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
- Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
- Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
- Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
- Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
- Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
- Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
- Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
- Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
- Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
- Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
- Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
- Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'
- Rebuild against libldb 1.12
- New upstream release 0.6.0
- Fix build with new automake versions
- Add a patch to fix krb5 ccache creation issue with krb5 1.11
- Resolves: rhbz#1431153 - sssd: libsss_proxy.so needs to be linked with -ldl
- Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
the IP address of the machine updated in IPA upon
sssd.service startup
- Rebuilt for Python3.5 rebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Add a patch to fix krb5 unit tests
- New upstream release 0.99.0
- New upstream release 1.14 beta
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0beta
- Apply a couple of patches from upstream git that resolve crashes when
ID mapping object was not initialized properly but needed later
- Make LDB dependency a strict equivalency
- New upstream release 1.12.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.1
- Backport patches with Python3 support from upstream
- Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
commands in man pages since local provider
is deprecated
- Include upstream patch to build with krb5-1.11
- Include couple of patches from upstream 1.11 branch
- Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
Rebuild against Samba rebase.
- Enable hardened build for RHEL7
- Update to 1.16.2 release
- Cleanup unused global definitions
- Remove python2 references from the spec file
- Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x
- Resolves: rhbz#1625842 id_provider= local causes SSSD to abort startup
- Resolves: rhbz#697057 - kpasswd fails when using sssd and
- kadmin server != kdc server
- Upgrades from SysV should now maintain enabled/disabled status
- Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
should not cause files domain entries to be
qualified, this can break sudo access
- Related: rhbz#1611011 - Support for "require smartcard for login option"
- Additional upstream fixes
- Fix double free in monitor
- Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
sssd killed by SIGABRT
- Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
systemd-user service in the account phase in RHEL-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
- Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
- Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
- Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
- Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
- Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
- Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
- Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
- Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
- Resolves: rhbz#2087745 - 2FA prompting setting ineffective
- Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language
- Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
- Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
- Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend
- Backport important patches from upstream 1.14.2 prerelease
- Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
boot
- Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14
- Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
omitted and auth_provider is krb5
- Change default kerberos credential cache location to /run/user/
- Fix failover from Global Catalog to LDAP in case GC is not available
- New upstream release 1.5.8
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
- Support for the LDAP paging control
- Support for multiple DNS servers for name resolution
- Fixes for several group membership bugs
- Fixes for rare crash bugs
- Own several directories create during make install (#839782)
- Move the sss_cache tool to the main package
- New upstream release 1.15.2
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_2.html
- Move sssd_pac to the sssd-krb5 subpackage
- Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
in ding-libs
- Fix SSH integration with fully-qualified domains
- Add the ability to dynamically discover the NetBIOS name
- Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
Rebuild against rebased Samba libs
- Resolves: rhbz#1820574 - [sssd] RHEL 8.3 Tier 0 Localization
- New upstream release 1.5.0
- Fixed issues with LDAP search filters that needed to be escaped
- Add Kerberos FAST support on platforms that support it
- Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
- Added a Kerberos access provider to honor .k5login
- Addressed several thread-safety issues in the sss_client code
- Improved support for delayed online Kerberos auth
- Significantly reduced time between connecting to the network/VPN and
- acquiring a TGT
- Added feature for automatic Kerberos ticket renewal
- Provides the kerberos ticket for long-lived processes or cron jobs
- even when the user logs out
- Added several new features to the LDAP access provider
- Support for 'shadow' access control
- Support for authorizedService access control
- Ability to mix-and-match LDAP access control features
- Added an option for a separate password-change LDAP server for those
- platforms where LDAP referrals are not supported
- Added support for manpage translations
- New upstream release 1.15.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_1.html
- New upstream release 1.12.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3
- Fix spelling errors in description (fedpkg lint)
- Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
- Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
- Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL
- Rebuild sssd against libldb 1.0.2 so the memberof module loads again.
- Related: rhbz#677425
- Log startup errors to the syslog
- Allow cache cleanup to be disabled in sssd.conf
- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
- Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
- Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
- Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
- Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
- Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
- Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)
- require the latest libldb
- Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
users
- Rebuild for libldb 1.1.3
- Rebuild due to rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
- New upstream release 1.9.0 beta 4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
- Add a new AD provider to improve integration with Active Directory 2008 R2
or later servers
- SUDO integration was completely rewritten. The new implementation works
with multiple domains and uses an improved refresh mechanism to download
only the necessary rules
- The IPA authentication provider now supports subdomains
- Fixed regression for setups that were setting default_tkt_enctypes
manually by reverting a previous workaround.
- Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
- Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
- Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
- Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior
error messages with line numbers
- bugfix release 0.3.2
- includes previous release patches
- change permissions of the /etc/sssd/sssd.conf to 0600
- Resolves: rhbz#1615460 - Rebase SSSD to the latest released version
- New upstream release 1.6.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
- Add host access control support for LDAP (similar to pam_host_attr)
- Finer-grained control on principals used with Kerberos (such as for FAST or
- validation)
- Added a new tool sss_cache to allow selective expiring of cached entries
- Added support for LDAP DEREF and ASQ controls
- Added access control features for Novell Directory Server
- FreeIPA dynamic DNS update now checks first to see if an update is needed
- Complete rewrite of the HBAC library
- New libraries: libipa_hbac and libipa_hbac-python
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Fix licenses in sources and on RPMs
- New upstream release 1.10 alpha1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0alpha1
- Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
for D-bus, resulting in a crash
- Rebuild with libldb-1.2.0
- Fix systemd conversion. Upgrades from SysV to systemd weren't properly
- enabling the systemd service.
- Fix a serious memory leak in the memberOf plugin
- Fix an issue where the user's full name would sometimes be removed
- from the cache
- Backport simplification of ccache management from 1.11.1
- Resolves: rhbz#1010553 - sssd setting KRB5CCNAME=(null) on login
- Resolves: rhbz#1382750 - Conflicting default timeout values
- Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"
- Resolves: rhbz#1175511 - sssd-libwbclient conflicts with Samba's and causes
crash in wbinfo
- in addition to the patch libwbclient.so is
filtered out of the Provides list of the package
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
- Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
- Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
- Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
- Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
- Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
- Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
- Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
- Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
- Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
- Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
- Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
- Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
- Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
- Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
- Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
- Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
- Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
- Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
- Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
- Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
- Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
- Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
- Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
- Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
- Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive
- Resolves: rhbz#1448094 - sssd-kcm cannot handle big tickets
- New upstream release 1.11 beta 2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0beta2
- Fix few segfaults
- Resolves: upstream #2811 - PAM responder crashed if user was not set
- Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step
- Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
keyring
- Also apply a patch to fix gating tests issue
- Cherry-pick patches from upstream that enable the files provider
- Enable the files domain
- Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
which is superseded by the files domain autoconfiguration
- Related: rhbz#1357418 - SSSD fast cache for local users
- Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
kdestroy caused by KCM returning a wrong error
code during the delete operation
- Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
username in getpwnam()
- Resolves: rhbz#758425 - LDAP failover not working if server refuses
connections
- Improved handling of users and groups with multi-valued name attributes
(aliases)
- Performance enhancements
Initgroups on RFC2307bis/FreeIPA
HBAC rule processing
- Improved process-hang detection and restarting
- Enabled the midpoint cache refresh by default (fewer cache misses on
commonly-used entries)
- Cleaned up the example configuration
- New tool to change debug level on the fly
- New upstream release 1.12 beta1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0beta1
- fixed items found during review
- added initscript
- Resolves: 1658813 - PKINIT with KCM does not work
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features - fix netgroups and sudo as well
- Fix building pac responder with the krb5-1.14
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization
- Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
- Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
- Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]
- release out of the official 0.3.2 tarball
- Rebuild against new libldb
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
- Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
- Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
- Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
- Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
- Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
- Resolves: RHEL-10721 - very bad performance when requesting service tickets
- Resolves: RHEL-19011 - Invalid handling groups from child domain
- Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]
- Don't discard HBAC rule processing result if SELinux is on
Resolves: rhbz#846792 (CVE-2012-3462)
- New stable upstream version 1.2.0
- Support ServiceGroups for FreeIPA v2 HBAC rules
- Fix long-standing issue with auth_provider = proxy
- Better logging for TLS issues in LDAP
- New upstream release 1.13.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.0
- New upstream release 1.14.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.2
- Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
- Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
- Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11
- Fix ipa-migration bug
- Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
migration mode
- Rebuild against new ding-libs
- Version 0.3.1
- includes previous release patches
- Remove the ability to create public ccachedir (#1015089)
- Fix bug in generation of systemd unit file
- Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
- Fixed "requires/provides" rpmdiff warning
- Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
- Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
- Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
- Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
- Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization
- Move sssd_pac to the sssd-ipa and sssd-ad subpackages
- Trim out RHEL5-specific macros since we don't build on RHEL 5
- Trim out macros for Fedora older than F18
- Update libldb requirement to 1.1.16
- Trim RPM changelog down to the last year
- New upstream release
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
- Support for the service map in NSS
- Support for setting default SELinux user context from FreeIPA
- Support for retrieving SSH user and host keys from LDAP (Experimental)
- Support for caching autofs LDAP requests (Experimental)
- Support for caching SUDO rules (Experimental)
- Fix uninitialized value bug causing crashes throughout the code
- Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup
- Add OSCP checks for p11_child
- Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
users
- Resolves: rhbz#1494002 - sssd_nss crashed in cache_req_search_domains_next
- python-sssdconfig: Fix parssing sssd.conf without config_file_version
- Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed
- Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
done here in order to unblock gating changes before rebase.
- Related: rhbz#1682305
- Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
realm join
- Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
default for AD Provider
- Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
parent directory when logging in
- New upstream stable release 1.0.0
- Switch hardcoded python3 shebangs into the %{__python3} macro
- Version 0.3.0
- Provides file based configuration and lots of improvements
- Resolves: rhbz#1369130 - nss_sss should not link against libpthread
- Resolves: rhbz#1392916 - sssd failes to start after update
- Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
on the directory /etc/sssd
- Rebuild against libldb 1.11
- Fix segfault in sssd_pam when cache_credentials was enabled
- Update the sample configuration
- Fix upgrade issues caused by data provider service removal
- Add support for python3 bindings
- Add requirement to python3 or python3 bindings
- Resolves: rhbz#1014594 - sssd: Support Python 3
- New upstream release 1.9.0 beta 5
- Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
- Many fixes for the support for setting default SELinux user context from
FreeIPA, most notably fixed the specificity evaluation
- Fixed an incorrect default in the krb5_canonicalize option of the AD
provider which was preventing password change operation
- The shadowLastChange attribute value is now correctly updated with the
number of days since the Epoch, not seconds
- Resolves: rhbz#1657980 - sssd_nss memory leak
- Also relax libldb Requires
- Remove --enable-ldb-version-check
- New upstream release 1.10.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.1
- Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
PKCS#11 URI
- New upstream release 1.9.0 beta 2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
- Add support for the Kerberos DIR cache for storing multiple TGTs
automatically
- Major performance enhancement when storing large groups in the cache
- Major performance enhancement when performing initgroups() against Active
Directory
- SSSDConfig data file default locations can now be set during configure for
easier packaging
- New upstream release 1.16.0
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_0.html
- Rebuilt for glibc bug#747377
- Rebuild for Python 3.6
- Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
- Fix release version for upgrades
- New upstream release 1.13.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Add last minute bug fixes, found in testing the package
- Resolves: rhbz#1623878 - crash related to sbus_router_destructor()
- Rebuild against new libldb
- Resolves: rhbz#1652719 - [SECURITY] sssd returns '/' for emtpy home directories
- Fix issue with IPA + SELinux in containers
- Resolves: upstream https://fedorahosted.org/sssd/ticket/3297
- Add support for libldb 1.0.0
- Try to fix build adding automake as an explicit BuildRequire
- Add also a couple of last minute patches from upstream
- Fix systemd executions/requirements
- New upstream release 1.11.4
- Remove upstreamed patch
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.4
- Small cleanup and fixes in the spec file
- BuildRequire recent libini_config to ensure consistent behaviour
- added sss_client
- New upstream release 1.13.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.3
- New upstream release 1.13 alpha
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.0alpha
- Fix potential crash with external groups in trusted IPA-AD setup
- Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
without a password. (Patch by Stephen Gallagher)
- Resolves: rhbz#1736265 - Smart Card auth of local user: endless
loop if wrong PIN was provided
- Resolves: rhbz#2149241 - [sssd] SSSD enters failed state after heavy load in the system
- Resolves: rhbz#1642372 - SSSD Python getgrouplist API was removed but required for IPA
- Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
- Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
- Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
- Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1
- Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files (additional patch)
- Ensure that SSSD builds against libldb-1.0.0 on F15 and later
- Remove .la for memberOf
- Fix CVE-2010-0014
- Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
- Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
- Resolves: rhbz#1893159 - Default debug level should report all errors / failures
- Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication
- Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently
- New upstream release 1.12.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0
- Resolves: rhbz#1718193 - p11_child should have an option to skip
C_WaitForSlotEvent if the PKCS#11 module
does not implement it properly
- Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied
- New upstream release 1.8.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
- Several fixes to case-insensitive domain functions
- Fix for GSSAPI binds when the keytab contains unrelated principals
- Fixed several segfaults
- Workarounds added for LDAP servers with unreadable RootDSE
- SSH knownhostproxy will no longer enter an infinite loop preventing login
- The provided SYSV init script now starts SSSD earlier at startup and stops
it later during shutdown
- Assorted minor fixes for issues discovered by static analysis tools
- Resolve groups from AD correctly
- Restore Requires: cyrus-sasl-gssapi as it is not auto-detected during
- rpmbuild
- Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
not FIPS140 compliant
- Fixes link error on platforms that do not do implicit linking
- Fixes double-free segfault in PAM
- Fixes double-free error in async resolver
- Fixes support for TCP-based DNS lookups in async resolver
- Fixes memory alignment issues on ARM processors
- Manpage fixes
- Resolves: upstream#3529 - sssd-kcm Fix restart during/after upgrade
- Resolves: upstream#3621 - backport bug found by static analyzers
- Fix building on rawhide. Remove -Wl,-z,defs from LDFLAGS
- Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
no members
- New upstream release 1.5.11
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
- Fix a serious regression that prevented SSSD from working with ldaps:// URIs
- IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
- address being saved to the AAAA record
- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
- Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
- Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
- Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
- Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
- Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed
- Resolves: rhbz#1628122 - Printing incorrect information about domain
with sssctl utility
- Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
fails with the KCM ccache
- New upstream release 1.16.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_1.html
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Resolves: rhbz#1673443 - sssd man pages: The default value of
"ldap_user_home_directory" is not mentioned
with AD server configuration
- New upstream release 1.9.1
- Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
- Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
- Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)
- Fix multicast checks in the SSSD
- Resolves: rhbz#1007475 - The multicast check is wrong in the sudo source
code getting the host info
- New upstream release 1.11.3
- Remove upstreamed patches
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.3
- Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
- Resolves: rhbz#1915395 - Memory leak in the simple access provider
- Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
- Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)
- Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
started due to a misconfiguration
- Release candidate for SSSD 1.1
- Add simple access provider
- Create subpackages for libcollection, libini_config, libdhash and librefarray
- Support IPv6
- Support LDAP referrals
- Fix cache issues
- Better feedback from PAM when offline
- Add workaround patch for RHBZ #1366403
- Do not write out dots in the domain-realm mapping file (#905650)
- Fix the Kerberos password expiration warning (#912223)
- Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
- Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
- Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]
- Version 0.2.0
- Add SSSDConfig API
- Update polish translation for 0.6.0
- Fix long timeout on ldap operation
- Make dp requests more robust
- New upstream release 1.12.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.2
- Fix several regressions since 1.5.x
- Ensure that the RPM creates the /var/lib/sss/mc directory
- Add support for Netscape password warning expiration control
- Rebuild against libldb 1.1.6
- Related: rhbz#1637513 - sssd crashes when refreshing expired sudo rules
- Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
the trailing colon
- Fix changelog dates to make F19 rpmbuild happy
-Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
subdomain service name being used
- Fix libwbclient alternatives
- Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
- Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
- Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
- Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
- Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
- Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
- Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
- Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
- Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
- Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
- Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
- Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
- Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
- Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
- Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
- Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
- Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
- Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate
- Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
- Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
- Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently
- New upstream release 1.5.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
- Fixes for Active Directory when not all users and groups have POSIX attributes
- Fixes for handling users and groups that have name aliases (aliases are ignored)
- Fix group memberships after initgroups in the IPA provider
- New upstream release 1.11.5
- Remove upstreamed patch
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5
- Fix regressions with ipa and SELinux
- Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
context on client is staff_u
- Do not crash on resolving a group SID in IPA server mode
- Apply a number of patches from upstream to fix issues found 1.12.3
- Resolves: rhbz#1176373 - dyndns_iface does not accept multiple
interfaces, or isn't documented to be able to
- Resolves: rhbz#988068 - getpwnam_r fails for non-existing users when sssd is
not running
- Resolves: upstream #2557 authentication failure with user from AD
- Fix tests on big-endian
- Fix previous changelog entry
- New upstream release 1.9.0 beta 3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
- Add a new PAC responder for dealing with cross-realm Kerberos trusts
- Terminate idle connections to the NSS and PAM responders
- Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
/usr/libexec/sssd/sssd_be killed by 11 crash
func _dbus_list_unlink
- Fix %postun
- New upstream release 1.8.1
- Resolve issue where we could enter an infinite loop trying to connect to an
auth server
- Fix serious issue with complex (3+ levels) nested groups
- Fix netgroup support for case-insensitivity and aliases
- Fix serious issue with lookup bundling resulting in requests never
completing
- IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
in addition to pam_authenticate
- Fix several regressions in the proxy provider
- Resolves: rhbz#743133 - Performance regression with Kerberos authentication
against AD
- Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work
- Fix a couple of segfaults that may happen on reload
- Fix OTP bug
- Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
entered separately
- Fix missing file permissions for sssd-clients
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Recreate Kerberos ccache directory if it's missing
- Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
directory /run/user/UID/ccdir does not exist
- New upstream release 1.9.3
- Resolves: rhbz#626205 - Unable to unlock screen
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
- Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization
- Initial release (based on version 0.1.0 upstream code)
- New upstream release 1.11.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.1
- New upstream release 1.12 beta2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0beta2
- libwbclient-sssd: update interface to version 0.13
- Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
1.x, this can result in time outs
- Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
searching in local cache database access on
the sock_file system_bus_socket
- Bump up release number to avoid library sub-packages version issues with
previous releases.
- Ensure that the configuration upgrade script always writes the config
file with 0600 permissions
- Eliminate an infinite loop in group enumerations
- Backport upstream patches required by FreeIPA 4.2.1
- Fix accidental disabling of the DIR cache support
- Resolves: upstream#3684 - A group is not updated if its member is removed
with the cleanup task, but the group does not
change
- Resolves: upstream#3558 - sudo: report error when two rules share cn
- Tone down shutdown messages for socket activated responders
- IPA: Qualify the externalUser sudo attribute
- Resolves: upstream#3550 - refresh_expired_interval does not work with
netgrous in 1.15
- Resolves: upstream#3402 - Support alternative sources for the files provider
- Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
- Resolves: upstream#3679 - Make nss netgroup requests more robust
- Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
configured
- Resolves: upstream#3469 - extend sss-certmap man page regarding priority
processing
- Improve docs/debug message about GC detection
- Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
list out of bound?
- Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
set.
- Document which principal does the AD provider use
- Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
defined, but contains no SIDs
- Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
- Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
Provider returned an error
[org.freedesktop.sssd.Error.DataProvider.Fatal]
- New upstream release 1.11.2
- Remove upstreamed patches
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2
- New upstream release 1.15.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.15.0
- New upstream release 1.5.9
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
- Support for overriding home directory, shell and primary GID locally
- Properly honor TTL values from SRV record lookups
- Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
- servers)
- Properly escape IPv6 addresses in the failover code
- Do not crash if inotify fails (e.g. resource exhaustion)
- Don't add multiple TGT renewal callbacks (too many log messages)
- Fix typo in Requires that prevented an upgrade (#973916)
- Use a hardcoded version in Conflicts, not less-than-current
- New upstream release 1.8.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
- Numerous manpage and translation updates
- LDAP: Handle situations where the RootDSE isn't available anonymously
- LDAP: Fix regression for users using non-standard LDAP attributes for user
information
- Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
- Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
- Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)
- Handle OTP response from FreeIPA server gracefully
- Resolves: rhbz#1283798 - sssd failover does not work on connecting to
non-responsive ldaps:// server
- Handle new error code for IPA password migration
- Resolves: rhbz#677768 - name service caches names, so id command shows
- recently deleted users
- Backport several patches from upstream.
- Fix a potential crash against old (pre-4.0) IPA servers
- Resolves: upstream#3573 - sssd won't show netgroups with blank domain
- Resolves: upstream#3660 - confdb_expand_app_domains() always fails
- Resolves: upstream#3658 - Application domain is not interpreted correctly
- Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
json_loads()
- Resolves: upstream#3386 - KCM: Payload buffer is too small
- Resolves: upstream#3666 - Fix usage of str.decode() in our tests
- A few KCM misc fixes
- New upstream release 1.13.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.1
python3-netaddr-0.7.19-8.el8.noarch.rpm | - Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- New upstream release 0.7.15
- Add separate source for tests, see https://github.com/drkjam/netaddr/issues/102
- Add patch for broken assertion, see https://github.com/drkjam/netaddr/pull/103
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- New upstream release 0.7.2
- Updated Summary and Description with new values provided by upstream
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Cleanup spec file conditionals
- Use updated python macros
- Use %license
- New upstream version, bug fixes for 0.5
- New upstream release 0.7.5
- Updated summary and description to match upstream README
- Updated URL and source to reflect upstream move to github
- Rebuild for Python 2.6
- Fix shebang mangling for python3 (RHBZ#1546800)
- Update description
- Fix netaddr shebang (bug #1394046)
- Add BuildDepends on dos2unix to clean up some upstream sources
- Add provides for python2-netaddr (RHBZ#1282129)
- Python 2 binary package renamed to python2-netaddr
See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
- New upstream release 0.7.3
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- Delete file which contains bundled pytest
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- New upstream release 0.7.11
- Enabled Python 3 support (bz1070357)
- Rebuild for Python 3.6
- Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Minor tweaks to spec file aligning with latest Fedora packaging guidelines
- Enforce python 2.4 dependency as needed by netaddr >= 0.6.2
- Drop BR on python-setuptool as it is not imported in setup.py
- Drop BR on dos2unix use sed instead
- Align description with that of delivered PKG-INFO
- Rip out python shebangs
- Add %check section to enable tests
- Thanks to Gareth Armstrong
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- New upstream bugfix release
- Do not traceback on invalid IPNetwork input (upstream issues #2, #6, #5, #8)
- Remove executable bit from documentation files to make rpmlint happy
- Upstream release 0.7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Upstream 0.7.12
- Conditionalize python3 subpackages build on Fedora
- Few spec cleanups
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- New upstream version
- New upstream release 0.7.19 (RHBZ#1413231)
- New upstream release 0.7.4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- New upstream bugfix release
- New upstream bugfix release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Initial packaging for Fedora
- New upstream release 0.7.18 (RHBZ#1259969)
- New upstream release 0.7.14
- New upstream version, bug fixes for 0.5.1
- Don't build python2 subpackage on rhel>7
https://bugzilla.redhat.com/show_bug.cgi?id=1567153
- New upstream release 0.7.17
- New upstream release 0.7.1 fixes naming conflict with 'nash' by
renaming the netaddr shell to 'netaddr'
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- New upstream version
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
python3-networkx-1.11-16.1.el8.noarch.rpm | - Build dependencies cleanup
- New upstream version
- Do not use bundled python-decorator
- Remove Requires: ipython, needed by one example only
- Clean junk files left in /tmp
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- BR python-setuptools
- Update project and source URLs
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4
- New upstream version
- Update URLs
- Add -numpy patch to fix test failure
- New upstream version
- Fix license handling
- Add patch to fix sphinx build
- Cleanup spec file conditionals
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- Fix gdal and pydot dependencies
- New upstream version
- Replace __python macros with direct python invocations.
- Disable checks for now.
- Replace a define with global.
- Conditionalize the Python 2 subpackage and don't build it on EL > 7
- New upstream version
- Drop upstreamed -test-rounding-fix patch
- Upstream no longer bundles python-decorator; drop the workaround
- New upstream version
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- Split to subpackages and support EL6 and EL7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Mass rebuild for Fedora 17
- Comply with latest python packaging guidelines (bz 1301767)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Fix python3-networkx-drawing subpackage (bz 1149980)
- Fix python(3)-geo subpackage
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Build dependencies cleanup
- New upstream version
- Add tex-preview BR for documentation
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- New upstream version
- Build for both python2 and python3
- Drop BuildRoot, clean script, and clean at start of install script
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Bump version to 1.0.1.
- License changed LGPLv2+ -> BSD.
- Rebuild for Python 3.6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- License is really LGPLv2+.
- Include license as documentation.
- Add a check section to run tests.
- New upstream version
- Drop defattr
- Build documentation
- Switch hardcoded python3 shebangs into the %{__python3} macro
- Don't build the geo subpackage
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Note bundled jquery
- Change pydot dependencies to pydotplus (bz 1326957)
- New upstream version
- Drop upstreamed -numpy patch
- Fix gdal requires block
- Initial package.
python3-networkx-core-1.11-16.1.el8.noarch.rpm | - Build dependencies cleanup
- New upstream version
- Do not use bundled python-decorator
- Remove Requires: ipython, needed by one example only
- Clean junk files left in /tmp
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- BR python-setuptools
- Update project and source URLs
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4
- New upstream version
- Update URLs
- Add -numpy patch to fix test failure
- New upstream version
- Fix license handling
- Add patch to fix sphinx build
- Cleanup spec file conditionals
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- Fix gdal and pydot dependencies
- New upstream version
- Replace __python macros with direct python invocations.
- Disable checks for now.
- Replace a define with global.
- Conditionalize the Python 2 subpackage and don't build it on EL > 7
- New upstream version
- Drop upstreamed -test-rounding-fix patch
- Upstream no longer bundles python-decorator; drop the workaround
- New upstream version
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- Split to subpackages and support EL6 and EL7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Mass rebuild for Fedora 17
- Comply with latest python packaging guidelines (bz 1301767)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Fix python3-networkx-drawing subpackage (bz 1149980)
- Fix python(3)-geo subpackage
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Build dependencies cleanup
- New upstream version
- Add tex-preview BR for documentation
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- New upstream version
- Build for both python2 and python3
- Drop BuildRoot, clean script, and clean at start of install script
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Bump version to 1.0.1.
- License changed LGPLv2+ -> BSD.
- Rebuild for Python 3.6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- License is really LGPLv2+.
- Include license as documentation.
- Add a check section to run tests.
- New upstream version
- Drop defattr
- Build documentation
- Switch hardcoded python3 shebangs into the %{__python3} macro
- Don't build the geo subpackage
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Note bundled jquery
- Change pydot dependencies to pydotplus (bz 1326957)
- New upstream version
- Drop upstreamed -numpy patch
- Fix gdal requires block
- Initial package.
python3-numpy-1.14.3-10.el8.x86_64.rpm | - 1.14.0 rc1
- Update to 1.8.0 final
- fix segfault within %check on 2.7 (patch 2)
- Per discussion w/Jose Matos, Obsolete/Provide f2py, as the
stand-alone one is no longer supported/maintained upstream
- Update to 1.8.0rc2
- Create clean site.cfg
- Use serial atlas
- Linking /usr/include/numpy to .h files, BZ 185079.
- Add alternatives for the f2py exacutable
- Resolves: rhbz#1633548
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Moved distutils back to the main package, BZ 572820.
- update to 1.5.1rc1
- add python3 subpackage
- some spec-cleanups
- Rebuild for Python 3.4
- Fix obsoletes / provides for numpy -> python2-numpy rename
- Update to 1.10.2, BZ 1291674.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- EVR bump for pygame chainbuild.
- Rebuild for Fedora Extras 5
- Fix CVE-2014-1858, CVE-2014-1859: #1062009, #1062359
- New upstream release
- 1.14.2
- Update to 1.10.1, BZ 1271022.
- Require python-devel, BZ 488464.
- Add ARM support
- Fix __pycache__ ownership (bug #1072467)
- New upstream release
- 1.13.0 rc1
- Fixing FTBFS on ppc64le (#1078354)
- Fix rpmlint warnings
- Update License
- Apply patch: change shebang of f2py to use binary directly
- New upstream release
- Update to 1.11.1rc1, BZ 1340440.
- Bump Release. 1b2 is higher than 0b3
- New upstream release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Add provides to satisfy numpy%{_isa} requires in other packages
- Rebuild with fixed gating.yaml
related: #1687873
- Update to 1.11.0rc2
- Specfile cleanup (bug #969854)
- ignore the "Ticket #1299 second test" failure on s390(x)
- Update to 1.11.0 final
- Update to latest upstream.
- Fixed Source0 URL.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Update to 1.11.2 final
- Add upstream patch to fix xerbla linkage (bug #1172834)
- fix the AttributeError during tests
- fix build on s390(x)
- Rebuild for Python 2.6
- Drop BR: atlas-devel, since it just provides binary-compat
blas and lapack libs. Atlas can still be optionally used
at runtime. (Note: this is all per the atlas maintainer).
- Update to 1.5.1 final
- Update to 1.6.2rc1
- Upstream update
- Update to 1.6.0 final
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Add python egg to %files on f9+
- New upstream release
- Update to 1.11.1 final
- URL Fix, BZ 1001337
- Update to 1.6.2 final
- Fixed atlas BR, BZ 505376.
- Add patch from github pull 371 to fix python 3.3 pickle issue
- Remove cython .c source regeneration - fails now
- rework patches for 3.3 to more directly reflect upstream's commits
- re-enable test suite on python 3
- forcibly regenerate Cython .c source to avoid import issues on Python 3.3
- Update to 1.7.0rc1
- Re-enabling atlas BR, dropping lapack Requires.
- rebuild for atlas 3.10
- Add python2-numpy provides (bug #1249423)
- Spec cleanup
- Fix up cpuinfo bug (#229753). Upstream bug/change:
http://projects.scipy.org/scipy/scipy/ticket/349
- 1.13.0 rc2
- Update to 1.8.0b2
- add workaround for rhbz#849713 (fixes FTBFS)
- 1.14.3
- Split out f2py into subpackage, thanks Peter Robinson pbrobinson@gmail.com.
- actually add the patch this time
- New upstream release, added python-nose BR. BZ 465999.
- Using atlas blas, not blas-devel. BZ 461472.
- Fix ambiguous Python 2 dependency declarations
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- remove rhel logic from with_python3 conditional
- New upstream release
- Update to 1.11.2rc1, BZ 1340440.
- Fix libdir path in site.cfg, BZ 1006242.
- 1.14.1
- New upstream release
- 1.13.3
- Update to 1.9.1, BZ 1160273.
- Update to 1.10.0 final.
- Fix CVE-2019-6446
resolves: #1668466
- Update to 1.7.0b2
- Drop patches applied upstream
- Update gfortran patch to recognize latest gfortran f95 support
- Resolves rhbz#236444
- Initial RPM release
- Added gfortran patch from Neal Becker
- Rebuild for Python 3.6
- set proper environment variables for openblas
- Make f2py script name generation work with platform-python
related: #1580828
- Adjusted the postun scriptlets to enable upgrading to RHEL 9
- Resolves: rhbz#1933055
- 1.13.2
- 1.13.0 final
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Update to 1.6.0b1
- Build python3 module with python3
- Add patch from upstream to fix build time import error
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Update to 1.8.0b1
- Drop f2py patch applied upstream
- Update to 1.7.0 final
- Update to 1.8.1
- Update to latest upstream.
- rebuild for https://fedoraproject.org/wiki/Features/Python_3.3
- needs unicode patch
- 1.13.1 final
- source commit fix
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update to 1.2.1.
- Rebuilt for Python3.5 rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- 1.12.1
- Cleanup spec file conditionals
- Update to 1.11.0b2, BZ 1303387.
- New upstream release. Include backported doublefree patch
- Update to 1.9.0rc1
- Update to 1.7.1
- Update to 1.7.0b1
- Rebase python 3.3 patchs to current git master
- Drop patches applied upstream
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Update to 1.10.2rc1
- Drop opt-flags patch applied upstream
- Update to 1.6.1
- Update site.cfg for new atlas library names
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Move f2py documentation to f2py package (bug #1027394)
- Ship doc module (bug #1034357)
- Re-add provides f2py
- Update to 1.9.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Update to 1.11.0b2, BZ 1306249.
- Fix broken float128 on all arches except x86_64
resolves: #1687873
- Switch runtime dependency of the python3-numpy-f2py package from
python3-devel (that's now buildroot-only) to python3-libs-devel
Resolves: rhbz#1610863
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to 1.12.0, build with gcc 7.0.
- Update to 1.6.0b2
- Drop import patch fixed upstream
- Bump and rebuild for BZ 712251.
- Update to 1.10.4, BZ 1296509.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Update to 1.10.2rc1, BZ 1289550.
- Use openblas where available, BZ 1472318.
- Remove fortran flags or arm would build with -march=x86-64
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- New upstream release
- Upstream update
- Add [atlas] to site.cfg for new atlas library names
- Temporarily dropping atlas BR to work around 562577.
- New upstream release
- Update to 1.10.0b1, BZ 1252641.
- Since the previous didn't work, Requiring lapack.
- Provide python2-* packages
- Run tests with verbose=2
- Reverted to 1.3.0 after upstream pulled 1.4.0, BZ 579065.
- Split out doc subpackage.
- Moved linalg, fft back to main package.
- rebuild for newer python3
- Update to git snapshot (due to build issue) after 1.11.0b1, BZ 1301943.
- Build only python3 subpackages
- Use proper upstream release tarball
resolves: #1594350
- Update to 1.8.2
- Update to 1.9.0
- Remove f2py3 executable (only f2py3.6 should be provided)
- 1.4.0.
- Dropped ARM patch, ARM support added upstream.
- Rebuild for python 2.5
python3-numpy-f2py-1.14.3-10.el8.x86_64.rpm | - 1.14.0 rc1
- Update to 1.8.0 final
- fix segfault within %check on 2.7 (patch 2)
- Per discussion w/Jose Matos, Obsolete/Provide f2py, as the
stand-alone one is no longer supported/maintained upstream
- Update to 1.8.0rc2
- Create clean site.cfg
- Use serial atlas
- Linking /usr/include/numpy to .h files, BZ 185079.
- Add alternatives for the f2py exacutable
- Resolves: rhbz#1633548
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Moved distutils back to the main package, BZ 572820.
- update to 1.5.1rc1
- add python3 subpackage
- some spec-cleanups
- Rebuild for Python 3.4
- Fix obsoletes / provides for numpy -> python2-numpy rename
- Update to 1.10.2, BZ 1291674.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- EVR bump for pygame chainbuild.
- Rebuild for Fedora Extras 5
- Fix CVE-2014-1858, CVE-2014-1859: #1062009, #1062359
- New upstream release
- 1.14.2
- Update to 1.10.1, BZ 1271022.
- Require python-devel, BZ 488464.
- Add ARM support
- Fix __pycache__ ownership (bug #1072467)
- New upstream release
- 1.13.0 rc1
- Fixing FTBFS on ppc64le (#1078354)
- Fix rpmlint warnings
- Update License
- Apply patch: change shebang of f2py to use binary directly
- New upstream release
- Update to 1.11.1rc1, BZ 1340440.
- Bump Release. 1b2 is higher than 0b3
- New upstream release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Add provides to satisfy numpy%{_isa} requires in other packages
- Rebuild with fixed gating.yaml
related: #1687873
- Update to 1.11.0rc2
- Specfile cleanup (bug #969854)
- ignore the "Ticket #1299 second test" failure on s390(x)
- Update to 1.11.0 final
- Update to latest upstream.
- Fixed Source0 URL.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Update to 1.11.2 final
- Add upstream patch to fix xerbla linkage (bug #1172834)
- fix the AttributeError during tests
- fix build on s390(x)
- Rebuild for Python 2.6
- Drop BR: atlas-devel, since it just provides binary-compat
blas and lapack libs. Atlas can still be optionally used
at runtime. (Note: this is all per the atlas maintainer).
- Update to 1.5.1 final
- Update to 1.6.2rc1
- Upstream update
- Update to 1.6.0 final
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Add python egg to %files on f9+
- New upstream release
- Update to 1.11.1 final
- URL Fix, BZ 1001337
- Update to 1.6.2 final
- Fixed atlas BR, BZ 505376.
- Add patch from github pull 371 to fix python 3.3 pickle issue
- Remove cython .c source regeneration - fails now
- rework patches for 3.3 to more directly reflect upstream's commits
- re-enable test suite on python 3
- forcibly regenerate Cython .c source to avoid import issues on Python 3.3
- Update to 1.7.0rc1
- Re-enabling atlas BR, dropping lapack Requires.
- rebuild for atlas 3.10
- Add python2-numpy provides (bug #1249423)
- Spec cleanup
- Fix up cpuinfo bug (#229753). Upstream bug/change:
http://projects.scipy.org/scipy/scipy/ticket/349
- 1.13.0 rc2
- Update to 1.8.0b2
- add workaround for rhbz#849713 (fixes FTBFS)
- 1.14.3
- Split out f2py into subpackage, thanks Peter Robinson pbrobinson@gmail.com.
- actually add the patch this time
- New upstream release, added python-nose BR. BZ 465999.
- Using atlas blas, not blas-devel. BZ 461472.
- Fix ambiguous Python 2 dependency declarations
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- remove rhel logic from with_python3 conditional
- New upstream release
- Update to 1.11.2rc1, BZ 1340440.
- Fix libdir path in site.cfg, BZ 1006242.
- 1.14.1
- New upstream release
- 1.13.3
- Update to 1.9.1, BZ 1160273.
- Update to 1.10.0 final.
- Fix CVE-2019-6446
resolves: #1668466
- Update to 1.7.0b2
- Drop patches applied upstream
- Update gfortran patch to recognize latest gfortran f95 support
- Resolves rhbz#236444
- Initial RPM release
- Added gfortran patch from Neal Becker
- Rebuild for Python 3.6
- set proper environment variables for openblas
- Make f2py script name generation work with platform-python
related: #1580828
- Adjusted the postun scriptlets to enable upgrading to RHEL 9
- Resolves: rhbz#1933055
- 1.13.2
- 1.13.0 final
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Update to 1.6.0b1
- Build python3 module with python3
- Add patch from upstream to fix build time import error
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Update to 1.8.0b1
- Drop f2py patch applied upstream
- Update to 1.7.0 final
- Update to 1.8.1
- Update to latest upstream.
- rebuild for https://fedoraproject.org/wiki/Features/Python_3.3
- needs unicode patch
- 1.13.1 final
- source commit fix
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update to 1.2.1.
- Rebuilt for Python3.5 rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- 1.12.1
- Cleanup spec file conditionals
- Update to 1.11.0b2, BZ 1303387.
- New upstream release. Include backported doublefree patch
- Update to 1.9.0rc1
- Update to 1.7.1
- Update to 1.7.0b1
- Rebase python 3.3 patchs to current git master
- Drop patches applied upstream
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Update to 1.10.2rc1
- Drop opt-flags patch applied upstream
- Update to 1.6.1
- Update site.cfg for new atlas library names
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Move f2py documentation to f2py package (bug #1027394)
- Ship doc module (bug #1034357)
- Re-add provides f2py
- Update to 1.9.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Update to 1.11.0b2, BZ 1306249.
- Fix broken float128 on all arches except x86_64
resolves: #1687873
- Switch runtime dependency of the python3-numpy-f2py package from
python3-devel (that's now buildroot-only) to python3-libs-devel
Resolves: rhbz#1610863
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to 1.12.0, build with gcc 7.0.
- Update to 1.6.0b2
- Drop import patch fixed upstream
- Bump and rebuild for BZ 712251.
- Update to 1.10.4, BZ 1296509.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Update to 1.10.2rc1, BZ 1289550.
- Use openblas where available, BZ 1472318.
- Remove fortran flags or arm would build with -march=x86-64
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- New upstream release
- Upstream update
- Add [atlas] to site.cfg for new atlas library names
- Temporarily dropping atlas BR to work around 562577.
- New upstream release
- Update to 1.10.0b1, BZ 1252641.
- Since the previous didn't work, Requiring lapack.
- Provide python2-* packages
- Run tests with verbose=2
- Reverted to 1.3.0 after upstream pulled 1.4.0, BZ 579065.
- Split out doc subpackage.
- Moved linalg, fft back to main package.
- rebuild for newer python3
- Update to git snapshot (due to build issue) after 1.11.0b1, BZ 1301943.
- Build only python3 subpackages
- Use proper upstream release tarball
resolves: #1594350
- Update to 1.8.2
- Update to 1.9.0
- Remove f2py3 executable (only f2py3.6 should be provided)
- 1.4.0.
- Dropped ARM patch, ARM support added upstream.
- Rebuild for python 2.5
python3-pyasn1-modules-0.3.7-6.el8.noarch.rpm | - update to upstream release 0.1.6
- update modules to 0.0.4
- update description
- add python3-pyasn1 subpackage
- add versioned Requires for the module subpackages
- add %check section
- Update to new upstream release 0.1.9, modules 0.0.8.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for Python3.5 rebuild
- Rebuilt for Python 3.7
- Update to upstream release 0.2.3 (#1426979)
- Adapt to the way upstream changed the way tests are executed
- Pass PYTHONPATH when building the documentation
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Update rpm to be more fedora friendly
- New release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+ Revision: 31989
- fixed (build)requires
- Import pyasn1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Update to upstream version 0.0.12a
- Rebuild for Python 2.6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Update to upstream release 0.3.4 (#1485669)
- Update modules to 0.1.2
- Patch to fixed crash at SequenceOf native decoder
- Fix python2 provides for pyasn1 modules (#1295693)
- Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4
- update to upstream release 0.1.7
- update modules to 0.0.5
- Update to new upstream release 0.1.8, modules 0.0.6.
- Add in missing colon after Provides
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Explicitly provide python2 subpackages, use python_provide macro
- Move LICENSE to the license tag instead of doc.
- Update to upstream release 0.3.7 (#1492446)
- Update modules to 0.1.5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Update to upstream release 0.3.2 (#1475594)
- Update modules to 0.0.11
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Rebuild for Python 3.6
- New upstream version
- Use Python 3 Sphinx if with Python 3
- Cleanup
- Remove the python2 subpackage
- Use setuptools to install the package
- simplify the files included in the rpm so it includes the .egg-info
- Update to upstream release 0.2.1 (#1419310)
- Added doc subpackage and moved documentation there
- Update to upstream version 0.0.9a
- Include patch that adds parsing for the Any type
- If python_provide wasn't defined then the python2 subpackages
didn't provide python-pyasn1-*
- Cleanup spec file conditionals
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rename to python-pyasn1
- Spec file cleanups
- Update to upstream version 0.0.8a
- Include doc/notes.html in the package
python3-pyqt5-sip-4.19.25-1.el8.x86_64.rpm | - 4.19.25 + sync with Fedora
Resolves: bz#2071606
python3-pyusb-1.0.0-9.1.module+el8.9.0+1372+09f67869.noarch.rpm | - 1.0.0-a1 (bug #586950).
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Python 2 binary package renamed to python2-pyusb
See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Rebuild for Python 3.6
- Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Fix end-of-line in README
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Latest upstream.
- Add python3 support, spec cleanup, BZ 1022851.
- Fixed changelog.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- 1.0.0-a2.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Cleanup packaging and fix archful provide in noarch package
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuild for Python 2.6
- Initial packaging
- Latest upstream.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Rebuilt to fix the NVR issue (#2094880)
- Conditionalize the python2 subpackage
- Latest upstream, BZ 1192561.
- Latest upstream, BZ 1192561.
python3-qrcode-core-5.3-1.module+el8.10.0+1916+6bb8cf6b.noarch.rpm | - Resolves: RHEL-15090 Generation of image file fails with Python 3
- Conditionalize the python2 subpackage
- Update to 5.0.1
- Initial package
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Update to 5.1
- Introduce python3 subpackages (#1237118)
- Moved LICENSE from %doc to %license
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Python 2 binary package renamed to python2-qrcode
See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Clean up spec, removing unnecessary declarations
- Rename tool in %{_bindir} to the less ambiguous qrcode
- Also rename python-qrcode-core to python2-qrcode-core
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1654457, rhbz#1654458
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Create -core subpackage for minimal dependencies
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuild for Python 3.6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Make python-qrcode-core conflicts with python-qrcode < 5.0
python3-qt5-5.15.0-3.el8.x86_64.rpm | - 5.4
- 5.5
- python3: (Build)Requires: python3-dbus
- Rebuild (binutils)
Resolves: bz#1949066
- New base sub package to provide QtBase only (RHBZ#1394626)
- New requirement from the main package to the base sub package
- BR: python2-devel, use %__python2 macro
- Rebuild with binutils fix for ppc64le (#1475636)
- fix python3-qt5-webkit name
- 5.13.1
Resolves: bz#1775603
- -rpm-macros: Conflicts: python(3)-qt5 < 5.6
- rebuild (qt5)
- %description: mention PyQt5
- Provides: PyQt5
- fixed bz#1348507 - Arbitrary code execution due to insecure loading
of Python module from CWD
- 5.9.1
- rebuild (sip)
- restore qtwebengine support
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Enabled QtWebEngine for Fedora >= 24
- fix python3-qt5-webengine name
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- Rebuild (Qt 5.15.3)
Resolves: bz#2061729
- Update to 5.10.1 andd rop dependency on qt5-qtwebkit and qt5-qtwebengine
- rebuild (qt5)
- rebuild (f21-python)
- +Qt5Positioning,Qt5Sensors support
- rebuild (sip)
- rebuild (sip), re-enable -webengine for secondary archs
- 5.5.1
- enable qtenginio, fix pyuic5 wrapper, use %license
- rebuild (qt5)
- 5.4.2
- python3-qt5-devel subpkg
- PyQt-gpl-5.3.1
- PyQt5-5.7.1
- PyQt-5.2.1
- PyQt5-5.8.2
- rebuild (qt5)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- -devel: restore dep on base pkg
- PyQt5-5.10
- move -devel binaries to main pkg(s) (#1422613)
- add missing -webengine/-webkit descriptions
- better python3-qt5-devel description
- try to determine dbus-python install paths dynamically (#1161121)
- Rebuild for Python 3.6
- restore python3 support
- explicitly support Qt5 newer than just 5.9.3 (+5.9.4,5.10.0,5.10.1)
- fix pyrcc5 wrapper typo
- PyQt-5.2
- rebuild (sip)
- rebuild (qt5)
- Cleanup spec file conditionals
- python3-qt5: omit sip files inadvertantly added in 5.7.1-5
- Add patch to fix python3 sip installation dir (#1228432)
- BR: sip + sync with Fedora
- PyQt5-5.7
- (temp) disable -webengine support
- rebuild against new qt5-qtbase-5.7.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- PyQt-gpl-5.3.2
- rebuild (sip)
- python3-qt5 support
- Drop dependency on qt5-qtenginio
- -webengine,-webkit subpkgs
- Rebuild against fixed qt5-qtbase to fix -debuginfo (#1065636)
- rebuild (qt5)
- add Obsoletes for misnamed -webengine/-webkit pkgs (#1315025)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- PyQt5-5.11 + sync with Fedora
- Drop dependency on phonon and python2 support
- enable -webengine on f25+
- pkgconfig(QtOpenGL) being satisfied by qt4 devel (#1162415)
- drop ppc ppc64 ppc64le, it's not supported yet
- python-qt5 is not built with $RPM_OPT_FLAGS (#1314998)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- explicitly set CFLAGS,CXXFLAGS,LFLAGS
- +macros.pyqt5
- limit -webengine support to just primary archs (for now)
- rebuild (qt5)
- PyQt5-5.6
- 5.9.2
- rebuild
- 5.15.0
Resolves: bz#1949066
- rebuild (sip)
- Build failure in sipQtWebKitWidgestQWebInspector: qprinter.h not found (#1160932)
- python2_sitelib should be python2_sitearch (#1161121)
- 5.4.1
- restore -webengine
- fixed bz#1348507, pyqt5 with python2 in isolated mode
- Rebuild again for Python 3.6
- PyQt5-5.8.1
- PyQt5-5.8
- -rpm-macros subpkg
- add wrappers for pyrcc5,pylupdate5 (#141116,#1415812)
- update provides filtering
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- rebuild (qt5)
- use safer subdir builds
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- BR: qt5-qtbase-private-devel
- python3-qt5: add versioned qt5 dep (like base python-qt5 pkg has)
- (temporarily) omit webengine support on fc26
- rebuild (qt5-qtenginio)
- rebuild (qt5-qtbase), disable -webengine (temp on f25, until fixed)
- License: GPLv3 (#1520186)
- rebuild (qt5)
- 5.11.2 + sync with Fedora
- wrong python release used in pyuic5 launch script (#1193107)
- -doc: add qsci doc QyQt5.api content
- enable Qt5WebChannel/Qt5WebSockets support
- ensure .so modules are executable (for proper -debuginfo extraction)
- -webengine: add ExclusiveArch (matching qt5-qtwebengine's)
- PyQt5-5.9
- Rebuilt for GCC 5 C++11 ABI change
- rebuild (qt5), Provides: python2-qt5
- PyQt-gpl-5.3
- +Qt5Bluetooth,Qt5Quick,Qt5SerialPorts support
python3-qt5-base-5.15.0-3.el8.x86_64.rpm | - 5.4
- 5.5
- python3: (Build)Requires: python3-dbus
- Rebuild (binutils)
Resolves: bz#1949066
- New base sub package to provide QtBase only (RHBZ#1394626)
- New requirement from the main package to the base sub package
- BR: python2-devel, use %__python2 macro
- Rebuild with binutils fix for ppc64le (#1475636)
- fix python3-qt5-webkit name
- 5.13.1
Resolves: bz#1775603
- -rpm-macros: Conflicts: python(3)-qt5 < 5.6
- rebuild (qt5)
- %description: mention PyQt5
- Provides: PyQt5
- fixed bz#1348507 - Arbitrary code execution due to insecure loading
of Python module from CWD
- 5.9.1
- rebuild (sip)
- restore qtwebengine support
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Enabled QtWebEngine for Fedora >= 24
- fix python3-qt5-webengine name
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- Rebuild (Qt 5.15.3)
Resolves: bz#2061729
- Update to 5.10.1 andd rop dependency on qt5-qtwebkit and qt5-qtwebengine
- rebuild (qt5)
- rebuild (f21-python)
- +Qt5Positioning,Qt5Sensors support
- rebuild (sip)
- rebuild (sip), re-enable -webengine for secondary archs
- 5.5.1
- enable qtenginio, fix pyuic5 wrapper, use %license
- rebuild (qt5)
- 5.4.2
- python3-qt5-devel subpkg
- PyQt-gpl-5.3.1
- PyQt5-5.7.1
- PyQt-5.2.1
- PyQt5-5.8.2
- rebuild (qt5)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- -devel: restore dep on base pkg
- PyQt5-5.10
- move -devel binaries to main pkg(s) (#1422613)
- add missing -webengine/-webkit descriptions
- better python3-qt5-devel description
- try to determine dbus-python install paths dynamically (#1161121)
- Rebuild for Python 3.6
- restore python3 support
- explicitly support Qt5 newer than just 5.9.3 (+5.9.4,5.10.0,5.10.1)
- fix pyrcc5 wrapper typo
- PyQt-5.2
- rebuild (sip)
- rebuild (qt5)
- Cleanup spec file conditionals
- python3-qt5: omit sip files inadvertantly added in 5.7.1-5
- Add patch to fix python3 sip installation dir (#1228432)
- BR: sip + sync with Fedora
- PyQt5-5.7
- (temp) disable -webengine support
- rebuild against new qt5-qtbase-5.7.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- PyQt-gpl-5.3.2
- rebuild (sip)
- python3-qt5 support
- Drop dependency on qt5-qtenginio
- -webengine,-webkit subpkgs
- Rebuild against fixed qt5-qtbase to fix -debuginfo (#1065636)
- rebuild (qt5)
- add Obsoletes for misnamed -webengine/-webkit pkgs (#1315025)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- PyQt5-5.11 + sync with Fedora
- Drop dependency on phonon and python2 support
- enable -webengine on f25+
- pkgconfig(QtOpenGL) being satisfied by qt4 devel (#1162415)
- drop ppc ppc64 ppc64le, it's not supported yet
- python-qt5 is not built with $RPM_OPT_FLAGS (#1314998)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- explicitly set CFLAGS,CXXFLAGS,LFLAGS
- +macros.pyqt5
- limit -webengine support to just primary archs (for now)
- rebuild (qt5)
- PyQt5-5.6
- 5.9.2
- rebuild
- 5.15.0
Resolves: bz#1949066
- rebuild (sip)
- Build failure in sipQtWebKitWidgestQWebInspector: qprinter.h not found (#1160932)
- python2_sitelib should be python2_sitearch (#1161121)
- 5.4.1
- restore -webengine
- fixed bz#1348507, pyqt5 with python2 in isolated mode
- Rebuild again for Python 3.6
- PyQt5-5.8.1
- PyQt5-5.8
- -rpm-macros subpkg
- add wrappers for pyrcc5,pylupdate5 (#141116,#1415812)
- update provides filtering
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- rebuild (qt5)
- use safer subdir builds
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- BR: qt5-qtbase-private-devel
- python3-qt5: add versioned qt5 dep (like base python-qt5 pkg has)
- (temporarily) omit webengine support on fc26
- rebuild (qt5-qtenginio)
- rebuild (qt5-qtbase), disable -webengine (temp on f25, until fixed)
- License: GPLv3 (#1520186)
- rebuild (qt5)
- 5.11.2 + sync with Fedora
- wrong python release used in pyuic5 launch script (#1193107)
- -doc: add qsci doc QyQt5.api content
- enable Qt5WebChannel/Qt5WebSockets support
- ensure .so modules are executable (for proper -debuginfo extraction)
- -webengine: add ExclusiveArch (matching qt5-qtwebengine's)
- PyQt5-5.9
- Rebuilt for GCC 5 C++11 ABI change
- rebuild (qt5), Provides: python2-qt5
- PyQt-gpl-5.3
- +Qt5Bluetooth,Qt5Quick,Qt5SerialPorts support
python3-rpm-generators-5-8.el8.noarch.rpm | - Enabled gating
- Related: rhbz#1776941
- Add patch 9: Generate requires and provides for platform-python(abi)
(https://fedoraproject.org/wiki/Changes/Platform_Python_Stack)
- Switch bootsrapping macro to a bcond for modularity
- Add patch 10: Do not provide pythonXdist for platform-python packages (rhbz#1484607)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Fix the pythondeps.sh and pythondistdeps.py scripts for multiple digits python versions
- Resolves: rhbz#2143990
- Do not parse nested dist/egg-info metadata
- Resolves: rhbz#1916172
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650544
- Create major-version provides only on major Python versions (2.7, 3.6)
- Fix an extra parenthesis in python.attr
- Resolves: rhbz#1776941
- Use nonstandardlib for purelib definition (#1609492)
- Rebase to rpm 4.14.0 final (http://rpm.org/wiki/Releases/4.14.0)
- Re-synchronize version/release macros with the rpm Fedora package
- Splitting Python RPM generators from the `rpm` package to standalone one
- Added a license file
- Added a dependency on rpm for the proper directory structure
- Properly owning the __pycache__ directory
- Update to a new upstream version of RPM
- Drop upstreamed patches
- Renumber remaining patches
- Switch the pythondistdeps.py script to /usr/libexec/platform-python
- Fork upstream generators
- "Fix" support of environment markers
python3-scipy-1.0.0-21.module+el8.10.0+1910+234ad790.x86_64.rpm | - Bump for rebuild against python 2.5 in devel tree
- Autorebuild for GCC 4.3
- Fix rpmlint warnings
- License update
- Add patch to use build_dir argument in build_extension
- rebuilt for GCC 8.x (gfortran soname bump)
- Fix BuildRoot
- Add BuildRequires, Requires
- Test remove d1mach patch
- Fix defattr
- Add changelog
- Removed Prefix, Vendor
- Fix Source0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Bump for rebuild against numpy 1.3
- update to new upstream source
- update Summary, License, Url, and description
- added extra dependencies
- remove symlink since Lib has been renamed scipy
- Add BuildRequires gcc-gfortran
- Disable tests on s390x
- Disable python3 tests for now
- Add BuildRequires numpy
- Updated spec for FE Packaging Guidelines and for upstream version 0.5.1
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Add bconds for python2
- Resolves: rhbz#1615727
- Different BR for python36 module build
- Resolves: rhbz#1615727
- fix source URL
- Build with $RPM_LD_FLAGS
- Related: rhbz#1624172
- Update to 0.11.0 final
- Update to 0.13.2
- Rebuild for atlas-3.8.2
- Switch Python 3 conditionals to bcond
- Update to 0.13.3
- Update to 0.10.0
- rebuild (suitesparse)
- Use openblas where available https://fedoraproject.org/wiki/Changes/OpenBLAS_as_default_BLAS
- Remove ppc64 hackery for OpenBLAS
- Don't run tests in parallel as pytest crashes
- Don't run test_denormals as it tends to stuck
- use python2 macros everywhere (Requested by Han Boetes)
- Patch for stsci image function syntax fix.
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Update to 0.13.0 final
- Update for new upstream release
- New upstream release
- Unbundle six
- Resolves: rhbz#1647341
- Do not create -PYTEST.pyc files
- Resolves: rhbz#1934199
- Unbundle python-six (bug #1005350)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Update to 0.13.0rc1
- Bump for rebuild against numpy 1.4.0
- Update to 0.10.1
- Disabled docs building due to missing BuildRequires: python2/3-numpydoc
- Disabled BuildRequires on pytest-xdist since it's not available in RHEL8
right now and doesn't seem to be actually needed for the build
- Fix licensing to match Fedora packaging guidance
- Remove unnecessary library deps
- Rebuild for Python 2.6
- Update to 0.12.0b1
- Drop upstreamed linalg patch
- Update to 0.7.1.
- Update to latest beta which lists python 2.6 support
- fix the stsci fix
- Update to new upstream source
- Update to 0.16.0
- Use python_provide macro
- new version
- Minor adjustments to specfile for packaging guidelines.
- Changed buildrequires fftw version 3 from fftw2
- Force preprocessing of Fortran sources to make annobin record proper flags
- Resolves: rhbz#1624172
- Update to 0.13.1
- Rebuild for Python 3.6
- Use openblas where available (except ppc64), to use same as numpy (BZ 1472318)
- Add patch to fix segfaul in test of sgeqrf
- minor correction for f77 usage
- Add requires python3-numpy, python3-f2py for python3-scipy (bug 863755)
- Revert "Discard results of testsuite on %{arm} for now"
- Update to 0.14
- Do not use system python-six (bug #1046817)
- Update to 0.12.0 final
- No longer remove weave from python3 build
- Update to 0.14.1
- Add f2py requires to prepared for numpy packaging split
- Add BuildRequires gcc-c++
- Add python-devel
- Add libstdc++
- add python3 subpackage
- Add provides to satisfy scipy%{_isa} requires in other packages
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- fix licensing tag and bump for buildid rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuild for libgfortran.so.3
- Update to 0.16.1
- Update to 0.17.0
- Drop ctypes patch applied upstream
- 0.18.0
- %check: make non-fatal as temporary workaround for scipy build on arm
- Update to final 0.7 release
- Discard results of testsuite on %{arm} for now
Segfaults on non-aligned memory test (expected for arm)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- New subpackages with HTML documentation
- Fix scipy build on python-2.7
- remove arch specific optimizations
- go back to using gfortran now that numpy is patched
- Bumping due to problems with modular RPM upgrade path
- Resolves: rhbz#1695587
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Fix f2py requires
- Resolves: rhbz#1628242
- Update to 0.15.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Rebuild for rpm bug 1131892
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Fix unversioned requires/buildrequires
- Resolves: rhbz#1628242
- new version
- rebuilt with atlas 3.10
- include missing setup files for stsci module
- Update to 0.13.0b1
- Drop patches applied upstream
- Fixup changelog and summary
- update to 1.0.0 and use pytest instead of nose
- use timeout during parallel %check
- little cosmetic changes
- filter provides in python_sitearch
- Rebuild due to bug in RPM (RHBZ #1468476)
- Removed test dependency python2/3-pytest-timeout, since it's not strictly needed and it's not available in RHEL8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Update to 0.11.0rc2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Update to 0.9.0
- Drop all stsci sources and patches, dropped from upstream
- Drop gcc and py27 patches fixed upstream
- Add %check section to run tests
- Rebuild with Python 3.4
- Remove old ufsparse references, use suitesparse
- Spec cleanup
- Add patch to fix ctypes test
- Move requires to correct python2 subpackage
- Add FFLAGS also in %install
- Remove unversioned provides
- Resolves: rhbz#1628242
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Rebuild for python 3.3
- Link with -lm to build with new stricter Fedora flags
https://bugzilla.redhat.com/show_bug.cgi?id=1541416
- fix for egg-info file creation
- Fix python{2,3}-six Requires
- Resolves: rhbz#1709599
- revert to f77 due to issue with numpy in development
- include_dirs changes for ufsparse change in development
- remove rhel logic from with_python3 conditional
- Add patch from upstream to fix python3.3 issues in linalg routines
- Fix for gcc34 weave blitz bug #505379
python3-sss-2.9.4-5.el8_10.2.x86_64.rpm | - Decrease priority of sssd-libwbclient 20 -> 5
- It should be lower than priority of samba veriosn of libwbclient.
- https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18
- Add explicit requirement on selinux-policy version to address new SBUS
symlinks.
- Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
certificate EKU and perform an action based
on value when generating SSH key from a certificate
- Resolves: rhbz#752495 - Crash when apply settings
- Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
repository
- This just required a raise in release number
and changelog for the record.
- Only BuildRequire libcmocka on Fedora
- Resolves: rhbz#1256849 - SUDO: Support the IPA schema
- Use alternatives for libwbclient
- New upstream release 1.12.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.4
- Resolves: rhbz#1754996 - [sssd] Tier 0 Localization
- Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
- Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
file from package sssd-common-1.15.1-1.fc25.x86_64
- Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4
- Unify return type of list_active_domains for python{2,3}
- Fix incorrect tarball URL
- Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
of gen_new to avoid a subsequent switch call
failure
- Fix upgrade issues from old (pre-0.5.0) releases of SSSD
- Resolves: rhbz#1672780 - gdm login not prompting for username when smart
card maps to multiple users
- Resolves: rhbz#683267 - sssd 1.5.1-9 breaks AD authentication
- Fix broken ARM build
- Add missing DP_OPTION_TERMINATOR in AD provider options
- Backport upstream patches for 1.15.3 pre-release
- required for building freeipa-4.5.x in rawhide
- Resolves: rhbz#606887 - sssd stops on upgrade
- Fix nested group member filter sanitization for RFC2307bis
- Put translated tool manpages into the sssd-tools subpackage
- Fix regression with krb5_map_user
- Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
- Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
default if nonexistent domain is mentioned
- New upstream release 1.6.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
- Fixes a major cache performance issue introduced in 1.6.2
- Fixes a potential infinite-loop with certain LDAP layouts
- Related: rhbz#1638150 - session not recording for local user when groups defined
- Also add silence a Coverity warning, which is related to rhbz#1637131
- New upstream release 1.4.1
- Add support for netgroups to the proxy provider
- Fixes a minor bug with UIDs/GIDs >= 2^31
- Fixes a segfault in the kerberos provider
- Fixes a segfault in the NSS responder if a data provider crashes
- Correctly use sdap_netgroup_search_base
- Resolves: rhbz#1636397 - SSSD not fetching all sudo rules from AD
- Change the default ccache location to DIR:/run/user/${UID}/krb5cc
and patch man page accordingly
- Resolves: rhbz#851304
- Resolves: rhbz#1615590 - Do not rely on "python" for el8
- Install systemd unit file instead of sysv init script
- New upstream release 1.9.0 beta7
- obsoletes patches #1-#3
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
- Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
- Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
- Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
- Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
- Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade
- Rebuild for libldb 1.1.19
- Version 0.2.1
- New stable upstream version 1.2.1
- Resolves: rhbz#595529 - spec file should eschew %define in favor of
- %global
- Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
- to fail while restart.
- Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
- keyring
- Resolves: rhbz#599724 - sssd is broken on Rawhide
- Resolves: rhbz#1729055 - sssd does not pass correct rules to sudo
- New upstream release 1.5.6
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
- Fixed a serious memory leak in the memberOf plugin
- Fixed a regression with the negative cache that caused it to be essentially
- nonfunctional
- Fixed an issue where the user's full name would sometimes be removed from
- the cache
- Fixed an issue with password changes in the kerberos provider not working
- with kpasswd
- Fix regression on 64-bit platforms
- Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
suggests using * for backend sss
- New upstream release 1.6.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
- Fixes a serious issue with LDAP connections when the communication is
dropped (e.g. VPN disconnection, waking from sleep)
- SSSD is now less strict when dealing with users/groups with multiple names
when a definitive primary name cannot be determined
- The LDAP provider will no longer attempt to canonicalize by default when
using SASL. An option to re-enable this has been provided.
- Fixes for non-standard LDAP attribute names (e.g. those used by Active
Directory)
- Three HBAC regressions have been fixed.
- Fix for an infinite loop in the deref code
- New upstream release 1.10 beta2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
- BuildRequire libcmocka-devel in order to run all upstream tests during build
- BuildRequire libnl3 instead of libnl1
- No longer BuildRequire initscripts, we no longer use /sbin/service
- Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
older krb5-libs version
- This is to bump version to allow rebuild against rebased libldb.
- New upstream release 1.11.5.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5.1
- Backport patches from upstream 1.12.5 prerelease - contains many fixes
- New upstream release 1.9.0
- New upstream release 1.7.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
- Support for case-insensitive domains
- Support for multiple search bases in the LDAP provider
- Support for the native FreeIPA netgroup implementation
- Reliability improvements to the process monitor
- New DEBUG facility with more consistent log levels
- New tool to change debug log levels without restarting SSSD
- SSSD will now disconnect from LDAP server when idle
- FreeIPA HBAC rules can choose to ignore srchost options for significant
performance gains
- Assorted performance improvements in the LDAP provider
- Resolves: rhbz#1466503 - Snippets are not used when sssd.conf does not exist
- New upstream release 1.13.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.4
- New upstream release 1.5.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
- Fixes for support of FreeIPA v2
- Fixes for failover if DNS entries change
- Improved sss_obfuscate tool with better interactive mode
- Fix several crash bugs
- Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
- Delete users from the local cache if initgroups calls return 'no such user'
- (previously only worked for getpwnam/getpwuid)
- Use new Transifex.net translations
- Better support for automatic TGT renewal (now survives restart)
- Netgroup fixes
- New upstream release 1.8.0 beta 3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
- Fixed a regression in group enumeration since 1.7.0
- Fixed several memory-corruption bugs
- Finalized the ABI for the autofs support
- Fixed a regression in the proxy provider
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
- Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
- Resolves: rhbz#1803134 - Improve "unlock" time when user session already active
- Resolves: rhbz#1328108 - Protocol error with FreeIPA on CentOS 6
- Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
- doesn't require it
- Rebuild against libldb 1.10
- Build with _hardened_build macro
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- New upstream release 1.1.1
- Fixed the IPA provider (which was segfaulting at start)
- Fixed a bug in the SSSDConfig API causing some options to revert to
- their defaults
- This impacted the Authconfig UI
- Ensure that SASL binds to LDAP auto-retry when interrupted by a signal
- Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
- Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter
- Rebuild against new libtevent
- latest upstream release.
- also add a patch that fixes debugging output (potential segfault)
- Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
groups during getgrnam and getgrgid
- Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
in call to 'print'
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features
- Rebuild against PCRE 8.30
- CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Rebuild SSSD against ding-libs 0.3.0beta1
- Fix endianness bug in service map protocol
- Fix pre and post script requirements
- sssd-tools should require sssd-common, not sssd
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
- Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
- Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
- Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
- Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
- Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #
raise(): /usr/libexec/sssd/sssd_autofs killed by 6
- Fix segfault in TGT renewal
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
- Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
- Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
- Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
- Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
- Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]
- Only create the SELinux login file if there are SELinux mappings on
the IPA server
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
- Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)
- Add plugin for cifs-utils
- Resolves: rhbz#998544
- Fix memberOf install path
- Related: rhbz#1638006 - Files: The files provider always enumerates
which causes duplicate when running getent passwd
- New upstream release 1.14.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.1
- New upstream release 1.14 alpha
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0alpha
- Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
setnetgrent_result_timeout
- Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
or machine swaps
- Resolves: failure in glibc tests
https://sourceware.org/bugzilla/show_bug.cgi?id=22530
- Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
auth_provider ldap, login fails if the LDAP server
is not allowing anonymous binds
- Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
corrected with AD
- Resolves: upstream#3586 - Give a more detailed debug and system-log message
if krb5_init_context() failed
- Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
in /etc/systemd/system
- Backport few upstream features from 1.16.1
- Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
new ones (kcm)
- Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
- Resolves: rhbz#1646168 - sssctl access-report always prints an error message
- Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
configuration without having to restart the whole
sssd
- Resolves: rhbz#1640576 - sssctl reports incorrect information about local
user's cache entry expiration time
- Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
- Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys
- the cmocka toolkit exists only on selected arches
- Fixes a serious memory hierarchy bug causing unpredictable behavior in the
LDAP provider.
- New upstream release 1.11.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0
- Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
/usr/libexec/sssd/proxy_child killed by 6
- Fix building of sssd-nfs-idmap with libnfsidmap.so.1
- New upstream release 1.10
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0
- Backport more sbus2 fixes
- Related: rhbz#1623878 - crash related to sbus_router_destructor()
- Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
certificate EKU and perform an action based
on value when generating SSH key from a certificate
(additional patch)
- Solve a shutdown race-condition that sometimes left processes running
- Resolves: rhbz#606887 - SSSD stops on upgrade
- Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
with no specific host/hostgroup set
- Resolves: upstream#3621 - FleetCommander integration must not require
capability DAC_OVERRIDE
- Remove %files reference to sss_debuglevel copied from wrong upstreeam
spec file.
- Resolves: rhbz#1713368 - Add sssd-dbus package as a dependency of sssd-tools
- Resolves: RHEL-33957 - ad: refresh root domain when read directly
- Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
- Make sure to properly convert to systemd if upgrading from newer
- updates for Fedora 14
- Fix build issues: Update expided certificate in unit tests
- New upstream release 0.7.0
- New upstream release 1.14.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0
- Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
sssd_ifp killed by SIGSEGV
- New upstream version 1.2.91 (1.3.0rc1)
- Improved LDAP failover
- Synchronous sysdb API (provides performance enhancements)
- Better online reconnection detection
- New LDAP access provider allows for filtering user access by LDAP attribute
- Reduced default timeout for detecting offline status with LDAP
- GSSAPI ticket lifetime made configurable
- Better offline->online transition support in Kerberos
- Release new upstream version 1.1.91
- Enhancements when using SSSD with FreeIPA v2
- Support for deferred kinit
- Support for DNS SRV records for failover
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
- Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
- Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
- Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
- Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
- Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
- Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
- Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
- Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
- Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
- Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
- Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf
- Resolves: rhbz#1646113 - Missing concise documentation about valid options
for sssd-files-provider
- Fix typo in libwbclient-devel %preun
- Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
- Also sync. kcm multihost tests with master
- Switch unicode library from libunistring to Glib
- Drop unnecessary explicit Requires on keyutils
- Guarantee that versioned Requires include the correct architecture
connection timeout
- Resolves: rhbz#1139962 - Fedora 21, FreeIPA 4.0.2: sssd does not find user
private group from server
- New upstream release 1.5.5
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
- Fixes for several crash bugs
- LDAP group lookups will no longer abort if there is a zero-length member
- attribute
- Add automatic fallback to 'cn' if the 'gecos' attribute does not exist
- New upstream bugfix release 0.99.1
- Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
- Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
- Several segfault bugfixes
- Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
retrieve AD users through IPA Trust
- New upstream release 1.5.10
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
- Fixed a regression introduced in 1.5.9 that could result in blocking calls
- to LDAP
- Rebuilt for libnfsidmap.so.1
- Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
specified up to the seconds
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
if ID provider is authenticated with GSSAPI
- New upstream release 1.9.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Release SSSD 1.1.0 final
- Fix two potential segfaults
- Fix memory leak in monitor
- Better error message for unusable confdb
- New upstream release 1.6.4
- Rolls up previous patches applied to the 1.6.3 tarball
- Fixes a rare issue causing crashes in the failover logic
- Fixes an issue where SSSD would return the wrong PAM error code for users
that it does not recognize.
- Related: rhbz#1635595 - Cant login with smartcard with multiple certs
- New upstream release 1.9.0 beta 1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
- Add native support for autofs to the IPA provider
- Support for ID-mapping when connecting to Active Directory
- Support for handling very large (> 1500 users) groups in Active Directory
- Support for sub-domains (will be used for dealing with trust relationships)
- Add a new fast in-memory cache to speed up lookups of cached data on
repeated requests
- Backport important patches from upstream 1.13 prerelease
- Relax libldb BuildRequires to be greater-or-equal
- Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
- Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
- Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
- Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
inotify events, and no updates are triggered
- Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
on GDM login with smart-card
- Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
- Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
- Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
- Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
if LDAP entries do not contain AD forest root information
- Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
in SSSD-AD direct integration.
- Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
- Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
- Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma
- add missing configure check that broke stopping the daemon
- also fix default config to add a missing required option
- New upstream release 1.9.0 beta 6
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
- A new option, override_shell was added. If this option is set, all users
managed by SSSD will have their shell set to its value.
- Fixes for the support for setting default SELinux user context from FreeIPA.
- Fixed a regression introduced in beta 5 that broke LDAP SASL binds
- The SSSD supports the concept of a Primary Server and a Back Up Server in
failover
- A new command-line tool sss_seed is available to help prime the cache with
a user record when deploying a new machine
- SSSD is now able to discover and save the domain-realm mappings
between an IPA server and a trusted Active Directory server.
- Packaging changes to fix ldconfig usage in subpackages (#843995)
- Rebuild against libldb 1.1.9
- New upstream release 1.9.4
- Rebuild against libldb 1.1.4
- package git snapshot
- Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
access on the sock_file system_bus_socket
- Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
fails to download desktop profile data
- Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
- Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
after applying ID Views for them in IPA server
- Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
mapping is applied
- Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
differs from the default
- Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
- Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
- Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
- Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
- Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
- Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
- Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
- Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
- Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
- Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
- Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
- Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization
- Apply a number of patches from upstream to fix issues found post-beta,
in particular:
-- segfault with a high DEBUG level
-- Fix IPA password migration (upstream #1873)
-- Fix fail over when retrying SRV resolution (upstream #1886)
- Rebuild for libldb 1.1.18
- Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
pam libraries
- Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
prompts (e.g. Password + Token)
- Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
by remote host" if locale not available
- Resolves: rhbz#1733372 - permission denied on logs when running sssd as
non-root user
- Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
information
- Fix Obsoletes: to account for dist tag
- Convert post and pre scripts to run on the sssd-common subpackage
- Remove old conversion from SYSV
- Fix regression in endianness patch
- New upstream release 1.4.0
- Added support for netgroups to the LDAP provider
- Performance improvements made to group processing of RFC2307 LDAP servers
- Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
- Build-system improvements to support Gentoo
- Split out several libraries into the ding-libs tarball
- Manpage reviewed and updated
- Fix regressions and bugs in sssd upstream 1.12.2
- https://fedorahosted.org/sssd/ticket/{id}
- Regressions: #2471, #2475, #2483, #2487, #2529, #2535
- Bugs: #2287, #2445
- New upstream release 1.8.0
- Support for the service map in NSS
- Support for setting default SELinux user context from FreeIPA
- Support for retrieving SSH user and host keys from LDAP (Experimental)
- Support for caching autofs LDAP requests (Experimental)
- Support for caching SUDO rules (Experimental)
- Include the IPA AutoFS provider
- Fixed several memory-corruption bugs
- Fixed a regression in group enumeration since 1.7.0
- Fixed a regression in the proxy provider
- Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
- Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
logged at each login
- Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
/usr/sbin/sssd was killed by signal 11 (SIGSEGV)
- Resolves: rhbz#743133 - Performance regression with Kerberos authentication
against AD
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features
- Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc
- New upstream release 1.10 beta1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta1
- New upstream release 1.12.5
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.5
- Backport few upstream patches/fixes
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
- Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
- Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
- Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
- Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
- Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
- Resolves: rhbz#2098617 - Harden kerberos ticket validation
- Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
- Resolves: rhbz#1164156 - libsss_simpleifp should pull sssd-dbus
- Resolves: rhbz#1179379 - gzip: stdin: file size changed while
zipping when rotating logfile
- Include the 1.9.2 tarball
- Resolves: rhbz#1578014 - sssd does not work under non-root user
- Note: Actually the patches were in the 2.0.0-37, this one just adds this
changelog because it was missing.
- Use mcpath insted of mcachepath macro to be consistent with
upsteam spec file
- Add missing %license macro
- New upstream release
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
- Fix two minor manpage bugs
- Include the IPA AutoFS provider
- Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
and libtevent to avoid an issue in GPO processing
- Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
- against LDAP
- Resolves: upstream#3618 - selinux_child segfaults in a docker container
- Check the validity of naming context
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- New upstream release 1.15.3
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_3.html
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Resolves: rhbz#1726945 - negative cache does not use values from
'filter_users' config option for known domains
- Related: rhbz#1637131 - pam_unix unable to match fully qualified username
provided by sssd during smartcard auth using gdm
- New upstream release 1.5.1
- Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Vast performance improvements when enumerate = true
- All PAM actions will now perform a forced initgroups lookup instead of just
- a user information lookup
- This guarantees that all group information is available to other
- providers, such as the simple provider.
- For backwards-compatibility, DNS lookups will also fall back to trying the
- SSSD domain name as a DNS discovery domain.
- Support for more password expiration policies in LDAP
- 389 Directory Server
- FreeIPA
- ActiveDirectory
- Support for ldap_tls_{cert,key,cipher_suite} config options
-Assorted bugfixes
- Resolves: #967012 - [abrt] sssd-1.9.5-1.fc18: sss_mmap_cache_gr_invalidate_gid:
Process /usr/libexec/sssd/sssd_nss was killed by
signal 11 (SIGSEGV)
- Resolves: #996214 - sssd proxy_child segfault
- Resolves: rhbz#1687281
Rebase sssd in RHEL-8.1 to the latest upstream release
- Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
- Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
- Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working
- Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
- cached password with predicatable filename
- Backport important patches from upstream 1.13 prerelease
- Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
attribute for group name
- Resolves: upstream #2335 - Investigate using the krb5 responder
for driving the PAM conversation with OTPs
- Enable cmocka tests for secondary architectures
- Split internal helper libraries into a shared object
- Significantly reduce disk-space usage
- Resolves: rhbz#1687281
Rebase sssd in RHEL-8.1 to the latest upstream release
-Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
UnknownProperty: Unknown property
- Re-add manpage translations
- Resolves: rhbz#632615 - the krb5 locator plugin isn't packaged for multilib
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Patch SSSDConfig API to address
- https://bugzilla.redhat.com/show_bug.cgi?id=549482
- Fix slow login with ipa and SELinux
- Resolves: upstream #2624 - Only set the selinux context if the context
differs from the local one
for match rules sss-certmap
- Resolves: RHEL-39085 - [RfE] SSSD Failover Enhancements
- Rebuild for new libldb
- Don't duplicate libsss_autofs.so in two packages
- Set explicit package contents instead of globbing
- New upstream release 1.5.3
- Support for libldb >= 1.0.0
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
- Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user
- Change selinux policy requirement to Conflicts: with the old version,
rather than Requires: the supported version.
- New upstream release 0.5.0
- Backport extended NSS API from upstream master branch
- Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
with smart card
- New upstream release 1.9.0 rc1
- Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
- Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
- Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
- Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
- Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
- Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
- Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
- Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
- Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
- Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
- Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
- Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
- Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
- Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
- Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
- Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
- Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
- Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
- Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
- Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
- Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
- Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
- Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
- Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'
- Rebuild against libldb 1.12
- New upstream release 0.6.0
- Fix build with new automake versions
- Add a patch to fix krb5 ccache creation issue with krb5 1.11
- Resolves: rhbz#1431153 - sssd: libsss_proxy.so needs to be linked with -ldl
- Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
the IP address of the machine updated in IPA upon
sssd.service startup
- Rebuilt for Python3.5 rebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Add a patch to fix krb5 unit tests
- New upstream release 0.99.0
- New upstream release 1.14 beta
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0beta
- Apply a couple of patches from upstream git that resolve crashes when
ID mapping object was not initialized properly but needed later
- Make LDB dependency a strict equivalency
- New upstream release 1.12.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.1
- Backport patches with Python3 support from upstream
- Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
commands in man pages since local provider
is deprecated
- Include upstream patch to build with krb5-1.11
- Include couple of patches from upstream 1.11 branch
- Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
Rebuild against Samba rebase.
- Enable hardened build for RHEL7
- Update to 1.16.2 release
- Cleanup unused global definitions
- Remove python2 references from the spec file
- Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x
- Resolves: rhbz#1625842 id_provider= local causes SSSD to abort startup
- Resolves: rhbz#697057 - kpasswd fails when using sssd and
- kadmin server != kdc server
- Upgrades from SysV should now maintain enabled/disabled status
- Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
should not cause files domain entries to be
qualified, this can break sudo access
- Related: rhbz#1611011 - Support for "require smartcard for login option"
- Additional upstream fixes
- Fix double free in monitor
- Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
sssd killed by SIGABRT
- Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
systemd-user service in the account phase in RHEL-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
- Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
- Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
- Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
- Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
- Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
- Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
- Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
- Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
- Resolves: rhbz#2087745 - 2FA prompting setting ineffective
- Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language
- Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
- Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
- Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend
- Backport important patches from upstream 1.14.2 prerelease
- Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
boot
- Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14
- Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
omitted and auth_provider is krb5
- Change default kerberos credential cache location to /run/user/
- Fix failover from Global Catalog to LDAP in case GC is not available
- New upstream release 1.5.8
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
- Support for the LDAP paging control
- Support for multiple DNS servers for name resolution
- Fixes for several group membership bugs
- Fixes for rare crash bugs
- Own several directories create during make install (#839782)
- Move the sss_cache tool to the main package
- New upstream release 1.15.2
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_2.html
- Move sssd_pac to the sssd-krb5 subpackage
- Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
in ding-libs
- Fix SSH integration with fully-qualified domains
- Add the ability to dynamically discover the NetBIOS name
- Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
Rebuild against rebased Samba libs
- Resolves: rhbz#1820574 - [sssd] RHEL 8.3 Tier 0 Localization
- New upstream release 1.5.0
- Fixed issues with LDAP search filters that needed to be escaped
- Add Kerberos FAST support on platforms that support it
- Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
- Added a Kerberos access provider to honor .k5login
- Addressed several thread-safety issues in the sss_client code
- Improved support for delayed online Kerberos auth
- Significantly reduced time between connecting to the network/VPN and
- acquiring a TGT
- Added feature for automatic Kerberos ticket renewal
- Provides the kerberos ticket for long-lived processes or cron jobs
- even when the user logs out
- Added several new features to the LDAP access provider
- Support for 'shadow' access control
- Support for authorizedService access control
- Ability to mix-and-match LDAP access control features
- Added an option for a separate password-change LDAP server for those
- platforms where LDAP referrals are not supported
- Added support for manpage translations
- New upstream release 1.15.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_1.html
- New upstream release 1.12.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3
- Fix spelling errors in description (fedpkg lint)
- Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
- Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
- Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL
- Rebuild sssd against libldb 1.0.2 so the memberof module loads again.
- Related: rhbz#677425
- Log startup errors to the syslog
- Allow cache cleanup to be disabled in sssd.conf
- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
- Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
- Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
- Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
- Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
- Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
- Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)
- require the latest libldb
- Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
users
- Rebuild for libldb 1.1.3
- Rebuild due to rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
- New upstream release 1.9.0 beta 4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
- Add a new AD provider to improve integration with Active Directory 2008 R2
or later servers
- SUDO integration was completely rewritten. The new implementation works
with multiple domains and uses an improved refresh mechanism to download
only the necessary rules
- The IPA authentication provider now supports subdomains
- Fixed regression for setups that were setting default_tkt_enctypes
manually by reverting a previous workaround.
- Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
- Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
- Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
- Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior
error messages with line numbers
- bugfix release 0.3.2
- includes previous release patches
- change permissions of the /etc/sssd/sssd.conf to 0600
- Resolves: rhbz#1615460 - Rebase SSSD to the latest released version
- New upstream release 1.6.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
- Add host access control support for LDAP (similar to pam_host_attr)
- Finer-grained control on principals used with Kerberos (such as for FAST or
- validation)
- Added a new tool sss_cache to allow selective expiring of cached entries
- Added support for LDAP DEREF and ASQ controls
- Added access control features for Novell Directory Server
- FreeIPA dynamic DNS update now checks first to see if an update is needed
- Complete rewrite of the HBAC library
- New libraries: libipa_hbac and libipa_hbac-python
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Fix licenses in sources and on RPMs
- New upstream release 1.10 alpha1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0alpha1
- Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
for D-bus, resulting in a crash
- Rebuild with libldb-1.2.0
- Fix systemd conversion. Upgrades from SysV to systemd weren't properly
- enabling the systemd service.
- Fix a serious memory leak in the memberOf plugin
- Fix an issue where the user's full name would sometimes be removed
- from the cache
- Backport simplification of ccache management from 1.11.1
- Resolves: rhbz#1010553 - sssd setting KRB5CCNAME=(null) on login
- Resolves: rhbz#1382750 - Conflicting default timeout values
- Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"
- Resolves: rhbz#1175511 - sssd-libwbclient conflicts with Samba's and causes
crash in wbinfo
- in addition to the patch libwbclient.so is
filtered out of the Provides list of the package
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
- Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
- Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
- Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
- Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
- Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
- Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
- Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
- Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
- Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
- Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
- Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
- Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
- Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
- Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
- Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
- Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
- Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
- Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
- Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
- Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
- Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
- Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
- Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
- Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
- Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive
- Resolves: rhbz#1448094 - sssd-kcm cannot handle big tickets
- New upstream release 1.11 beta 2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0beta2
- Fix few segfaults
- Resolves: upstream #2811 - PAM responder crashed if user was not set
- Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step
- Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
keyring
- Also apply a patch to fix gating tests issue
- Cherry-pick patches from upstream that enable the files provider
- Enable the files domain
- Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
which is superseded by the files domain autoconfiguration
- Related: rhbz#1357418 - SSSD fast cache for local users
- Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
kdestroy caused by KCM returning a wrong error
code during the delete operation
- Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
username in getpwnam()
- Resolves: rhbz#758425 - LDAP failover not working if server refuses
connections
- Improved handling of users and groups with multi-valued name attributes
(aliases)
- Performance enhancements
Initgroups on RFC2307bis/FreeIPA
HBAC rule processing
- Improved process-hang detection and restarting
- Enabled the midpoint cache refresh by default (fewer cache misses on
commonly-used entries)
- Cleaned up the example configuration
- New tool to change debug level on the fly
- New upstream release 1.12 beta1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0beta1
- fixed items found during review
- added initscript
- Resolves: 1658813 - PKINIT with KCM does not work
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features - fix netgroups and sudo as well
- Fix building pac responder with the krb5-1.14
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization
- Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
- Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
- Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]
- release out of the official 0.3.2 tarball
- Rebuild against new libldb
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
- Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
- Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
- Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
- Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
- Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
- Resolves: RHEL-10721 - very bad performance when requesting service tickets
- Resolves: RHEL-19011 - Invalid handling groups from child domain
- Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]
- Don't discard HBAC rule processing result if SELinux is on
Resolves: rhbz#846792 (CVE-2012-3462)
- New stable upstream version 1.2.0
- Support ServiceGroups for FreeIPA v2 HBAC rules
- Fix long-standing issue with auth_provider = proxy
- Better logging for TLS issues in LDAP
- New upstream release 1.13.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.0
- New upstream release 1.14.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.2
- Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
- Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
- Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11
- Fix ipa-migration bug
- Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
migration mode
- Rebuild against new ding-libs
- Version 0.3.1
- includes previous release patches
- Remove the ability to create public ccachedir (#1015089)
- Fix bug in generation of systemd unit file
- Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
- Fixed "requires/provides" rpmdiff warning
- Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
- Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
- Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
- Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
- Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization
- Move sssd_pac to the sssd-ipa and sssd-ad subpackages
- Trim out RHEL5-specific macros since we don't build on RHEL 5
- Trim out macros for Fedora older than F18
- Update libldb requirement to 1.1.16
- Trim RPM changelog down to the last year
- New upstream release
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
- Support for the service map in NSS
- Support for setting default SELinux user context from FreeIPA
- Support for retrieving SSH user and host keys from LDAP (Experimental)
- Support for caching autofs LDAP requests (Experimental)
- Support for caching SUDO rules (Experimental)
- Fix uninitialized value bug causing crashes throughout the code
- Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup
- Add OSCP checks for p11_child
- Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
users
- Resolves: rhbz#1494002 - sssd_nss crashed in cache_req_search_domains_next
- python-sssdconfig: Fix parssing sssd.conf without config_file_version
- Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed
- Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
done here in order to unblock gating changes before rebase.
- Related: rhbz#1682305
- Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
realm join
- Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
default for AD Provider
- Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
parent directory when logging in
- New upstream stable release 1.0.0
- Switch hardcoded python3 shebangs into the %{__python3} macro
- Version 0.3.0
- Provides file based configuration and lots of improvements
- Resolves: rhbz#1369130 - nss_sss should not link against libpthread
- Resolves: rhbz#1392916 - sssd failes to start after update
- Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
on the directory /etc/sssd
- Rebuild against libldb 1.11
- Fix segfault in sssd_pam when cache_credentials was enabled
- Update the sample configuration
- Fix upgrade issues caused by data provider service removal
- Add support for python3 bindings
- Add requirement to python3 or python3 bindings
- Resolves: rhbz#1014594 - sssd: Support Python 3
- New upstream release 1.9.0 beta 5
- Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
- Many fixes for the support for setting default SELinux user context from
FreeIPA, most notably fixed the specificity evaluation
- Fixed an incorrect default in the krb5_canonicalize option of the AD
provider which was preventing password change operation
- The shadowLastChange attribute value is now correctly updated with the
number of days since the Epoch, not seconds
- Resolves: rhbz#1657980 - sssd_nss memory leak
- Also relax libldb Requires
- Remove --enable-ldb-version-check
- New upstream release 1.10.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.1
- Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
PKCS#11 URI
- New upstream release 1.9.0 beta 2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
- Add support for the Kerberos DIR cache for storing multiple TGTs
automatically
- Major performance enhancement when storing large groups in the cache
- Major performance enhancement when performing initgroups() against Active
Directory
- SSSDConfig data file default locations can now be set during configure for
easier packaging
- New upstream release 1.16.0
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_0.html
- Rebuilt for glibc bug#747377
- Rebuild for Python 3.6
- Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
- Fix release version for upgrades
- New upstream release 1.13.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Add last minute bug fixes, found in testing the package
- Resolves: rhbz#1623878 - crash related to sbus_router_destructor()
- Rebuild against new libldb
- Resolves: rhbz#1652719 - [SECURITY] sssd returns '/' for emtpy home directories
- Fix issue with IPA + SELinux in containers
- Resolves: upstream https://fedorahosted.org/sssd/ticket/3297
- Add support for libldb 1.0.0
- Try to fix build adding automake as an explicit BuildRequire
- Add also a couple of last minute patches from upstream
- Fix systemd executions/requirements
- New upstream release 1.11.4
- Remove upstreamed patch
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.4
- Small cleanup and fixes in the spec file
- BuildRequire recent libini_config to ensure consistent behaviour
- added sss_client
- New upstream release 1.13.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.3
- New upstream release 1.13 alpha
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.0alpha
- Fix potential crash with external groups in trusted IPA-AD setup
- Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
without a password. (Patch by Stephen Gallagher)
- Resolves: rhbz#1736265 - Smart Card auth of local user: endless
loop if wrong PIN was provided
- Resolves: rhbz#2149241 - [sssd] SSSD enters failed state after heavy load in the system
- Resolves: rhbz#1642372 - SSSD Python getgrouplist API was removed but required for IPA
- Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
- Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
- Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
- Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1
- Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files (additional patch)
- Ensure that SSSD builds against libldb-1.0.0 on F15 and later
- Remove .la for memberOf
- Fix CVE-2010-0014
- Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
- Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
- Resolves: rhbz#1893159 - Default debug level should report all errors / failures
- Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication
- Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently
- New upstream release 1.12.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0
- Resolves: rhbz#1718193 - p11_child should have an option to skip
C_WaitForSlotEvent if the PKCS#11 module
does not implement it properly
- Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied
- New upstream release 1.8.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
- Several fixes to case-insensitive domain functions
- Fix for GSSAPI binds when the keytab contains unrelated principals
- Fixed several segfaults
- Workarounds added for LDAP servers with unreadable RootDSE
- SSH knownhostproxy will no longer enter an infinite loop preventing login
- The provided SYSV init script now starts SSSD earlier at startup and stops
it later during shutdown
- Assorted minor fixes for issues discovered by static analysis tools
- Resolve groups from AD correctly
- Restore Requires: cyrus-sasl-gssapi as it is not auto-detected during
- rpmbuild
- Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
not FIPS140 compliant
- Fixes link error on platforms that do not do implicit linking
- Fixes double-free segfault in PAM
- Fixes double-free error in async resolver
- Fixes support for TCP-based DNS lookups in async resolver
- Fixes memory alignment issues on ARM processors
- Manpage fixes
- Resolves: upstream#3529 - sssd-kcm Fix restart during/after upgrade
- Resolves: upstream#3621 - backport bug found by static analyzers
- Fix building on rawhide. Remove -Wl,-z,defs from LDFLAGS
- Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
no members
- New upstream release 1.5.11
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
- Fix a serious regression that prevented SSSD from working with ldaps:// URIs
- IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
- address being saved to the AAAA record
- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
- Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
- Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
- Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
- Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
- Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed
- Resolves: rhbz#1628122 - Printing incorrect information about domain
with sssctl utility
- Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
fails with the KCM ccache
- New upstream release 1.16.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_1.html
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Resolves: rhbz#1673443 - sssd man pages: The default value of
"ldap_user_home_directory" is not mentioned
with AD server configuration
- New upstream release 1.9.1
- Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
- Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
- Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)
- Fix multicast checks in the SSSD
- Resolves: rhbz#1007475 - The multicast check is wrong in the sudo source
code getting the host info
- New upstream release 1.11.3
- Remove upstreamed patches
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.3
- Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
- Resolves: rhbz#1915395 - Memory leak in the simple access provider
- Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
- Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)
- Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
started due to a misconfiguration
- Release candidate for SSSD 1.1
- Add simple access provider
- Create subpackages for libcollection, libini_config, libdhash and librefarray
- Support IPv6
- Support LDAP referrals
- Fix cache issues
- Better feedback from PAM when offline
- Add workaround patch for RHBZ #1366403
- Do not write out dots in the domain-realm mapping file (#905650)
- Fix the Kerberos password expiration warning (#912223)
- Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
- Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
- Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]
- Version 0.2.0
- Add SSSDConfig API
- Update polish translation for 0.6.0
- Fix long timeout on ldap operation
- Make dp requests more robust
- New upstream release 1.12.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.2
- Fix several regressions since 1.5.x
- Ensure that the RPM creates the /var/lib/sss/mc directory
- Add support for Netscape password warning expiration control
- Rebuild against libldb 1.1.6
- Related: rhbz#1637513 - sssd crashes when refreshing expired sudo rules
- Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
the trailing colon
- Fix changelog dates to make F19 rpmbuild happy
-Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
subdomain service name being used
- Fix libwbclient alternatives
- Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
- Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
- Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
- Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
- Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
- Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
- Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
- Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
- Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
- Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
- Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
- Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
- Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
- Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
- Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
- Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
- Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
- Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate
- Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
- Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
- Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently
- New upstream release 1.5.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
- Fixes for Active Directory when not all users and groups have POSIX attributes
- Fixes for handling users and groups that have name aliases (aliases are ignored)
- Fix group memberships after initgroups in the IPA provider
- New upstream release 1.11.5
- Remove upstreamed patch
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5
- Fix regressions with ipa and SELinux
- Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
context on client is staff_u
- Do not crash on resolving a group SID in IPA server mode
- Apply a number of patches from upstream to fix issues found 1.12.3
- Resolves: rhbz#1176373 - dyndns_iface does not accept multiple
interfaces, or isn't documented to be able to
- Resolves: rhbz#988068 - getpwnam_r fails for non-existing users when sssd is
not running
- Resolves: upstream #2557 authentication failure with user from AD
- Fix tests on big-endian
- Fix previous changelog entry
- New upstream release 1.9.0 beta 3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
- Add a new PAC responder for dealing with cross-realm Kerberos trusts
- Terminate idle connections to the NSS and PAM responders
- Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
/usr/libexec/sssd/sssd_be killed by 11 crash
func _dbus_list_unlink
- Fix %postun
- New upstream release 1.8.1
- Resolve issue where we could enter an infinite loop trying to connect to an
auth server
- Fix serious issue with complex (3+ levels) nested groups
- Fix netgroup support for case-insensitivity and aliases
- Fix serious issue with lookup bundling resulting in requests never
completing
- IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
in addition to pam_authenticate
- Fix several regressions in the proxy provider
- Resolves: rhbz#743133 - Performance regression with Kerberos authentication
against AD
- Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work
- Fix a couple of segfaults that may happen on reload
- Fix OTP bug
- Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
entered separately
- Fix missing file permissions for sssd-clients
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Recreate Kerberos ccache directory if it's missing
- Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
directory /run/user/UID/ccdir does not exist
- New upstream release 1.9.3
- Resolves: rhbz#626205 - Unable to unlock screen
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
- Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization
- Initial release (based on version 0.1.0 upstream code)
- New upstream release 1.11.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.1
- New upstream release 1.12 beta2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0beta2
- libwbclient-sssd: update interface to version 0.13
- Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
1.x, this can result in time outs
- Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
searching in local cache database access on
the sock_file system_bus_socket
- Bump up release number to avoid library sub-packages version issues with
previous releases.
- Ensure that the configuration upgrade script always writes the config
file with 0600 permissions
- Eliminate an infinite loop in group enumerations
- Backport upstream patches required by FreeIPA 4.2.1
- Fix accidental disabling of the DIR cache support
- Resolves: upstream#3684 - A group is not updated if its member is removed
with the cleanup task, but the group does not
change
- Resolves: upstream#3558 - sudo: report error when two rules share cn
- Tone down shutdown messages for socket activated responders
- IPA: Qualify the externalUser sudo attribute
- Resolves: upstream#3550 - refresh_expired_interval does not work with
netgrous in 1.15
- Resolves: upstream#3402 - Support alternative sources for the files provider
- Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
- Resolves: upstream#3679 - Make nss netgroup requests more robust
- Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
configured
- Resolves: upstream#3469 - extend sss-certmap man page regarding priority
processing
- Improve docs/debug message about GC detection
- Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
list out of bound?
- Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
set.
- Document which principal does the AD provider use
- Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
defined, but contains no SIDs
- Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
- Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
Provider returned an error
[org.freedesktop.sssd.Error.DataProvider.Fatal]
- New upstream release 1.11.2
- Remove upstreamed patches
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2
- New upstream release 1.15.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.15.0
- New upstream release 1.5.9
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
- Support for overriding home directory, shell and primary GID locally
- Properly honor TTL values from SRV record lookups
- Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
- servers)
- Properly escape IPv6 addresses in the failover code
- Do not crash if inotify fails (e.g. resource exhaustion)
- Don't add multiple TGT renewal callbacks (too many log messages)
- Fix typo in Requires that prevented an upgrade (#973916)
- Use a hardcoded version in Conflicts, not less-than-current
- New upstream release 1.8.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
- Numerous manpage and translation updates
- LDAP: Handle situations where the RootDSE isn't available anonymously
- LDAP: Fix regression for users using non-standard LDAP attributes for user
information
- Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
- Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
- Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)
- Handle OTP response from FreeIPA server gracefully
- Resolves: rhbz#1283798 - sssd failover does not work on connecting to
non-responsive ldaps:// server
- Handle new error code for IPA password migration
- Resolves: rhbz#677768 - name service caches names, so id command shows
- recently deleted users
- Backport several patches from upstream.
- Fix a potential crash against old (pre-4.0) IPA servers
- Resolves: upstream#3573 - sssd won't show netgroups with blank domain
- Resolves: upstream#3660 - confdb_expand_app_domains() always fails
- Resolves: upstream#3658 - Application domain is not interpreted correctly
- Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
json_loads()
- Resolves: upstream#3386 - KCM: Payload buffer is too small
- Resolves: upstream#3666 - Fix usage of str.decode() in our tests
- A few KCM misc fixes
- New upstream release 1.13.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.1
python3-sss-murmur-2.9.4-5.el8_10.3.x86_64.rpm | - Decrease priority of sssd-libwbclient 20 -> 5
- It should be lower than priority of samba veriosn of libwbclient.
- https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18
- Add explicit requirement on selinux-policy version to address new SBUS
symlinks.
- Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
certificate EKU and perform an action based
on value when generating SSH key from a certificate
- Resolves: rhbz#752495 - Crash when apply settings
- Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
repository
- This just required a raise in release number
and changelog for the record.
- Only BuildRequire libcmocka on Fedora
- Resolves: rhbz#1256849 - SUDO: Support the IPA schema
- Use alternatives for libwbclient
- New upstream release 1.12.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.4
- Resolves: rhbz#1754996 - [sssd] Tier 0 Localization
- Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
- Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
file from package sssd-common-1.15.1-1.fc25.x86_64
- Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4
- Unify return type of list_active_domains for python{2,3}
- Fix incorrect tarball URL
- Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
of gen_new to avoid a subsequent switch call
failure
- Fix upgrade issues from old (pre-0.5.0) releases of SSSD
- Resolves: rhbz#1672780 - gdm login not prompting for username when smart
card maps to multiple users
- Resolves: rhbz#683267 - sssd 1.5.1-9 breaks AD authentication
- Fix broken ARM build
- Add missing DP_OPTION_TERMINATOR in AD provider options
- Backport upstream patches for 1.15.3 pre-release
- required for building freeipa-4.5.x in rawhide
- Resolves: rhbz#606887 - sssd stops on upgrade
- Fix nested group member filter sanitization for RFC2307bis
- Put translated tool manpages into the sssd-tools subpackage
- Fix regression with krb5_map_user
- Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
- Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
default if nonexistent domain is mentioned
- New upstream release 1.6.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
- Fixes a major cache performance issue introduced in 1.6.2
- Fixes a potential infinite-loop with certain LDAP layouts
- Related: rhbz#1638150 - session not recording for local user when groups defined
- Also add silence a Coverity warning, which is related to rhbz#1637131
- New upstream release 1.4.1
- Add support for netgroups to the proxy provider
- Fixes a minor bug with UIDs/GIDs >= 2^31
- Fixes a segfault in the kerberos provider
- Fixes a segfault in the NSS responder if a data provider crashes
- Correctly use sdap_netgroup_search_base
- Resolves: rhbz#1636397 - SSSD not fetching all sudo rules from AD
- Change the default ccache location to DIR:/run/user/${UID}/krb5cc
and patch man page accordingly
- Resolves: rhbz#851304
- Resolves: rhbz#1615590 - Do not rely on "python" for el8
- Install systemd unit file instead of sysv init script
- New upstream release 1.9.0 beta7
- obsoletes patches #1-#3
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
- Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
- Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
- Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
- Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
- Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade
- Rebuild for libldb 1.1.19
- Version 0.2.1
- New stable upstream version 1.2.1
- Resolves: rhbz#595529 - spec file should eschew %define in favor of
- %global
- Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
- to fail while restart.
- Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
- keyring
- Resolves: rhbz#599724 - sssd is broken on Rawhide
- Resolves: rhbz#1729055 - sssd does not pass correct rules to sudo
- New upstream release 1.5.6
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
- Fixed a serious memory leak in the memberOf plugin
- Fixed a regression with the negative cache that caused it to be essentially
- nonfunctional
- Fixed an issue where the user's full name would sometimes be removed from
- the cache
- Fixed an issue with password changes in the kerberos provider not working
- with kpasswd
- Fix regression on 64-bit platforms
- Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
suggests using * for backend sss
- New upstream release 1.6.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
- Fixes a serious issue with LDAP connections when the communication is
dropped (e.g. VPN disconnection, waking from sleep)
- SSSD is now less strict when dealing with users/groups with multiple names
when a definitive primary name cannot be determined
- The LDAP provider will no longer attempt to canonicalize by default when
using SASL. An option to re-enable this has been provided.
- Fixes for non-standard LDAP attribute names (e.g. those used by Active
Directory)
- Three HBAC regressions have been fixed.
- Fix for an infinite loop in the deref code
- New upstream release 1.10 beta2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
- BuildRequire libcmocka-devel in order to run all upstream tests during build
- BuildRequire libnl3 instead of libnl1
- No longer BuildRequire initscripts, we no longer use /sbin/service
- Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
older krb5-libs version
- This is to bump version to allow rebuild against rebased libldb.
- New upstream release 1.11.5.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5.1
- Backport patches from upstream 1.12.5 prerelease - contains many fixes
- New upstream release 1.9.0
- New upstream release 1.7.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
- Support for case-insensitive domains
- Support for multiple search bases in the LDAP provider
- Support for the native FreeIPA netgroup implementation
- Reliability improvements to the process monitor
- New DEBUG facility with more consistent log levels
- New tool to change debug log levels without restarting SSSD
- SSSD will now disconnect from LDAP server when idle
- FreeIPA HBAC rules can choose to ignore srchost options for significant
performance gains
- Assorted performance improvements in the LDAP provider
- Resolves: rhbz#1466503 - Snippets are not used when sssd.conf does not exist
- New upstream release 1.13.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.4
- New upstream release 1.5.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
- Fixes for support of FreeIPA v2
- Fixes for failover if DNS entries change
- Improved sss_obfuscate tool with better interactive mode
- Fix several crash bugs
- Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
- Delete users from the local cache if initgroups calls return 'no such user'
- (previously only worked for getpwnam/getpwuid)
- Use new Transifex.net translations
- Better support for automatic TGT renewal (now survives restart)
- Netgroup fixes
- New upstream release 1.8.0 beta 3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
- Fixed a regression in group enumeration since 1.7.0
- Fixed several memory-corruption bugs
- Finalized the ABI for the autofs support
- Fixed a regression in the proxy provider
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
- Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
- Resolves: rhbz#1803134 - Improve "unlock" time when user session already active
- Resolves: rhbz#1328108 - Protocol error with FreeIPA on CentOS 6
- Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
- doesn't require it
- Rebuild against libldb 1.10
- Build with _hardened_build macro
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- New upstream release 1.1.1
- Fixed the IPA provider (which was segfaulting at start)
- Fixed a bug in the SSSDConfig API causing some options to revert to
- their defaults
- This impacted the Authconfig UI
- Ensure that SASL binds to LDAP auto-retry when interrupted by a signal
- Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
- Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter
- Rebuild against new libtevent
- latest upstream release.
- also add a patch that fixes debugging output (potential segfault)
- Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
groups during getgrnam and getgrgid
- Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
in call to 'print'
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features
- Rebuild against PCRE 8.30
- CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Rebuild SSSD against ding-libs 0.3.0beta1
- Fix endianness bug in service map protocol
- Fix pre and post script requirements
- sssd-tools should require sssd-common, not sssd
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
- Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
- Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
- Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
- Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
- Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #
raise(): /usr/libexec/sssd/sssd_autofs killed by 6
- Fix segfault in TGT renewal
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
- Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
- Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
- Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
- Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
- Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]
- Only create the SELinux login file if there are SELinux mappings on
the IPA server
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
- Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)
- Add plugin for cifs-utils
- Resolves: rhbz#998544
- Fix memberOf install path
- Related: rhbz#1638006 - Files: The files provider always enumerates
which causes duplicate when running getent passwd
- New upstream release 1.14.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.1
- New upstream release 1.14 alpha
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0alpha
- Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
setnetgrent_result_timeout
- Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
or machine swaps
- Resolves: failure in glibc tests
https://sourceware.org/bugzilla/show_bug.cgi?id=22530
- Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
auth_provider ldap, login fails if the LDAP server
is not allowing anonymous binds
- Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
corrected with AD
- Resolves: upstream#3586 - Give a more detailed debug and system-log message
if krb5_init_context() failed
- Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
in /etc/systemd/system
- Backport few upstream features from 1.16.1
- Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
new ones (kcm)
- Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
- Resolves: rhbz#1646168 - sssctl access-report always prints an error message
- Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
configuration without having to restart the whole
sssd
- Resolves: rhbz#1640576 - sssctl reports incorrect information about local
user's cache entry expiration time
- Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
- Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys
- the cmocka toolkit exists only on selected arches
- Fixes a serious memory hierarchy bug causing unpredictable behavior in the
LDAP provider.
- New upstream release 1.11.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0
- Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
/usr/libexec/sssd/proxy_child killed by 6
- Fix building of sssd-nfs-idmap with libnfsidmap.so.1
- New upstream release 1.10
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0
- Backport more sbus2 fixes
- Related: rhbz#1623878 - crash related to sbus_router_destructor()
- Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
certificate EKU and perform an action based
on value when generating SSH key from a certificate
(additional patch)
- Solve a shutdown race-condition that sometimes left processes running
- Resolves: rhbz#606887 - SSSD stops on upgrade
- Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
with no specific host/hostgroup set
- Resolves: upstream#3621 - FleetCommander integration must not require
capability DAC_OVERRIDE
- Remove %files reference to sss_debuglevel copied from wrong upstreeam
spec file.
- Resolves: rhbz#1713368 - Add sssd-dbus package as a dependency of sssd-tools
- Resolves: RHEL-33957 - ad: refresh root domain when read directly
- Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
- Make sure to properly convert to systemd if upgrading from newer
- updates for Fedora 14
- Fix build issues: Update expided certificate in unit tests
- New upstream release 0.7.0
- New upstream release 1.14.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0
- Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
sssd_ifp killed by SIGSEGV
- New upstream version 1.2.91 (1.3.0rc1)
- Improved LDAP failover
- Synchronous sysdb API (provides performance enhancements)
- Better online reconnection detection
- New LDAP access provider allows for filtering user access by LDAP attribute
- Reduced default timeout for detecting offline status with LDAP
- GSSAPI ticket lifetime made configurable
- Better offline->online transition support in Kerberos
- Release new upstream version 1.1.91
- Enhancements when using SSSD with FreeIPA v2
- Support for deferred kinit
- Support for DNS SRV records for failover
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
- Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
- Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
- Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
- Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
- Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
- Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
- Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
- Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
- Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
- Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
- Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf
- Resolves: rhbz#1646113 - Missing concise documentation about valid options
for sssd-files-provider
- Fix typo in libwbclient-devel %preun
- Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
- Also sync. kcm multihost tests with master
- Switch unicode library from libunistring to Glib
- Drop unnecessary explicit Requires on keyutils
- Guarantee that versioned Requires include the correct architecture
connection timeout
- Resolves: rhbz#1139962 - Fedora 21, FreeIPA 4.0.2: sssd does not find user
private group from server
- New upstream release 1.5.5
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
- Fixes for several crash bugs
- LDAP group lookups will no longer abort if there is a zero-length member
- attribute
- Add automatic fallback to 'cn' if the 'gecos' attribute does not exist
- New upstream bugfix release 0.99.1
- Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
- Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
- Several segfault bugfixes
- Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
retrieve AD users through IPA Trust
- New upstream release 1.5.10
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
- Fixed a regression introduced in 1.5.9 that could result in blocking calls
- to LDAP
- Rebuilt for libnfsidmap.so.1
- Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
specified up to the seconds
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
if ID provider is authenticated with GSSAPI
- New upstream release 1.9.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Release SSSD 1.1.0 final
- Fix two potential segfaults
- Fix memory leak in monitor
- Better error message for unusable confdb
- New upstream release 1.6.4
- Rolls up previous patches applied to the 1.6.3 tarball
- Fixes a rare issue causing crashes in the failover logic
- Fixes an issue where SSSD would return the wrong PAM error code for users
that it does not recognize.
- Related: rhbz#1635595 - Cant login with smartcard with multiple certs
- New upstream release 1.9.0 beta 1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
- Add native support for autofs to the IPA provider
- Support for ID-mapping when connecting to Active Directory
- Support for handling very large (> 1500 users) groups in Active Directory
- Support for sub-domains (will be used for dealing with trust relationships)
- Add a new fast in-memory cache to speed up lookups of cached data on
repeated requests
- Backport important patches from upstream 1.13 prerelease
- Relax libldb BuildRequires to be greater-or-equal
- Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
- Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
- Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
- Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
inotify events, and no updates are triggered
- Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
on GDM login with smart-card
- Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
- Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
- Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
- Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
if LDAP entries do not contain AD forest root information
- Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
in SSSD-AD direct integration.
- Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
- Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
- Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma
- add missing configure check that broke stopping the daemon
- also fix default config to add a missing required option
- New upstream release 1.9.0 beta 6
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
- A new option, override_shell was added. If this option is set, all users
managed by SSSD will have their shell set to its value.
- Fixes for the support for setting default SELinux user context from FreeIPA.
- Fixed a regression introduced in beta 5 that broke LDAP SASL binds
- The SSSD supports the concept of a Primary Server and a Back Up Server in
failover
- A new command-line tool sss_seed is available to help prime the cache with
a user record when deploying a new machine
- SSSD is now able to discover and save the domain-realm mappings
between an IPA server and a trusted Active Directory server.
- Packaging changes to fix ldconfig usage in subpackages (#843995)
- Rebuild against libldb 1.1.9
- New upstream release 1.9.4
- Rebuild against libldb 1.1.4
- package git snapshot
- Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
access on the sock_file system_bus_socket
- Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
fails to download desktop profile data
- Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
- Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
after applying ID Views for them in IPA server
- Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
mapping is applied
- Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
differs from the default
- Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
- Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
- Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
- Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
- Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
- Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
- Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
- Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
- Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
- Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
- Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
- Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization
- Apply a number of patches from upstream to fix issues found post-beta,
in particular:
-- segfault with a high DEBUG level
-- Fix IPA password migration (upstream #1873)
-- Fix fail over when retrying SRV resolution (upstream #1886)
- Rebuild for libldb 1.1.18
- Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
pam libraries
- Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
prompts (e.g. Password + Token)
- Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
by remote host" if locale not available
- Resolves: rhbz#1733372 - permission denied on logs when running sssd as
non-root user
- Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
information
- Fix Obsoletes: to account for dist tag
- Convert post and pre scripts to run on the sssd-common subpackage
- Remove old conversion from SYSV
- Fix regression in endianness patch
- New upstream release 1.4.0
- Added support for netgroups to the LDAP provider
- Performance improvements made to group processing of RFC2307 LDAP servers
- Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
- Build-system improvements to support Gentoo
- Split out several libraries into the ding-libs tarball
- Manpage reviewed and updated
- Fix regressions and bugs in sssd upstream 1.12.2
- https://fedorahosted.org/sssd/ticket/{id}
- Regressions: #2471, #2475, #2483, #2487, #2529, #2535
- Bugs: #2287, #2445
- New upstream release 1.8.0
- Support for the service map in NSS
- Support for setting default SELinux user context from FreeIPA
- Support for retrieving SSH user and host keys from LDAP (Experimental)
- Support for caching autofs LDAP requests (Experimental)
- Support for caching SUDO rules (Experimental)
- Include the IPA AutoFS provider
- Fixed several memory-corruption bugs
- Fixed a regression in group enumeration since 1.7.0
- Fixed a regression in the proxy provider
- Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
- Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
logged at each login
- Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
/usr/sbin/sssd was killed by signal 11 (SIGSEGV)
- Resolves: rhbz#743133 - Performance regression with Kerberos authentication
against AD
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features
- Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc
- New upstream release 1.10 beta1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta1
- New upstream release 1.12.5
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.5
- Backport few upstream patches/fixes
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
- Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
- Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
- Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
- Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
- Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
- Resolves: rhbz#2098617 - Harden kerberos ticket validation
- Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
- Resolves: rhbz#1164156 - libsss_simpleifp should pull sssd-dbus
- Resolves: rhbz#1179379 - gzip: stdin: file size changed while
zipping when rotating logfile
- Include the 1.9.2 tarball
- Resolves: rhbz#1578014 - sssd does not work under non-root user
- Note: Actually the patches were in the 2.0.0-37, this one just adds this
changelog because it was missing.
- Use mcpath insted of mcachepath macro to be consistent with
upsteam spec file
- Add missing %license macro
- New upstream release
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
- Fix two minor manpage bugs
- Include the IPA AutoFS provider
- Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
and libtevent to avoid an issue in GPO processing
- Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
- against LDAP
- Resolves: upstream#3618 - selinux_child segfaults in a docker container
- Check the validity of naming context
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- New upstream release 1.15.3
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_3.html
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Resolves: rhbz#1726945 - negative cache does not use values from
'filter_users' config option for known domains
- Related: rhbz#1637131 - pam_unix unable to match fully qualified username
provided by sssd during smartcard auth using gdm
- New upstream release 1.5.1
- Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Vast performance improvements when enumerate = true
- All PAM actions will now perform a forced initgroups lookup instead of just
- a user information lookup
- This guarantees that all group information is available to other
- providers, such as the simple provider.
- For backwards-compatibility, DNS lookups will also fall back to trying the
- SSSD domain name as a DNS discovery domain.
- Support for more password expiration policies in LDAP
- 389 Directory Server
- FreeIPA
- ActiveDirectory
- Support for ldap_tls_{cert,key,cipher_suite} config options
-Assorted bugfixes
- Resolves: #967012 - [abrt] sssd-1.9.5-1.fc18: sss_mmap_cache_gr_invalidate_gid:
Process /usr/libexec/sssd/sssd_nss was killed by
signal 11 (SIGSEGV)
- Resolves: #996214 - sssd proxy_child segfault
- Resolves: rhbz#1687281
Rebase sssd in RHEL-8.1 to the latest upstream release
- Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
- Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
- Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working
- Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
- cached password with predicatable filename
- Backport important patches from upstream 1.13 prerelease
- Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
attribute for group name
- Resolves: upstream #2335 - Investigate using the krb5 responder
for driving the PAM conversation with OTPs
- Enable cmocka tests for secondary architectures
- Split internal helper libraries into a shared object
- Significantly reduce disk-space usage
- Resolves: rhbz#1687281
Rebase sssd in RHEL-8.1 to the latest upstream release
-Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
UnknownProperty: Unknown property
- Re-add manpage translations
- Resolves: rhbz#632615 - the krb5 locator plugin isn't packaged for multilib
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Patch SSSDConfig API to address
- https://bugzilla.redhat.com/show_bug.cgi?id=549482
- Fix slow login with ipa and SELinux
- Resolves: upstream #2624 - Only set the selinux context if the context
differs from the local one
for match rules sss-certmap
- Resolves: RHEL-39085 - [RfE] SSSD Failover Enhancements
- Rebuild for new libldb
- Don't duplicate libsss_autofs.so in two packages
- Set explicit package contents instead of globbing
- New upstream release 1.5.3
- Support for libldb >= 1.0.0
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
- Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user
- Change selinux policy requirement to Conflicts: with the old version,
rather than Requires: the supported version.
- New upstream release 0.5.0
- Backport extended NSS API from upstream master branch
- Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
with smart card
- New upstream release 1.9.0 rc1
- Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
- Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
- Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
- Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
- Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
- Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
- Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
- Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
- Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
- Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
- Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
- Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
- Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
- Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
- Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
- Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
- Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
- Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
- Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
- Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
- Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
- Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
- Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
- Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'
- Rebuild against libldb 1.12
- New upstream release 0.6.0
- Fix build with new automake versions
- Add a patch to fix krb5 ccache creation issue with krb5 1.11
- Resolves: rhbz#1431153 - sssd: libsss_proxy.so needs to be linked with -ldl
- Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
the IP address of the machine updated in IPA upon
sssd.service startup
- Rebuilt for Python3.5 rebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Add a patch to fix krb5 unit tests
- New upstream release 0.99.0
- New upstream release 1.14 beta
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0beta
- Apply a couple of patches from upstream git that resolve crashes when
ID mapping object was not initialized properly but needed later
- Make LDB dependency a strict equivalency
- New upstream release 1.12.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.1
- Backport patches with Python3 support from upstream
- Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
commands in man pages since local provider
is deprecated
- Include upstream patch to build with krb5-1.11
- Include couple of patches from upstream 1.11 branch
- Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
Rebuild against Samba rebase.
- Enable hardened build for RHEL7
- Update to 1.16.2 release
- Cleanup unused global definitions
- Remove python2 references from the spec file
- Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x
- Resolves: rhbz#1625842 id_provider= local causes SSSD to abort startup
- Resolves: rhbz#697057 - kpasswd fails when using sssd and
- kadmin server != kdc server
- Upgrades from SysV should now maintain enabled/disabled status
- Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
should not cause files domain entries to be
qualified, this can break sudo access
- Related: rhbz#1611011 - Support for "require smartcard for login option"
- Additional upstream fixes
- Fix double free in monitor
- Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
sssd killed by SIGABRT
- Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
systemd-user service in the account phase in RHEL-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
- Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
- Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
- Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
- Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
- Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
- Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
- Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
- Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
- Resolves: rhbz#2087745 - 2FA prompting setting ineffective
- Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language
- Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
- Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
- Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend
- Backport important patches from upstream 1.14.2 prerelease
- Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
boot
- Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14
- Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
omitted and auth_provider is krb5
- Change default kerberos credential cache location to /run/user/
- Fix failover from Global Catalog to LDAP in case GC is not available
- New upstream release 1.5.8
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
- Support for the LDAP paging control
- Support for multiple DNS servers for name resolution
- Fixes for several group membership bugs
- Fixes for rare crash bugs
- Own several directories create during make install (#839782)
- Move the sss_cache tool to the main package
- New upstream release 1.15.2
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_2.html
- Move sssd_pac to the sssd-krb5 subpackage
- Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
in ding-libs
- Fix SSH integration with fully-qualified domains
- Add the ability to dynamically discover the NetBIOS name
- Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
Rebuild against rebased Samba libs
- Resolves: rhbz#1820574 - [sssd] RHEL 8.3 Tier 0 Localization
- New upstream release 1.5.0
- Fixed issues with LDAP search filters that needed to be escaped
- Add Kerberos FAST support on platforms that support it
- Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
- Added a Kerberos access provider to honor .k5login
- Addressed several thread-safety issues in the sss_client code
- Improved support for delayed online Kerberos auth
- Significantly reduced time between connecting to the network/VPN and
- acquiring a TGT
- Added feature for automatic Kerberos ticket renewal
- Provides the kerberos ticket for long-lived processes or cron jobs
- even when the user logs out
- Added several new features to the LDAP access provider
- Support for 'shadow' access control
- Support for authorizedService access control
- Ability to mix-and-match LDAP access control features
- Added an option for a separate password-change LDAP server for those
- platforms where LDAP referrals are not supported
- Added support for manpage translations
- New upstream release 1.15.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_1.html
- New upstream release 1.12.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3
- Fix spelling errors in description (fedpkg lint)
- Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
- Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
- Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL
- Rebuild sssd against libldb 1.0.2 so the memberof module loads again.
- Related: rhbz#677425
- Log startup errors to the syslog
- Allow cache cleanup to be disabled in sssd.conf
- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
- Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
- Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
- Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
- Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
- Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
- Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)
- require the latest libldb
- Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
users
- Rebuild for libldb 1.1.3
- Rebuild due to rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
- New upstream release 1.9.0 beta 4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
- Add a new AD provider to improve integration with Active Directory 2008 R2
or later servers
- SUDO integration was completely rewritten. The new implementation works
with multiple domains and uses an improved refresh mechanism to download
only the necessary rules
- The IPA authentication provider now supports subdomains
- Fixed regression for setups that were setting default_tkt_enctypes
manually by reverting a previous workaround.
- Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
- Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
- Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
- Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior
error messages with line numbers
- bugfix release 0.3.2
- includes previous release patches
- change permissions of the /etc/sssd/sssd.conf to 0600
- Resolves: rhbz#1615460 - Rebase SSSD to the latest released version
- New upstream release 1.6.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
- Add host access control support for LDAP (similar to pam_host_attr)
- Finer-grained control on principals used with Kerberos (such as for FAST or
- validation)
- Added a new tool sss_cache to allow selective expiring of cached entries
- Added support for LDAP DEREF and ASQ controls
- Added access control features for Novell Directory Server
- FreeIPA dynamic DNS update now checks first to see if an update is needed
- Complete rewrite of the HBAC library
- New libraries: libipa_hbac and libipa_hbac-python
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Fix licenses in sources and on RPMs
- New upstream release 1.10 alpha1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0alpha1
- Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
for D-bus, resulting in a crash
- Rebuild with libldb-1.2.0
- Fix systemd conversion. Upgrades from SysV to systemd weren't properly
- enabling the systemd service.
- Fix a serious memory leak in the memberOf plugin
- Fix an issue where the user's full name would sometimes be removed
- from the cache
- Backport simplification of ccache management from 1.11.1
- Resolves: rhbz#1010553 - sssd setting KRB5CCNAME=(null) on login
- Resolves: rhbz#1382750 - Conflicting default timeout values
- Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"
- Resolves: rhbz#1175511 - sssd-libwbclient conflicts with Samba's and causes
crash in wbinfo
- in addition to the patch libwbclient.so is
filtered out of the Provides list of the package
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
- Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
- Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
- Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
- Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
- Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
- Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
- Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
- Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
- Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
- Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
- Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
- Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
- Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
- Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
- Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
- Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
- Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
- Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
- Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
- Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
- Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
- Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
- Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
- Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
- Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive
- Resolves: rhbz#1448094 - sssd-kcm cannot handle big tickets
- New upstream release 1.11 beta 2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0beta2
- Fix few segfaults
- Resolves: upstream #2811 - PAM responder crashed if user was not set
- Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step
- Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
keyring
- Also apply a patch to fix gating tests issue
- Cherry-pick patches from upstream that enable the files provider
- Enable the files domain
- Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
which is superseded by the files domain autoconfiguration
- Related: rhbz#1357418 - SSSD fast cache for local users
- Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
kdestroy caused by KCM returning a wrong error
code during the delete operation
- Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
username in getpwnam()
- Resolves: rhbz#758425 - LDAP failover not working if server refuses
connections
- Improved handling of users and groups with multi-valued name attributes
(aliases)
- Performance enhancements
Initgroups on RFC2307bis/FreeIPA
HBAC rule processing
- Improved process-hang detection and restarting
- Enabled the midpoint cache refresh by default (fewer cache misses on
commonly-used entries)
- Cleaned up the example configuration
- New tool to change debug level on the fly
- New upstream release 1.12 beta1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0beta1
- fixed items found during review
- added initscript
- Resolves: 1658813 - PKINIT with KCM does not work
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features - fix netgroups and sudo as well
- Fix building pac responder with the krb5-1.14
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization
- Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
- Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
- Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]
- release out of the official 0.3.2 tarball
- Rebuild against new libldb
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
- Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
- Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
- Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
- Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
- Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
- Resolves: RHEL-10721 - very bad performance when requesting service tickets
- Resolves: RHEL-19011 - Invalid handling groups from child domain
- Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]
- Don't discard HBAC rule processing result if SELinux is on
Resolves: rhbz#846792 (CVE-2012-3462)
- New stable upstream version 1.2.0
- Support ServiceGroups for FreeIPA v2 HBAC rules
- Fix long-standing issue with auth_provider = proxy
- Better logging for TLS issues in LDAP
- New upstream release 1.13.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.0
- New upstream release 1.14.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.2
- Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
- Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
- Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11
- Fix ipa-migration bug
- Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
migration mode
- Rebuild against new ding-libs
- Version 0.3.1
- includes previous release patches
- Remove the ability to create public ccachedir (#1015089)
- Fix bug in generation of systemd unit file
- Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
- Fixed "requires/provides" rpmdiff warning
- Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
- Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
- Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
- Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
- Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization
- Move sssd_pac to the sssd-ipa and sssd-ad subpackages
- Trim out RHEL5-specific macros since we don't build on RHEL 5
- Trim out macros for Fedora older than F18
- Update libldb requirement to 1.1.16
- Trim RPM changelog down to the last year
- New upstream release
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
- Support for the service map in NSS
- Support for setting default SELinux user context from FreeIPA
- Support for retrieving SSH user and host keys from LDAP (Experimental)
- Support for caching autofs LDAP requests (Experimental)
- Support for caching SUDO rules (Experimental)
- Fix uninitialized value bug causing crashes throughout the code
- Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup
- Add OSCP checks for p11_child
- Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
users
- Resolves: rhbz#1494002 - sssd_nss crashed in cache_req_search_domains_next
- python-sssdconfig: Fix parssing sssd.conf without config_file_version
- Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed
- Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
done here in order to unblock gating changes before rebase.
- Related: rhbz#1682305
- Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
realm join
- Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
default for AD Provider
- Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
parent directory when logging in
- New upstream stable release 1.0.0
- Switch hardcoded python3 shebangs into the %{__python3} macro
- Version 0.3.0
- Provides file based configuration and lots of improvements
- Resolves: rhbz#1369130 - nss_sss should not link against libpthread
- Resolves: rhbz#1392916 - sssd failes to start after update
- Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
on the directory /etc/sssd
- Rebuild against libldb 1.11
- Fix segfault in sssd_pam when cache_credentials was enabled
- Update the sample configuration
- Fix upgrade issues caused by data provider service removal
- Add support for python3 bindings
- Add requirement to python3 or python3 bindings
- Resolves: rhbz#1014594 - sssd: Support Python 3
- New upstream release 1.9.0 beta 5
- Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
- Many fixes for the support for setting default SELinux user context from
FreeIPA, most notably fixed the specificity evaluation
- Fixed an incorrect default in the krb5_canonicalize option of the AD
provider which was preventing password change operation
- The shadowLastChange attribute value is now correctly updated with the
number of days since the Epoch, not seconds
- Resolves: rhbz#1657980 - sssd_nss memory leak
- Also relax libldb Requires
- Remove --enable-ldb-version-check
- New upstream release 1.10.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.1
- Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
PKCS#11 URI
- New upstream release 1.9.0 beta 2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
- Add support for the Kerberos DIR cache for storing multiple TGTs
automatically
- Major performance enhancement when storing large groups in the cache
- Major performance enhancement when performing initgroups() against Active
Directory
- SSSDConfig data file default locations can now be set during configure for
easier packaging
- New upstream release 1.16.0
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_0.html
- Rebuilt for glibc bug#747377
- Rebuild for Python 3.6
- Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
- Fix release version for upgrades
- New upstream release 1.13.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Add last minute bug fixes, found in testing the package
- Resolves: rhbz#1623878 - crash related to sbus_router_destructor()
- Rebuild against new libldb
- Resolves: rhbz#1652719 - [SECURITY] sssd returns '/' for emtpy home directories
- Fix issue with IPA + SELinux in containers
- Resolves: upstream https://fedorahosted.org/sssd/ticket/3297
- Add support for libldb 1.0.0
- Try to fix build adding automake as an explicit BuildRequire
- Add also a couple of last minute patches from upstream
- Fix systemd executions/requirements
- New upstream release 1.11.4
- Remove upstreamed patch
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.4
- Small cleanup and fixes in the spec file
- BuildRequire recent libini_config to ensure consistent behaviour
- added sss_client
- New upstream release 1.13.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.3
- New upstream release 1.13 alpha
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.0alpha
- Resolves: RHEL-112455 - p11_child currently has an infinite timeout [rhel-8.10.z]
- Resolves: RHEL-120292 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-8.10.z]
- Fix potential crash with external groups in trusted IPA-AD setup
- Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
without a password. (Patch by Stephen Gallagher)
- Resolves: rhbz#1736265 - Smart Card auth of local user: endless
loop if wrong PIN was provided
- Resolves: rhbz#2149241 - [sssd] SSSD enters failed state after heavy load in the system
- Resolves: rhbz#1642372 - SSSD Python getgrouplist API was removed but required for IPA
- Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
- Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
- Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
- Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1
- Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files (additional patch)
- Ensure that SSSD builds against libldb-1.0.0 on F15 and later
- Remove .la for memberOf
- Fix CVE-2010-0014
- Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
- Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
- Resolves: rhbz#1893159 - Default debug level should report all errors / failures
- Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication
- Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently
- New upstream release 1.12.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0
- Resolves: rhbz#1718193 - p11_child should have an option to skip
C_WaitForSlotEvent if the PKCS#11 module
does not implement it properly
- Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied
- New upstream release 1.8.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
- Several fixes to case-insensitive domain functions
- Fix for GSSAPI binds when the keytab contains unrelated principals
- Fixed several segfaults
- Workarounds added for LDAP servers with unreadable RootDSE
- SSH knownhostproxy will no longer enter an infinite loop preventing login
- The provided SYSV init script now starts SSSD earlier at startup and stops
it later during shutdown
- Assorted minor fixes for issues discovered by static analysis tools
- Resolve groups from AD correctly
- Restore Requires: cyrus-sasl-gssapi as it is not auto-detected during
- rpmbuild
- Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
not FIPS140 compliant
- Fixes link error on platforms that do not do implicit linking
- Fixes double-free segfault in PAM
- Fixes double-free error in async resolver
- Fixes support for TCP-based DNS lookups in async resolver
- Fixes memory alignment issues on ARM processors
- Manpage fixes
- Resolves: upstream#3529 - sssd-kcm Fix restart during/after upgrade
- Resolves: upstream#3621 - backport bug found by static analyzers
- Fix building on rawhide. Remove -Wl,-z,defs from LDFLAGS
- Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
no members
- New upstream release 1.5.11
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
- Fix a serious regression that prevented SSSD from working with ldaps:// URIs
- IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
- address being saved to the AAAA record
- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
- Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
- Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
- Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
- Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
- Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed
- Resolves: rhbz#1628122 - Printing incorrect information about domain
with sssctl utility
- Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
fails with the KCM ccache
- New upstream release 1.16.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_1.html
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Resolves: rhbz#1673443 - sssd man pages: The default value of
"ldap_user_home_directory" is not mentioned
with AD server configuration
- New upstream release 1.9.1
- Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
- Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
- Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)
- Fix multicast checks in the SSSD
- Resolves: rhbz#1007475 - The multicast check is wrong in the sudo source
code getting the host info
- New upstream release 1.11.3
- Remove upstreamed patches
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.3
- Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
- Resolves: rhbz#1915395 - Memory leak in the simple access provider
- Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
- Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)
- Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
started due to a misconfiguration
- Release candidate for SSSD 1.1
- Add simple access provider
- Create subpackages for libcollection, libini_config, libdhash and librefarray
- Support IPv6
- Support LDAP referrals
- Fix cache issues
- Better feedback from PAM when offline
- Add workaround patch for RHBZ #1366403
- Do not write out dots in the domain-realm mapping file (#905650)
- Fix the Kerberos password expiration warning (#912223)
- Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
- Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
- Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]
- Version 0.2.0
- Add SSSDConfig API
- Update polish translation for 0.6.0
- Fix long timeout on ldap operation
- Make dp requests more robust
- New upstream release 1.12.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.2
- Fix several regressions since 1.5.x
- Ensure that the RPM creates the /var/lib/sss/mc directory
- Add support for Netscape password warning expiration control
- Rebuild against libldb 1.1.6
- Related: rhbz#1637513 - sssd crashes when refreshing expired sudo rules
- Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
the trailing colon
- Fix changelog dates to make F19 rpmbuild happy
-Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
subdomain service name being used
- Fix libwbclient alternatives
- Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
- Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
- Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
- Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
- Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
- Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
- Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
- Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
- Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
- Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
- Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
- Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
- Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
- Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
- Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
- Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
- Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
- Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate
- Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
- Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
- Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently
- New upstream release 1.5.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
- Fixes for Active Directory when not all users and groups have POSIX attributes
- Fixes for handling users and groups that have name aliases (aliases are ignored)
- Fix group memberships after initgroups in the IPA provider
- New upstream release 1.11.5
- Remove upstreamed patch
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5
- Fix regressions with ipa and SELinux
- Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
context on client is staff_u
- Do not crash on resolving a group SID in IPA server mode
- Apply a number of patches from upstream to fix issues found 1.12.3
- Resolves: rhbz#1176373 - dyndns_iface does not accept multiple
interfaces, or isn't documented to be able to
- Resolves: rhbz#988068 - getpwnam_r fails for non-existing users when sssd is
not running
- Resolves: upstream #2557 authentication failure with user from AD
- Fix tests on big-endian
- Fix previous changelog entry
- New upstream release 1.9.0 beta 3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
- Add a new PAC responder for dealing with cross-realm Kerberos trusts
- Terminate idle connections to the NSS and PAM responders
- Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
/usr/libexec/sssd/sssd_be killed by 11 crash
func _dbus_list_unlink
- Fix %postun
- New upstream release 1.8.1
- Resolve issue where we could enter an infinite loop trying to connect to an
auth server
- Fix serious issue with complex (3+ levels) nested groups
- Fix netgroup support for case-insensitivity and aliases
- Fix serious issue with lookup bundling resulting in requests never
completing
- IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
in addition to pam_authenticate
- Fix several regressions in the proxy provider
- Resolves: rhbz#743133 - Performance regression with Kerberos authentication
against AD
- Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work
- Fix a couple of segfaults that may happen on reload
- Fix OTP bug
- Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
entered separately
- Fix missing file permissions for sssd-clients
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Recreate Kerberos ccache directory if it's missing
- Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
directory /run/user/UID/ccdir does not exist
- New upstream release 1.9.3
- Resolves: rhbz#626205 - Unable to unlock screen
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
- Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization
- Initial release (based on version 0.1.0 upstream code)
- New upstream release 1.11.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.1
- New upstream release 1.12 beta2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0beta2
- libwbclient-sssd: update interface to version 0.13
- Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
1.x, this can result in time outs
- Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
searching in local cache database access on
the sock_file system_bus_socket
- Bump up release number to avoid library sub-packages version issues with
previous releases.
- Ensure that the configuration upgrade script always writes the config
file with 0600 permissions
- Eliminate an infinite loop in group enumerations
- Backport upstream patches required by FreeIPA 4.2.1
- Fix accidental disabling of the DIR cache support
- Resolves: upstream#3684 - A group is not updated if its member is removed
with the cleanup task, but the group does not
change
- Resolves: upstream#3558 - sudo: report error when two rules share cn
- Tone down shutdown messages for socket activated responders
- IPA: Qualify the externalUser sudo attribute
- Resolves: upstream#3550 - refresh_expired_interval does not work with
netgrous in 1.15
- Resolves: upstream#3402 - Support alternative sources for the files provider
- Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
- Resolves: upstream#3679 - Make nss netgroup requests more robust
- Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
configured
- Resolves: upstream#3469 - extend sss-certmap man page regarding priority
processing
- Improve docs/debug message about GC detection
- Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
list out of bound?
- Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
set.
- Document which principal does the AD provider use
- Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
defined, but contains no SIDs
- Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
- Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
Provider returned an error
[org.freedesktop.sssd.Error.DataProvider.Fatal]
- New upstream release 1.11.2
- Remove upstreamed patches
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2
- New upstream release 1.15.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.15.0
- New upstream release 1.5.9
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
- Support for overriding home directory, shell and primary GID locally
- Properly honor TTL values from SRV record lookups
- Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
- servers)
- Properly escape IPv6 addresses in the failover code
- Do not crash if inotify fails (e.g. resource exhaustion)
- Don't add multiple TGT renewal callbacks (too many log messages)
- Fix typo in Requires that prevented an upgrade (#973916)
- Use a hardcoded version in Conflicts, not less-than-current
- New upstream release 1.8.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
- Numerous manpage and translation updates
- LDAP: Handle situations where the RootDSE isn't available anonymously
- LDAP: Fix regression for users using non-standard LDAP attributes for user
information
- Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
- Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
- Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)
- Handle OTP response from FreeIPA server gracefully
- Resolves: rhbz#1283798 - sssd failover does not work on connecting to
non-responsive ldaps:// server
- Handle new error code for IPA password migration
- Resolves: rhbz#677768 - name service caches names, so id command shows
- recently deleted users
- Backport several patches from upstream.
- Fix a potential crash against old (pre-4.0) IPA servers
- Resolves: upstream#3573 - sssd won't show netgroups with blank domain
- Resolves: upstream#3660 - confdb_expand_app_domains() always fails
- Resolves: upstream#3658 - Application domain is not interpreted correctly
- Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
json_loads()
- Resolves: upstream#3386 - KCM: Payload buffer is too small
- Resolves: upstream#3666 - Fix usage of str.decode() in our tests
- A few KCM misc fixes
- New upstream release 1.13.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.1
python3-yubico-1.3.2-9.1.module+el8.9.0+1372+09f67869.noarch.rpm | - Add python3-pyusb dependency to python3 subpackage (#1278210)
- Backport an upstream python3 fix (#1484862)
- Ship COPYING as %license where applicable
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt to fix NVR issue (#2097803)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Conditionalize the python2 subpackage
- Cleanup obsolete conditions (like RHEL 6)
- Update to v1.3.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Add missing provide for python-yubico
- Add missing obsoletes for python-yubico
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Add Python 3 subpackage (#1244237)
- Rebuild for Python 3.6
- Enable build on EL6.
- Upstream 1.2.3
- Require pyusb during building when running tests
- Initial release.
- Run upstream tests during build.
qt5-qtbase-5.15.3-8.el8_10.x86_64.rpm | - own /etc/xdg/QtProject
- Requires: qt-settings (f22+)
- macros.qt5: fix %_qt5_headerdir, %_qt5_datadir, %_qt5_plugindir
- Fix build on RHEL 7 kernel
Resolves: bz#1733135
- bz#1328659, load openssl libs dynamically
- fix build failure on secondary arch
- Build against system xkb and openssl 1.1
Resolves: bz#1882375
- drop BR: cmake (handled by qt5-rpm-macros now)
- Fix specific overflow in qtextlayout
- Fix incorrect parsing of the strict-transport-security (HSTS) header
- Fix buffer over-read via a crafted reply from a DNS server
Resolves: bz#2209491
- fix Source0: https://download.qt.io/official_releases/qt/5.9/5.9.0/submodules/qtbase-opensource-src-5.9.0.tar.xz
- disable bootstrap again
- Enable bootstrap to first import on rawhide
- Fix build failure with glibc
- %build: -accessibility
- macros.qt5: +%_qt5_archdatadir +%_qt5_settingsdir
- pull in a couple more configure-related upstream patches
- Rebuild for platform-python
- revert out-of-tree build, breaks Qt5*Config.cmake *_PRIVATE_INCLUDE_DIRS entries (all blank)
- Do not require qt-settings package
- -devel: Requires: pkgconfig(egl)
- de-bootstrap
- make -doc arch'd (workaround bug #1437522)
- F20: require libxkbcommon >= 0.4.1, only patch for the old libxcb
- rebuild
- %build: hack around 'make docs' failures (on f22+)
- use %make_build, %ldconfig
- drop %_licensedir hack
- HTTP2: Delay any communication until encrypted() can be responded to
Resolves: RHEL-46340
- qt5-qdoc need requires >= current version, otherwise will prevent the usage further when moved to qttools
- make 10-qt5-check-opengl2.sh xinit script more robust
- enable journald support for el7+ (#1315239)
- rebuild for ICU 56.1
- workaround moc/qconfig-multilib issues (#1290020,QTBUG-49972)
- add versioned Requires: libxkbcommon dep
- do a normal build with docs
- restore font rendering patch (#1052389,QTBUG-41590)
- qt5-qtbase: RPM build flags only partially injected (#1543888)
- 5.0.2
- fix cmake config (#929227)
- Qt5 application crashes when connecting/disconnecting displays (#1083664)
- 5.0.1
- lowmem patch for %arm, s390
- -common: Obsoletes: qt5-qtquick1(-devel)
- respin QTBUG-51767 patch
- full build
- Update tarball with https://bugreports.qt.io/browse/QTBUG-50703 fix
- Really debootstrap :-P
- When a screen comes back online, the windows need to be told about it (QTBUG-47041)
- xcb: Ignore disabling of outputs in the middle of the mode switch
- -docs: BuildRequires: qt5-qhelpgenerator
- Disable bootstrap
- 5.12.5 + sync with Fedora
Resolves: bz#1733135
- Bad font rendering (#1052389,QTBUG-41590)
- bootstrap for libicu bump
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- backport 5.8 patch for wayland crasher (#1403500,QTBUG-55583)
- add condition for rhel
- add support for firebird-3.x
- pull in handful of upstream fixes, particularly...
- Fix a division by zero when processing malformed BMP files (QTBUG-44547, CVE-2015-0295)
- crashes when connecting/disconnecting displays (#1083664,QTBUG-42985)
- Some Qt apps crash if they are compiled with gcc5 (QTBUG-45755)
- qconfig.pri: +alsa +kms +pulseaudio +xcb-sm
- more cmake_path love (#929227)
- ship $$[QT_INSTALL_DATA]/qtlogging.ini for packaged logging defaults (#1227295)
- DoS vulnerability in the GIF image handler (QTBUG-38367)
- qt5-rpm-macros pkg
- aarch64 is secondary arch too
- ppc64le is NOT multilib
- Fix Power 64 macro use
- Qt 5.5 RC 1
- fix build failure on big endian platform (ppc64,s390x)
- limit -reduce-relocations to %ix86 x86_64 archs (QTBUG-36129)
- create/own %{_qt5_plugindir}/iconengines
- -devel: create/own %{_qt5_archdatadir}/mkspecs/modules
- cleanup .prl
- 5.9.1
- don't omit examples for bootstrap (needs work)
- fix build issue with gcc6
- Perl 5.18 rebuild
- QWidget::setWindowRole does nothing (QTBUG-45484)
- fixed bz#1442553, multilib issue
- rebuild
- Non-bootstrapped build
- -dbus=runtime on el6 (#1196359)
- %build: -no-directfb
- Crash due to unsafe access to QTextLayout::lineCount (#1207279,QTBUG-43562)
- own %{_qt5_plugindir}/{designer,iconengines,script,styles}
- Fix out-of-bounds write in QOutlineMapper::convertPath
Resolves: bz#1996877
- introduce macros.qt5-qtbase (for %_qt5, %_qt5_epoch, %_qt5_version, %_qt5_evr)
- 5.2.0-rc1
- revert/omit recent egl packaging changes
- -doc install changes-5.* files here (#989149)
- -doc subpkg (not enabled)
- enable %check
- Try to ensure that -fPIC is used in CMake builds (QTBUG-45755)
- %build: -system-pcre, BR: pkgconfig(libpcre)
- use -O1 optimization on lowmem (s390) arch
- Enable EGL support
- enable qtchooser support
- Upstream Release Candidate 1
- adapted the berolinux's patch for new openssl-1.1.x
- fix %pre scriptlet
- QFileDialog: implement getOpenFileUrl and friends for real
- -system-libxkbcommon (f21+)
- rebase to latest SM patches (QTBUG-45484, QTBUG-46310)
- %build: restore -dbus-linked
- namespace QT_VERSION_CHECK to workaround major/minor being pre-defined (#1396755)
- update moc patch to define _SYS_SYSMACROS_H (#1396755)
- build: ./configure -journal (f24+)
- Prepare 5.7
- Move macros package away from qtbase. Now is called qt5-rpm-macros
- macros.qt5: we really only want the null-pointer-checks flag here
and definitely no arch-specific ones
- disable -docs (for ppc bootstrap mostly)
- fix QTBUG-35459 (too low entityCharacterLimit=1024 for CVE-2013-4549)
- fix QTBUG-35460 (error message for CVE-2013-4549 is misspelled)
- reenable docs on Fedora (accidentally disabled)
- BR: pkgconfig(libudev) pkgconfig(xkbcommon) pkgconfig(xcb-xkb)
- add qtchooser support (disabled by default)
- Fix CVE-2024-25580: potential buffer overflow when reading KTX images
Resolves: RHEL-25725
- remove GDB hackery again, -12 built fine on i686, hack breaks ARM build
- fix 10-qt5-check-opengl2.sh for multiple screens (#1245755)
- support the old versions of libxcb and libxkbcommon in F19 and F20
- don't use the bundled libxkbcommon
- Perl 5.18 rebuild
- New upstream version
- macros.qt5: fix %qt5_ldflags macro
- Official beta release
- use upstream commit/fix for QTBUG-46310
- restore qdoc/gdb hackery, i686 still needs it :(
- 5.15.2 + sync with Fedora
Resolves: bz#1930040
- 5.9.3
- Debootstrap
- Use meta doctools package to build docs
- undefine QMAKE_STRIP (and friends), so we get useful -debuginfo pkgs (#1065636)
- Integrate rc releases now.
- backport: data corruption in QNetworkAccessManager
- refresh mariadb patch to actually match cr#206850 logic (#1491316)
- Create a tests subpkg with unit tests for gating
Resolves: bz#1681889
- Update for official RC1 released packages
- qtbase --> qt5-qtbase
- create_cmake.prf: adjust CMAKE_NO_PRIVATE_INCLUDES (#1456211,QTBUG-37417)
- Start to implement 5.6.0 beta
- try harder to avoid doc/multilib conflicts (#1212750)
- bootstrap (rawhide)
- revert some minor changes introduced since 5.7
- move *Plugin.cmake items to runtime (not -devel)
- macros.qt5: +%qmake_qt5 , to help set standard build flags (CFLAGS, etc...)
- macros.qt5: use newer location, use unexpanded macros
- fix/update Release: 1%{?dist}
- 5.4.0-beta
- avoid extra -devel deps by moving *Plugin.cmake files to base pkgs
- support bootstrap macro, to disable -doc,-examples
- bz#1518958, backport to fix out of bounds reads in qdnslookup_unix
- qt5-qdoc subpkg
- Install changes-5.x.y file (#989149)
- -gui: don't require gtk2 (__requires_exclude_from platformthemes) (#1154884)
- use qdoc.gdb wrapper
- pull in slightly different upstreamed font rendering fix (#1052389,QTBUG-41590)
- 5.15.3 + sync with Fedora
Resolves: bz#2061377
Resolves: bz#2059853
- macros.qt5: null-pointer-checks flag isn't c++-specific
- rebuild for ICU 53.1
- disable openssl11 (for now, FTBFS), use -openssl-linked (bug #1401459)
- BR: perl-generators
- -Wno-deprecated-declarations (typo missed trailing 's')
- include recommended qtdbus patches, fix Release
- 5.2.1
- first try
- We're back to gold linker
- Remove reduce relocations
- Second round of builds now with bootstrap enabled due new qttools
- use '#!/usr/bin/perl' instead of '#!/usr/bin/env perl'
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- needs a minimum version on sqlite build dependency (#1038617)
- fix build when doc macro not defined
- 5.7.1 dec5 snapshot
- No more docs, no more bootstrap. Docs comes now on a single package.
- Shortcuts with KeypadModifier not working (QTBUG-33093,#1219173)
- 5.2.0
- Rebuild to fix CET notes
Resolves: bz#1657206
- candidate fixes for various QtDBus deadlocks (QTBUG-51648,QTBUG-51676)
- re-introduce bootstrap/examples macros
- put examples-manifest.xml in -examples
- restore -doc multilib hack (to be on the safe side, can't hurt)
- %build: s/-optimized-qmake/-optimized-tools/
- -devel: qtsql apparently wants all drivers available at buildtime
- try reverting from -optimized-tools to -optimized-qmake
- full build
- Update to 5.11.1
- Rebuild for ICU 60.1
- drop gcc6 workaround on arm
- qt5-qtbase-5.3.0-2.fc21 breaks keyboard input (#1100213)
- add poll support, thanks to fweimer@redhat.com (QTBUG-27195)
- ExcludeArch: ppc64 ppc (#1005482)
- Remove Android specific test to avoid unnecessary dependencies
Resolves: bz#1733135
- Official beta release
- Update to Qt 5.5.1 RC1
- Patchs 13, 52, 53, 101, 155, 223, 297 removed due to inclusion upstream
- Update proper tarball. Need avoid the fix branch
- -no-use-gold-linker (f22+, #1193044)
- Fix infinite loops in QXmlStreamReader (CVE-2023-38197)
Resolves: bz#2222770
- 5.3.2
- use software OpenGL (llvmpipe) if the hardware driver doesn't support OpenGL 2
- actually apply mariadb-related patch (#1491316)
- qt5-qtbase: RPM build flags only partially injected (#1543888)
- enable bootstrap (and disable failing docs)
- enable openssl11 support only for f27+ (for now)
- Use mariadb-connector-c-devel, f28+ (#1493909)
- Backport upstream mariadb patch (#1491316)
- pass QMAKE_*_RELEASE to configure to ensure optflags get used (#1505260)
- Valgrind still needed as buildreq due recent split qdoc package, but we can get rid of
specific arch set.
- Added missing libproxy buildreq
- Epel and RHEL doesn't have libinput, so a plugin need to be excluded for this distros
- better %rpm_macros_dir handling
- categoried logging for xcb entries (#1497564, QTBUG-55167)
- Attempt not to hardcode ABI-tag for specific kernel version
Resolves: bz#1612434
- added privat headers for Qt5 Xcb
- backport "crash on start if system bus is not available" (QTBUG-51299)
- 5.4.0 (final)
- OpenSSL: handle SSL_shutdown's errors properly
Resolves: bz#1851538
- Fixes #1005482 - qtbase FTBFS on ppc/ppc64
- add macros qtwebengine_arches in qt5
- port qtdbusconnection_no_debug.patch from qt(4)
- add rpm macros qtwebengine_arches for qtwebengine
- pull in another upstream moc fix/improvement (#1290020,QTBUG-49972)
- fix bootstrap/docs
- 2013-11-08_141 snapshot, arm switch qreal double
- Don't allow remote attacker to bypass security restrictions caused by
flaw in certificate validation (CVE-2023-34410)
Resolves: bz#2212753
- refresh mariadb patch wrt cr#206850 (#1491316)
- Item views don't handle insert/remove of rows robustly (QTBUG-48870)
- refresh mariadb patch support (upstreamed version apparently incomplete)
- respin QTBUG-51649 patch
- %build: use -dbus-runtime unconditionally
- drop (unused) build deps: atspi, dbus, networkmanager
- qtlogging.ini: remove comments
- Qt 5.7.0 release
- fix bootstrapping logic
- fixed bz#1401459, backport openssl-1.1 support
- move sql build deps into subpkg sections
- macro'ize ibase,tds support (disabled on rhel)
- support out-of-tree build
- better %check
- pull in final/upstream fixes for QTBUG-51648,QTBUG-51649
- disable examples/tests in bootstrap mode
- 5.10.1
- Compiled with gcc
- Beta 3
- Reintroduce xcb patch from https://codereview.qt-project.org/#/c/138201/
- Rebuild against new openssl
- Drop apache2 test server from unit tests to drop perl(CGI) dependency
Resolves: bz#1930040
- QMimeType: remove unwanted *.bin as preferredSuffix for octet-stream (fdo#101667,kde#382437)
- pull in upstream drag-n-drop related fixes (QTBUG-45812, QTBUG-51215)
- qt5-base-devel.x86_64 qt5-base-devel.i686 file conflict qconfig.h (#1036956)
- enable patch to track private api
- Rebuild (binutils)
Resolves: bz#1930040
- QListView upstream regression (#1509649, QTBUG-63846)
- 5.6.0-beta (final)
- 5.3.0
- Crash in QXcbWindow::setParent() due to NULL xcbScreen (QTBUG-50081, #1291003)
- Upstream Release Candidate retagged
- unconditionally undo valgrind hack when done (#1255054)
- full build after ICU soname bump
- full rebuild for hunspell 1.4.0
- remove GDB hackery, it is not producing useful backtraces for the ARM crash
- reenable documentation
- support ppc64le multilib (#1080629)
- -static subpkg, Requires: fontconfig-devel,glib2-devel,zlib-devel
- -devel: Requires: pkgconfig(gl)
- SM_CLIENT_ID property is not set (QTBUG-46310)
- Add mesa-dri-drivers as recommends on gui package as reported by Kevin Kofler
- Reference https://bugzilla.redhat.com/1249280
- enable -doc only on primary archs (allow secondary bootstrap)
- readd plugin __requires_exclude_from filter, it is still needed
- update moc patch to define _SYS_SYSMACROS_H_OUTER instead (#1396755)
- backport a couple more upstream fixes
- introduce -common noarch subpkg, should help multilib issues
- 5.0-rc2
- initial try at putting non-conflicting binaries in %_bindir
- 5.0-rc1
- Update to 5.4.2
- 5.4.0-rc
- fixed build issue with new mariadb
- Debootstrap after tools built. New tool needed qtattributionsscanner
- Fix buffer overflow in XBM parser
Resolves: bz#1870364
- fix build issue with gcc6
- fix check for alsa 1.1.x
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild
- Escape macros in %changelog
- backport 0055-Respect-manual-set-icon-themes.patch (kde#344469)
- conditionally use valgrind only if needed
- re-enable gold linker (#1458003)
- drop qt5_null_flag/qt5_deprecated_flag hacks (should be fixed upstream for awhile)
- make qt_settings/journald support unconditional
- Unify firebird patch for both versions
- Bootstrap again for copr
- Rebuild with binutils fix for ppc64le (#1475636)
- %ix86: build -no-sse2 (#1103185)
- Get rid of valgrind hack. It sort out that we don't need it anymore (#1211203)
- 5.2.0-beta1
- enable (non-conflicting) qtchooser support
- track private api use via properly versioned symbols (unused for now)
- pull in set of upstream Qt 5.5 fixes and improvements for XCB screen handling rebased to 5.4
- Fix incorrect integer overflow check in HTTP2 implementation
Resolves: RHEL-20238
- 5.9.2
- really apply QT_VERSION_CHECK workaround (#1396755)
- macros.qt5: cleanup, %_qt5_cflags, %_qt5_cxxflags (for f24+)
- try bootstrap=1 (f23)
- rebuild for ICU 57.1
- 5.3.1
- unconditionally enable freetype lcd_filter
- (temp) disable docs (libxcb bootstrap)
- 5.1.1
- Move libQt5EglFSDeviceIntegration lib out of the -devel subpkg
Resolves: bz#1692970
- Fix QImage allocaion failure
Resolve: bz#1667860
- Fix double free in QXmlStreamReader
Resolve: bz#1667858
- Fix segmentation fault on malformed BMP file
Resolve: bz#1667859
- 5.0.2-rc1
- fixed bz#1409600, stack overflow in QXmlSimpleReader, CVE-2016-10040
- bootstrap rebuild for hunspell 1.4.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- BR: pkgconfig(xcb-xkb) > 1.10 (f21+)
- allow possibility for libxkbcommon-0.4.x only
- Requires: openssl-libs%{?_isa} (#1328659)
- unable to use input methods in ibus-1.5.10 (#1203575)
- Broken window scaling (#1381828)
- Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
Resolves: bz#1814739
Resolves: bz#1814683
- Fix: XML entity expansion vulnerability
Resolves: bz#1822193
- filter plugin provides, drop filter plugin excludes (no longer needed)
- -devel: Provides: qt5-qtbase-private-devel (#1233829)
- -devel: Requires: redhat-rpm-config (#1248174)
- build with and add to macros.qt5 flags: -fno-delete-null-pointer-checks
- full build
- 5.2.0-alpha
- -system-harfbuzz
- rename subpkg -x11 => -gui
- move some gui-related plugins base => -gui
- don't use symlinks in %_qt5_bindir (more qtchooser-friendly)
- 5.6.0 release
- rebase the lowmem patch
- own %{_qt5_plugindir}/egldeviceintegrations
- qt5-qtbase-static missing dependencies (#1311311)
- pull in upstream gcc-4.8.0 buildfix
- workaround gold linker issue with duplicate symbols (f27+, #1458003)
- pull upstream patches (upstreamed versions, gcc6-related bits mostly)
- add better fix for compile error on big endian
- drop 5.5 XCB patches, the rebase is incomplete and does not work properly with Qt 5.4
- fix the allow-forcing-llvmpipe patch to patch actual caller of __glXInitialize
- -examples subpkg
- Upstream official release
- drop disconnect_displays.patch so we can better test latest xcb/display work
- restore previously dropped patches
- Multiple Vulnerabilities in Qt Image Format Handling (CVE-2015-1860 CVE-2015-1859 CVE-2015-1858)
- use linux-g++ platform unconditionally
- use valgrind to debug qdoc HTML generation
- Update to final release 5.5.1
- update to 5.4.1
- (re)enable -docs
- Fix build on MIPS (#1322537)
- drop BR: valgrind (not used, for awhile)
- Don't allow remote attacker to bypass security restrictions caused by
flaw in certificate validation (CVE-2023-34410) (version #2)
Resolves: bz#2212753
- Beta 3 release
- workaround 'make docs' crasher on el6 (QTBUG-43057)
- enable -qt-xcb to fix non-US keys under VNC (#1295713)
- rebuild for ICU 54.1
- Prefer QPA implementation in qsystemtrayicon_x11 if available
- drop dep on xorg-x11-xinit (own shared dirs instead)
- fix/improve qtchooser support using alternatives (#1122316)
- respin lowmem patch to apply (unconditionally) to gcc-4.7.2 too
- 5.0 (final)
- 5.10.0
- Bump for rebuild.
- ship /etc/xdg/qtchooser/5.conf alternative instead (of qt5.conf)
- make the QMAKE_STRIP sed not sensitive to whitespace (see #1074041 in Qt 4)
- -examples: include %{_qt5_docdir}/qdoc/examples-manifest.xml (#1212750)
- Update to final RC
- sync latest xcb/screen/display related upstream commits
- Initial update for 5.8.0
- QOpenGLShaderProgram: glProgramBinary() resulting in LINK_STATUS=FALSE not handled properly (QTBUG-66420)
- restore moc_system_defines.patch lost in 5.7.0 rebase
- +%_qt5_libexecdir
- fix %_qt5_examplesdir macro
- fix big endian builds
- don't inject $RPM_OPT_FLAGS/$RPM_LD_FLAGS into qmake defaults f24+ (#1279265)
qt5-qtbase-common-5.15.3-8.el8_10.noarch.rpm | - own /etc/xdg/QtProject
- Requires: qt-settings (f22+)
- macros.qt5: fix %_qt5_headerdir, %_qt5_datadir, %_qt5_plugindir
- Fix build on RHEL 7 kernel
Resolves: bz#1733135
- bz#1328659, load openssl libs dynamically
- fix build failure on secondary arch
- Build against system xkb and openssl 1.1
Resolves: bz#1882375
- drop BR: cmake (handled by qt5-rpm-macros now)
- Fix specific overflow in qtextlayout
- Fix incorrect parsing of the strict-transport-security (HSTS) header
- Fix buffer over-read via a crafted reply from a DNS server
Resolves: bz#2209491
- fix Source0: https://download.qt.io/official_releases/qt/5.9/5.9.0/submodules/qtbase-opensource-src-5.9.0.tar.xz
- disable bootstrap again
- Enable bootstrap to first import on rawhide
- Fix build failure with glibc
- %build: -accessibility
- macros.qt5: +%_qt5_archdatadir +%_qt5_settingsdir
- pull in a couple more configure-related upstream patches
- Rebuild for platform-python
- revert out-of-tree build, breaks Qt5*Config.cmake *_PRIVATE_INCLUDE_DIRS entries (all blank)
- Do not require qt-settings package
- -devel: Requires: pkgconfig(egl)
- de-bootstrap
- make -doc arch'd (workaround bug #1437522)
- F20: require libxkbcommon >= 0.4.1, only patch for the old libxcb
- rebuild
- %build: hack around 'make docs' failures (on f22+)
- use %make_build, %ldconfig
- drop %_licensedir hack
- HTTP2: Delay any communication until encrypted() can be responded to
Resolves: RHEL-46340
- qt5-qdoc need requires >= current version, otherwise will prevent the usage further when moved to qttools
- make 10-qt5-check-opengl2.sh xinit script more robust
- enable journald support for el7+ (#1315239)
- rebuild for ICU 56.1
- workaround moc/qconfig-multilib issues (#1290020,QTBUG-49972)
- add versioned Requires: libxkbcommon dep
- do a normal build with docs
- restore font rendering patch (#1052389,QTBUG-41590)
- qt5-qtbase: RPM build flags only partially injected (#1543888)
- 5.0.2
- fix cmake config (#929227)
- Qt5 application crashes when connecting/disconnecting displays (#1083664)
- 5.0.1
- lowmem patch for %arm, s390
- -common: Obsoletes: qt5-qtquick1(-devel)
- respin QTBUG-51767 patch
- full build
- Update tarball with https://bugreports.qt.io/browse/QTBUG-50703 fix
- Really debootstrap :-P
- When a screen comes back online, the windows need to be told about it (QTBUG-47041)
- xcb: Ignore disabling of outputs in the middle of the mode switch
- -docs: BuildRequires: qt5-qhelpgenerator
- Disable bootstrap
- 5.12.5 + sync with Fedora
Resolves: bz#1733135
- Bad font rendering (#1052389,QTBUG-41590)
- bootstrap for libicu bump
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- backport 5.8 patch for wayland crasher (#1403500,QTBUG-55583)
- add condition for rhel
- add support for firebird-3.x
- pull in handful of upstream fixes, particularly...
- Fix a division by zero when processing malformed BMP files (QTBUG-44547, CVE-2015-0295)
- crashes when connecting/disconnecting displays (#1083664,QTBUG-42985)
- Some Qt apps crash if they are compiled with gcc5 (QTBUG-45755)
- qconfig.pri: +alsa +kms +pulseaudio +xcb-sm
- more cmake_path love (#929227)
- ship $$[QT_INSTALL_DATA]/qtlogging.ini for packaged logging defaults (#1227295)
- DoS vulnerability in the GIF image handler (QTBUG-38367)
- qt5-rpm-macros pkg
- aarch64 is secondary arch too
- ppc64le is NOT multilib
- Fix Power 64 macro use
- Qt 5.5 RC 1
- fix build failure on big endian platform (ppc64,s390x)
- limit -reduce-relocations to %ix86 x86_64 archs (QTBUG-36129)
- create/own %{_qt5_plugindir}/iconengines
- -devel: create/own %{_qt5_archdatadir}/mkspecs/modules
- cleanup .prl
- 5.9.1
- don't omit examples for bootstrap (needs work)
- fix build issue with gcc6
- Perl 5.18 rebuild
- QWidget::setWindowRole does nothing (QTBUG-45484)
- fixed bz#1442553, multilib issue
- rebuild
- Non-bootstrapped build
- -dbus=runtime on el6 (#1196359)
- %build: -no-directfb
- Crash due to unsafe access to QTextLayout::lineCount (#1207279,QTBUG-43562)
- own %{_qt5_plugindir}/{designer,iconengines,script,styles}
- Fix out-of-bounds write in QOutlineMapper::convertPath
Resolves: bz#1996877
- introduce macros.qt5-qtbase (for %_qt5, %_qt5_epoch, %_qt5_version, %_qt5_evr)
- 5.2.0-rc1
- revert/omit recent egl packaging changes
- -doc install changes-5.* files here (#989149)
- -doc subpkg (not enabled)
- enable %check
- Try to ensure that -fPIC is used in CMake builds (QTBUG-45755)
- %build: -system-pcre, BR: pkgconfig(libpcre)
- use -O1 optimization on lowmem (s390) arch
- Enable EGL support
- enable qtchooser support
- Upstream Release Candidate 1
- adapted the berolinux's patch for new openssl-1.1.x
- fix %pre scriptlet
- QFileDialog: implement getOpenFileUrl and friends for real
- -system-libxkbcommon (f21+)
- rebase to latest SM patches (QTBUG-45484, QTBUG-46310)
- %build: restore -dbus-linked
- namespace QT_VERSION_CHECK to workaround major/minor being pre-defined (#1396755)
- update moc patch to define _SYS_SYSMACROS_H (#1396755)
- build: ./configure -journal (f24+)
- Prepare 5.7
- Move macros package away from qtbase. Now is called qt5-rpm-macros
- macros.qt5: we really only want the null-pointer-checks flag here
and definitely no arch-specific ones
- disable -docs (for ppc bootstrap mostly)
- fix QTBUG-35459 (too low entityCharacterLimit=1024 for CVE-2013-4549)
- fix QTBUG-35460 (error message for CVE-2013-4549 is misspelled)
- reenable docs on Fedora (accidentally disabled)
- BR: pkgconfig(libudev) pkgconfig(xkbcommon) pkgconfig(xcb-xkb)
- add qtchooser support (disabled by default)
- Fix CVE-2024-25580: potential buffer overflow when reading KTX images
Resolves: RHEL-25725
- remove GDB hackery again, -12 built fine on i686, hack breaks ARM build
- fix 10-qt5-check-opengl2.sh for multiple screens (#1245755)
- support the old versions of libxcb and libxkbcommon in F19 and F20
- don't use the bundled libxkbcommon
- Perl 5.18 rebuild
- New upstream version
- macros.qt5: fix %qt5_ldflags macro
- Official beta release
- use upstream commit/fix for QTBUG-46310
- restore qdoc/gdb hackery, i686 still needs it :(
- 5.15.2 + sync with Fedora
Resolves: bz#1930040
- 5.9.3
- Debootstrap
- Use meta doctools package to build docs
- undefine QMAKE_STRIP (and friends), so we get useful -debuginfo pkgs (#1065636)
- Integrate rc releases now.
- backport: data corruption in QNetworkAccessManager
- refresh mariadb patch to actually match cr#206850 logic (#1491316)
- Create a tests subpkg with unit tests for gating
Resolves: bz#1681889
- Update for official RC1 released packages
- qtbase --> qt5-qtbase
- create_cmake.prf: adjust CMAKE_NO_PRIVATE_INCLUDES (#1456211,QTBUG-37417)
- Start to implement 5.6.0 beta
- try harder to avoid doc/multilib conflicts (#1212750)
- bootstrap (rawhide)
- revert some minor changes introduced since 5.7
- move *Plugin.cmake items to runtime (not -devel)
- macros.qt5: +%qmake_qt5 , to help set standard build flags (CFLAGS, etc...)
- macros.qt5: use newer location, use unexpanded macros
- fix/update Release: 1%{?dist}
- 5.4.0-beta
- avoid extra -devel deps by moving *Plugin.cmake files to base pkgs
- support bootstrap macro, to disable -doc,-examples
- bz#1518958, backport to fix out of bounds reads in qdnslookup_unix
- qt5-qdoc subpkg
- Install changes-5.x.y file (#989149)
- -gui: don't require gtk2 (__requires_exclude_from platformthemes) (#1154884)
- use qdoc.gdb wrapper
- pull in slightly different upstreamed font rendering fix (#1052389,QTBUG-41590)
- 5.15.3 + sync with Fedora
Resolves: bz#2061377
Resolves: bz#2059853
- macros.qt5: null-pointer-checks flag isn't c++-specific
- rebuild for ICU 53.1
- disable openssl11 (for now, FTBFS), use -openssl-linked (bug #1401459)
- BR: perl-generators
- -Wno-deprecated-declarations (typo missed trailing 's')
- include recommended qtdbus patches, fix Release
- 5.2.1
- first try
- We're back to gold linker
- Remove reduce relocations
- Second round of builds now with bootstrap enabled due new qttools
- use '#!/usr/bin/perl' instead of '#!/usr/bin/env perl'
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- needs a minimum version on sqlite build dependency (#1038617)
- fix build when doc macro not defined
- 5.7.1 dec5 snapshot
- No more docs, no more bootstrap. Docs comes now on a single package.
- Shortcuts with KeypadModifier not working (QTBUG-33093,#1219173)
- 5.2.0
- Rebuild to fix CET notes
Resolves: bz#1657206
- candidate fixes for various QtDBus deadlocks (QTBUG-51648,QTBUG-51676)
- re-introduce bootstrap/examples macros
- put examples-manifest.xml in -examples
- restore -doc multilib hack (to be on the safe side, can't hurt)
- %build: s/-optimized-qmake/-optimized-tools/
- -devel: qtsql apparently wants all drivers available at buildtime
- try reverting from -optimized-tools to -optimized-qmake
- full build
- Update to 5.11.1
- Rebuild for ICU 60.1
- drop gcc6 workaround on arm
- qt5-qtbase-5.3.0-2.fc21 breaks keyboard input (#1100213)
- add poll support, thanks to fweimer@redhat.com (QTBUG-27195)
- ExcludeArch: ppc64 ppc (#1005482)
- Remove Android specific test to avoid unnecessary dependencies
Resolves: bz#1733135
- Official beta release
- Update to Qt 5.5.1 RC1
- Patchs 13, 52, 53, 101, 155, 223, 297 removed due to inclusion upstream
- Update proper tarball. Need avoid the fix branch
- -no-use-gold-linker (f22+, #1193044)
- Fix infinite loops in QXmlStreamReader (CVE-2023-38197)
Resolves: bz#2222770
- 5.3.2
- use software OpenGL (llvmpipe) if the hardware driver doesn't support OpenGL 2
- actually apply mariadb-related patch (#1491316)
- qt5-qtbase: RPM build flags only partially injected (#1543888)
- enable bootstrap (and disable failing docs)
- enable openssl11 support only for f27+ (for now)
- Use mariadb-connector-c-devel, f28+ (#1493909)
- Backport upstream mariadb patch (#1491316)
- pass QMAKE_*_RELEASE to configure to ensure optflags get used (#1505260)
- Valgrind still needed as buildreq due recent split qdoc package, but we can get rid of
specific arch set.
- Added missing libproxy buildreq
- Epel and RHEL doesn't have libinput, so a plugin need to be excluded for this distros
- better %rpm_macros_dir handling
- categoried logging for xcb entries (#1497564, QTBUG-55167)
- Attempt not to hardcode ABI-tag for specific kernel version
Resolves: bz#1612434
- added privat headers for Qt5 Xcb
- backport "crash on start if system bus is not available" (QTBUG-51299)
- 5.4.0 (final)
- OpenSSL: handle SSL_shutdown's errors properly
Resolves: bz#1851538
- Fixes #1005482 - qtbase FTBFS on ppc/ppc64
- add macros qtwebengine_arches in qt5
- port qtdbusconnection_no_debug.patch from qt(4)
- add rpm macros qtwebengine_arches for qtwebengine
- pull in another upstream moc fix/improvement (#1290020,QTBUG-49972)
- fix bootstrap/docs
- 2013-11-08_141 snapshot, arm switch qreal double
- Don't allow remote attacker to bypass security restrictions caused by
flaw in certificate validation (CVE-2023-34410)
Resolves: bz#2212753
- refresh mariadb patch wrt cr#206850 (#1491316)
- Item views don't handle insert/remove of rows robustly (QTBUG-48870)
- refresh mariadb patch support (upstreamed version apparently incomplete)
- respin QTBUG-51649 patch
- %build: use -dbus-runtime unconditionally
- drop (unused) build deps: atspi, dbus, networkmanager
- qtlogging.ini: remove comments
- Qt 5.7.0 release
- fix bootstrapping logic
- fixed bz#1401459, backport openssl-1.1 support
- move sql build deps into subpkg sections
- macro'ize ibase,tds support (disabled on rhel)
- support out-of-tree build
- better %check
- pull in final/upstream fixes for QTBUG-51648,QTBUG-51649
- disable examples/tests in bootstrap mode
- 5.10.1
- Compiled with gcc
- Beta 3
- Reintroduce xcb patch from https://codereview.qt-project.org/#/c/138201/
- Rebuild against new openssl
- Drop apache2 test server from unit tests to drop perl(CGI) dependency
Resolves: bz#1930040
- QMimeType: remove unwanted *.bin as preferredSuffix for octet-stream (fdo#101667,kde#382437)
- pull in upstream drag-n-drop related fixes (QTBUG-45812, QTBUG-51215)
- qt5-base-devel.x86_64 qt5-base-devel.i686 file conflict qconfig.h (#1036956)
- enable patch to track private api
- Rebuild (binutils)
Resolves: bz#1930040
- QListView upstream regression (#1509649, QTBUG-63846)
- 5.6.0-beta (final)
- 5.3.0
- Crash in QXcbWindow::setParent() due to NULL xcbScreen (QTBUG-50081, #1291003)
- Upstream Release Candidate retagged
- unconditionally undo valgrind hack when done (#1255054)
- full build after ICU soname bump
- full rebuild for hunspell 1.4.0
- remove GDB hackery, it is not producing useful backtraces for the ARM crash
- reenable documentation
- support ppc64le multilib (#1080629)
- -static subpkg, Requires: fontconfig-devel,glib2-devel,zlib-devel
- -devel: Requires: pkgconfig(gl)
- SM_CLIENT_ID property is not set (QTBUG-46310)
- Add mesa-dri-drivers as recommends on gui package as reported by Kevin Kofler
- Reference https://bugzilla.redhat.com/1249280
- enable -doc only on primary archs (allow secondary bootstrap)
- readd plugin __requires_exclude_from filter, it is still needed
- update moc patch to define _SYS_SYSMACROS_H_OUTER instead (#1396755)
- backport a couple more upstream fixes
- introduce -common noarch subpkg, should help multilib issues
- 5.0-rc2
- initial try at putting non-conflicting binaries in %_bindir
- 5.0-rc1
- Update to 5.4.2
- 5.4.0-rc
- fixed build issue with new mariadb
- Debootstrap after tools built. New tool needed qtattributionsscanner
- Fix buffer overflow in XBM parser
Resolves: bz#1870364
- fix build issue with gcc6
- fix check for alsa 1.1.x
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild
- Escape macros in %changelog
- backport 0055-Respect-manual-set-icon-themes.patch (kde#344469)
- conditionally use valgrind only if needed
- re-enable gold linker (#1458003)
- drop qt5_null_flag/qt5_deprecated_flag hacks (should be fixed upstream for awhile)
- make qt_settings/journald support unconditional
- Unify firebird patch for both versions
- Bootstrap again for copr
- Rebuild with binutils fix for ppc64le (#1475636)
- %ix86: build -no-sse2 (#1103185)
- Get rid of valgrind hack. It sort out that we don't need it anymore (#1211203)
- 5.2.0-beta1
- enable (non-conflicting) qtchooser support
- track private api use via properly versioned symbols (unused for now)
- pull in set of upstream Qt 5.5 fixes and improvements for XCB screen handling rebased to 5.4
- Fix incorrect integer overflow check in HTTP2 implementation
Resolves: RHEL-20238
- 5.9.2
- really apply QT_VERSION_CHECK workaround (#1396755)
- macros.qt5: cleanup, %_qt5_cflags, %_qt5_cxxflags (for f24+)
- try bootstrap=1 (f23)
- rebuild for ICU 57.1
- 5.3.1
- unconditionally enable freetype lcd_filter
- (temp) disable docs (libxcb bootstrap)
- 5.1.1
- Move libQt5EglFSDeviceIntegration lib out of the -devel subpkg
Resolves: bz#1692970
- Fix QImage allocaion failure
Resolve: bz#1667860
- Fix double free in QXmlStreamReader
Resolve: bz#1667858
- Fix segmentation fault on malformed BMP file
Resolve: bz#1667859
- 5.0.2-rc1
- fixed bz#1409600, stack overflow in QXmlSimpleReader, CVE-2016-10040
- bootstrap rebuild for hunspell 1.4.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- BR: pkgconfig(xcb-xkb) > 1.10 (f21+)
- allow possibility for libxkbcommon-0.4.x only
- Requires: openssl-libs%{?_isa} (#1328659)
- unable to use input methods in ibus-1.5.10 (#1203575)
- Broken window scaling (#1381828)
- Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
Resolves: bz#1814739
Resolves: bz#1814683
- Fix: XML entity expansion vulnerability
Resolves: bz#1822193
- filter plugin provides, drop filter plugin excludes (no longer needed)
- -devel: Provides: qt5-qtbase-private-devel (#1233829)
- -devel: Requires: redhat-rpm-config (#1248174)
- build with and add to macros.qt5 flags: -fno-delete-null-pointer-checks
- full build
- 5.2.0-alpha
- -system-harfbuzz
- rename subpkg -x11 => -gui
- move some gui-related plugins base => -gui
- don't use symlinks in %_qt5_bindir (more qtchooser-friendly)
- 5.6.0 release
- rebase the lowmem patch
- own %{_qt5_plugindir}/egldeviceintegrations
- qt5-qtbase-static missing dependencies (#1311311)
- pull in upstream gcc-4.8.0 buildfix
- workaround gold linker issue with duplicate symbols (f27+, #1458003)
- pull upstream patches (upstreamed versions, gcc6-related bits mostly)
- add better fix for compile error on big endian
- drop 5.5 XCB patches, the rebase is incomplete and does not work properly with Qt 5.4
- fix the allow-forcing-llvmpipe patch to patch actual caller of __glXInitialize
- -examples subpkg
- Upstream official release
- drop disconnect_displays.patch so we can better test latest xcb/display work
- restore previously dropped patches
- Multiple Vulnerabilities in Qt Image Format Handling (CVE-2015-1860 CVE-2015-1859 CVE-2015-1858)
- use linux-g++ platform unconditionally
- use valgrind to debug qdoc HTML generation
- Update to final release 5.5.1
- update to 5.4.1
- (re)enable -docs
- Fix build on MIPS (#1322537)
- drop BR: valgrind (not used, for awhile)
- Don't allow remote attacker to bypass security restrictions caused by
flaw in certificate validation (CVE-2023-34410) (version #2)
Resolves: bz#2212753
- Beta 3 release
- workaround 'make docs' crasher on el6 (QTBUG-43057)
- enable -qt-xcb to fix non-US keys under VNC (#1295713)
- rebuild for ICU 54.1
- Prefer QPA implementation in qsystemtrayicon_x11 if available
- drop dep on xorg-x11-xinit (own shared dirs instead)
- fix/improve qtchooser support using alternatives (#1122316)
- respin lowmem patch to apply (unconditionally) to gcc-4.7.2 too
- 5.0 (final)
- 5.10.0
- Bump for rebuild.
- ship /etc/xdg/qtchooser/5.conf alternative instead (of qt5.conf)
- make the QMAKE_STRIP sed not sensitive to whitespace (see #1074041 in Qt 4)
- -examples: include %{_qt5_docdir}/qdoc/examples-manifest.xml (#1212750)
- Update to final RC
- sync latest xcb/screen/display related upstream commits
- Initial update for 5.8.0
- QOpenGLShaderProgram: glProgramBinary() resulting in LINK_STATUS=FALSE not handled properly (QTBUG-66420)
- restore moc_system_defines.patch lost in 5.7.0 rebase
- +%_qt5_libexecdir
- fix %_qt5_examplesdir macro
- fix big endian builds
- don't inject $RPM_OPT_FLAGS/$RPM_LD_FLAGS into qmake defaults f24+ (#1279265)
qt5-qtbase-gui-5.15.3-8.el8_10.x86_64.rpm | - own /etc/xdg/QtProject
- Requires: qt-settings (f22+)
- macros.qt5: fix %_qt5_headerdir, %_qt5_datadir, %_qt5_plugindir
- Fix build on RHEL 7 kernel
Resolves: bz#1733135
- bz#1328659, load openssl libs dynamically
- fix build failure on secondary arch
- Build against system xkb and openssl 1.1
Resolves: bz#1882375
- drop BR: cmake (handled by qt5-rpm-macros now)
- Fix specific overflow in qtextlayout
- Fix incorrect parsing of the strict-transport-security (HSTS) header
- Fix buffer over-read via a crafted reply from a DNS server
Resolves: bz#2209491
- fix Source0: https://download.qt.io/official_releases/qt/5.9/5.9.0/submodules/qtbase-opensource-src-5.9.0.tar.xz
- disable bootstrap again
- Enable bootstrap to first import on rawhide
- Fix build failure with glibc
- %build: -accessibility
- macros.qt5: +%_qt5_archdatadir +%_qt5_settingsdir
- pull in a couple more configure-related upstream patches
- Rebuild for platform-python
- revert out-of-tree build, breaks Qt5*Config.cmake *_PRIVATE_INCLUDE_DIRS entries (all blank)
- Do not require qt-settings package
- -devel: Requires: pkgconfig(egl)
- de-bootstrap
- make -doc arch'd (workaround bug #1437522)
- F20: require libxkbcommon >= 0.4.1, only patch for the old libxcb
- rebuild
- %build: hack around 'make docs' failures (on f22+)
- use %make_build, %ldconfig
- drop %_licensedir hack
- HTTP2: Delay any communication until encrypted() can be responded to
Resolves: RHEL-46340
- qt5-qdoc need requires >= current version, otherwise will prevent the usage further when moved to qttools
- make 10-qt5-check-opengl2.sh xinit script more robust
- enable journald support for el7+ (#1315239)
- rebuild for ICU 56.1
- workaround moc/qconfig-multilib issues (#1290020,QTBUG-49972)
- add versioned Requires: libxkbcommon dep
- do a normal build with docs
- restore font rendering patch (#1052389,QTBUG-41590)
- qt5-qtbase: RPM build flags only partially injected (#1543888)
- 5.0.2
- fix cmake config (#929227)
- Qt5 application crashes when connecting/disconnecting displays (#1083664)
- 5.0.1
- lowmem patch for %arm, s390
- -common: Obsoletes: qt5-qtquick1(-devel)
- respin QTBUG-51767 patch
- full build
- Update tarball with https://bugreports.qt.io/browse/QTBUG-50703 fix
- Really debootstrap :-P
- When a screen comes back online, the windows need to be told about it (QTBUG-47041)
- xcb: Ignore disabling of outputs in the middle of the mode switch
- -docs: BuildRequires: qt5-qhelpgenerator
- Disable bootstrap
- 5.12.5 + sync with Fedora
Resolves: bz#1733135
- Bad font rendering (#1052389,QTBUG-41590)
- bootstrap for libicu bump
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- backport 5.8 patch for wayland crasher (#1403500,QTBUG-55583)
- add condition for rhel
- add support for firebird-3.x
- pull in handful of upstream fixes, particularly...
- Fix a division by zero when processing malformed BMP files (QTBUG-44547, CVE-2015-0295)
- crashes when connecting/disconnecting displays (#1083664,QTBUG-42985)
- Some Qt apps crash if they are compiled with gcc5 (QTBUG-45755)
- qconfig.pri: +alsa +kms +pulseaudio +xcb-sm
- more cmake_path love (#929227)
- ship $$[QT_INSTALL_DATA]/qtlogging.ini for packaged logging defaults (#1227295)
- DoS vulnerability in the GIF image handler (QTBUG-38367)
- qt5-rpm-macros pkg
- aarch64 is secondary arch too
- ppc64le is NOT multilib
- Fix Power 64 macro use
- Qt 5.5 RC 1
- fix build failure on big endian platform (ppc64,s390x)
- limit -reduce-relocations to %ix86 x86_64 archs (QTBUG-36129)
- create/own %{_qt5_plugindir}/iconengines
- -devel: create/own %{_qt5_archdatadir}/mkspecs/modules
- cleanup .prl
- 5.9.1
- don't omit examples for bootstrap (needs work)
- fix build issue with gcc6
- Perl 5.18 rebuild
- QWidget::setWindowRole does nothing (QTBUG-45484)
- fixed bz#1442553, multilib issue
- rebuild
- Non-bootstrapped build
- -dbus=runtime on el6 (#1196359)
- %build: -no-directfb
- Crash due to unsafe access to QTextLayout::lineCount (#1207279,QTBUG-43562)
- own %{_qt5_plugindir}/{designer,iconengines,script,styles}
- Fix out-of-bounds write in QOutlineMapper::convertPath
Resolves: bz#1996877
- introduce macros.qt5-qtbase (for %_qt5, %_qt5_epoch, %_qt5_version, %_qt5_evr)
- 5.2.0-rc1
- revert/omit recent egl packaging changes
- -doc install changes-5.* files here (#989149)
- -doc subpkg (not enabled)
- enable %check
- Try to ensure that -fPIC is used in CMake builds (QTBUG-45755)
- %build: -system-pcre, BR: pkgconfig(libpcre)
- use -O1 optimization on lowmem (s390) arch
- Enable EGL support
- enable qtchooser support
- Upstream Release Candidate 1
- adapted the berolinux's patch for new openssl-1.1.x
- fix %pre scriptlet
- QFileDialog: implement getOpenFileUrl and friends for real
- -system-libxkbcommon (f21+)
- rebase to latest SM patches (QTBUG-45484, QTBUG-46310)
- %build: restore -dbus-linked
- namespace QT_VERSION_CHECK to workaround major/minor being pre-defined (#1396755)
- update moc patch to define _SYS_SYSMACROS_H (#1396755)
- build: ./configure -journal (f24+)
- Prepare 5.7
- Move macros package away from qtbase. Now is called qt5-rpm-macros
- macros.qt5: we really only want the null-pointer-checks flag here
and definitely no arch-specific ones
- disable -docs (for ppc bootstrap mostly)
- fix QTBUG-35459 (too low entityCharacterLimit=1024 for CVE-2013-4549)
- fix QTBUG-35460 (error message for CVE-2013-4549 is misspelled)
- reenable docs on Fedora (accidentally disabled)
- BR: pkgconfig(libudev) pkgconfig(xkbcommon) pkgconfig(xcb-xkb)
- add qtchooser support (disabled by default)
- Fix CVE-2024-25580: potential buffer overflow when reading KTX images
Resolves: RHEL-25725
- remove GDB hackery again, -12 built fine on i686, hack breaks ARM build
- fix 10-qt5-check-opengl2.sh for multiple screens (#1245755)
- support the old versions of libxcb and libxkbcommon in F19 and F20
- don't use the bundled libxkbcommon
- Perl 5.18 rebuild
- New upstream version
- macros.qt5: fix %qt5_ldflags macro
- Official beta release
- use upstream commit/fix for QTBUG-46310
- restore qdoc/gdb hackery, i686 still needs it :(
- 5.15.2 + sync with Fedora
Resolves: bz#1930040
- 5.9.3
- Debootstrap
- Use meta doctools package to build docs
- undefine QMAKE_STRIP (and friends), so we get useful -debuginfo pkgs (#1065636)
- Integrate rc releases now.
- backport: data corruption in QNetworkAccessManager
- refresh mariadb patch to actually match cr#206850 logic (#1491316)
- Create a tests subpkg with unit tests for gating
Resolves: bz#1681889
- Update for official RC1 released packages
- qtbase --> qt5-qtbase
- create_cmake.prf: adjust CMAKE_NO_PRIVATE_INCLUDES (#1456211,QTBUG-37417)
- Start to implement 5.6.0 beta
- try harder to avoid doc/multilib conflicts (#1212750)
- bootstrap (rawhide)
- revert some minor changes introduced since 5.7
- move *Plugin.cmake items to runtime (not -devel)
- macros.qt5: +%qmake_qt5 , to help set standard build flags (CFLAGS, etc...)
- macros.qt5: use newer location, use unexpanded macros
- fix/update Release: 1%{?dist}
- 5.4.0-beta
- avoid extra -devel deps by moving *Plugin.cmake files to base pkgs
- support bootstrap macro, to disable -doc,-examples
- bz#1518958, backport to fix out of bounds reads in qdnslookup_unix
- qt5-qdoc subpkg
- Install changes-5.x.y file (#989149)
- -gui: don't require gtk2 (__requires_exclude_from platformthemes) (#1154884)
- use qdoc.gdb wrapper
- pull in slightly different upstreamed font rendering fix (#1052389,QTBUG-41590)
- 5.15.3 + sync with Fedora
Resolves: bz#2061377
Resolves: bz#2059853
- macros.qt5: null-pointer-checks flag isn't c++-specific
- rebuild for ICU 53.1
- disable openssl11 (for now, FTBFS), use -openssl-linked (bug #1401459)
- BR: perl-generators
- -Wno-deprecated-declarations (typo missed trailing 's')
- include recommended qtdbus patches, fix Release
- 5.2.1
- first try
- We're back to gold linker
- Remove reduce relocations
- Second round of builds now with bootstrap enabled due new qttools
- use '#!/usr/bin/perl' instead of '#!/usr/bin/env perl'
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- needs a minimum version on sqlite build dependency (#1038617)
- fix build when doc macro not defined
- 5.7.1 dec5 snapshot
- No more docs, no more bootstrap. Docs comes now on a single package.
- Shortcuts with KeypadModifier not working (QTBUG-33093,#1219173)
- 5.2.0
- Rebuild to fix CET notes
Resolves: bz#1657206
- candidate fixes for various QtDBus deadlocks (QTBUG-51648,QTBUG-51676)
- re-introduce bootstrap/examples macros
- put examples-manifest.xml in -examples
- restore -doc multilib hack (to be on the safe side, can't hurt)
- %build: s/-optimized-qmake/-optimized-tools/
- -devel: qtsql apparently wants all drivers available at buildtime
- try reverting from -optimized-tools to -optimized-qmake
- full build
- Update to 5.11.1
- Rebuild for ICU 60.1
- drop gcc6 workaround on arm
- qt5-qtbase-5.3.0-2.fc21 breaks keyboard input (#1100213)
- add poll support, thanks to fweimer@redhat.com (QTBUG-27195)
- ExcludeArch: ppc64 ppc (#1005482)
- Remove Android specific test to avoid unnecessary dependencies
Resolves: bz#1733135
- Official beta release
- Update to Qt 5.5.1 RC1
- Patchs 13, 52, 53, 101, 155, 223, 297 removed due to inclusion upstream
- Update proper tarball. Need avoid the fix branch
- -no-use-gold-linker (f22+, #1193044)
- Fix infinite loops in QXmlStreamReader (CVE-2023-38197)
Resolves: bz#2222770
- 5.3.2
- use software OpenGL (llvmpipe) if the hardware driver doesn't support OpenGL 2
- actually apply mariadb-related patch (#1491316)
- qt5-qtbase: RPM build flags only partially injected (#1543888)
- enable bootstrap (and disable failing docs)
- enable openssl11 support only for f27+ (for now)
- Use mariadb-connector-c-devel, f28+ (#1493909)
- Backport upstream mariadb patch (#1491316)
- pass QMAKE_*_RELEASE to configure to ensure optflags get used (#1505260)
- Valgrind still needed as buildreq due recent split qdoc package, but we can get rid of
specific arch set.
- Added missing libproxy buildreq
- Epel and RHEL doesn't have libinput, so a plugin need to be excluded for this distros
- better %rpm_macros_dir handling
- categoried logging for xcb entries (#1497564, QTBUG-55167)
- Attempt not to hardcode ABI-tag for specific kernel version
Resolves: bz#1612434
- added privat headers for Qt5 Xcb
- backport "crash on start if system bus is not available" (QTBUG-51299)
- 5.4.0 (final)
- OpenSSL: handle SSL_shutdown's errors properly
Resolves: bz#1851538
- Fixes #1005482 - qtbase FTBFS on ppc/ppc64
- add macros qtwebengine_arches in qt5
- port qtdbusconnection_no_debug.patch from qt(4)
- add rpm macros qtwebengine_arches for qtwebengine
- pull in another upstream moc fix/improvement (#1290020,QTBUG-49972)
- fix bootstrap/docs
- 2013-11-08_141 snapshot, arm switch qreal double
- Don't allow remote attacker to bypass security restrictions caused by
flaw in certificate validation (CVE-2023-34410)
Resolves: bz#2212753
- refresh mariadb patch wrt cr#206850 (#1491316)
- Item views don't handle insert/remove of rows robustly (QTBUG-48870)
- refresh mariadb patch support (upstreamed version apparently incomplete)
- respin QTBUG-51649 patch
- %build: use -dbus-runtime unconditionally
- drop (unused) build deps: atspi, dbus, networkmanager
- qtlogging.ini: remove comments
- Qt 5.7.0 release
- fix bootstrapping logic
- fixed bz#1401459, backport openssl-1.1 support
- move sql build deps into subpkg sections
- macro'ize ibase,tds support (disabled on rhel)
- support out-of-tree build
- better %check
- pull in final/upstream fixes for QTBUG-51648,QTBUG-51649
- disable examples/tests in bootstrap mode
- 5.10.1
- Compiled with gcc
- Beta 3
- Reintroduce xcb patch from https://codereview.qt-project.org/#/c/138201/
- Rebuild against new openssl
- Drop apache2 test server from unit tests to drop perl(CGI) dependency
Resolves: bz#1930040
- QMimeType: remove unwanted *.bin as preferredSuffix for octet-stream (fdo#101667,kde#382437)
- pull in upstream drag-n-drop related fixes (QTBUG-45812, QTBUG-51215)
- qt5-base-devel.x86_64 qt5-base-devel.i686 file conflict qconfig.h (#1036956)
- enable patch to track private api
- Rebuild (binutils)
Resolves: bz#1930040
- QListView upstream regression (#1509649, QTBUG-63846)
- 5.6.0-beta (final)
- 5.3.0
- Crash in QXcbWindow::setParent() due to NULL xcbScreen (QTBUG-50081, #1291003)
- Upstream Release Candidate retagged
- unconditionally undo valgrind hack when done (#1255054)
- full build after ICU soname bump
- full rebuild for hunspell 1.4.0
- remove GDB hackery, it is not producing useful backtraces for the ARM crash
- reenable documentation
- support ppc64le multilib (#1080629)
- -static subpkg, Requires: fontconfig-devel,glib2-devel,zlib-devel
- -devel: Requires: pkgconfig(gl)
- SM_CLIENT_ID property is not set (QTBUG-46310)
- Add mesa-dri-drivers as recommends on gui package as reported by Kevin Kofler
- Reference https://bugzilla.redhat.com/1249280
- enable -doc only on primary archs (allow secondary bootstrap)
- readd plugin __requires_exclude_from filter, it is still needed
- update moc patch to define _SYS_SYSMACROS_H_OUTER instead (#1396755)
- backport a couple more upstream fixes
- introduce -common noarch subpkg, should help multilib issues
- 5.0-rc2
- initial try at putting non-conflicting binaries in %_bindir
- 5.0-rc1
- Update to 5.4.2
- 5.4.0-rc
- fixed build issue with new mariadb
- Debootstrap after tools built. New tool needed qtattributionsscanner
- Fix buffer overflow in XBM parser
Resolves: bz#1870364
- fix build issue with gcc6
- fix check for alsa 1.1.x
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild
- Escape macros in %changelog
- backport 0055-Respect-manual-set-icon-themes.patch (kde#344469)
- conditionally use valgrind only if needed
- re-enable gold linker (#1458003)
- drop qt5_null_flag/qt5_deprecated_flag hacks (should be fixed upstream for awhile)
- make qt_settings/journald support unconditional
- Unify firebird patch for both versions
- Bootstrap again for copr
- Rebuild with binutils fix for ppc64le (#1475636)
- %ix86: build -no-sse2 (#1103185)
- Get rid of valgrind hack. It sort out that we don't need it anymore (#1211203)
- 5.2.0-beta1
- enable (non-conflicting) qtchooser support
- track private api use via properly versioned symbols (unused for now)
- pull in set of upstream Qt 5.5 fixes and improvements for XCB screen handling rebased to 5.4
- Fix incorrect integer overflow check in HTTP2 implementation
Resolves: RHEL-20238
- 5.9.2
- really apply QT_VERSION_CHECK workaround (#1396755)
- macros.qt5: cleanup, %_qt5_cflags, %_qt5_cxxflags (for f24+)
- try bootstrap=1 (f23)
- rebuild for ICU 57.1
- 5.3.1
- unconditionally enable freetype lcd_filter
- (temp) disable docs (libxcb bootstrap)
- 5.1.1
- Move libQt5EglFSDeviceIntegration lib out of the -devel subpkg
Resolves: bz#1692970
- Fix QImage allocaion failure
Resolve: bz#1667860
- Fix double free in QXmlStreamReader
Resolve: bz#1667858
- Fix segmentation fault on malformed BMP file
Resolve: bz#1667859
- 5.0.2-rc1
- fixed bz#1409600, stack overflow in QXmlSimpleReader, CVE-2016-10040
- bootstrap rebuild for hunspell 1.4.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- BR: pkgconfig(xcb-xkb) > 1.10 (f21+)
- allow possibility for libxkbcommon-0.4.x only
- Requires: openssl-libs%{?_isa} (#1328659)
- unable to use input methods in ibus-1.5.10 (#1203575)
- Broken window scaling (#1381828)
- Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
Resolves: bz#1814739
Resolves: bz#1814683
- Fix: XML entity expansion vulnerability
Resolves: bz#1822193
- filter plugin provides, drop filter plugin excludes (no longer needed)
- -devel: Provides: qt5-qtbase-private-devel (#1233829)
- -devel: Requires: redhat-rpm-config (#1248174)
- build with and add to macros.qt5 flags: -fno-delete-null-pointer-checks
- full build
- 5.2.0-alpha
- -system-harfbuzz
- rename subpkg -x11 => -gui
- move some gui-related plugins base => -gui
- don't use symlinks in %_qt5_bindir (more qtchooser-friendly)
- 5.6.0 release
- rebase the lowmem patch
- own %{_qt5_plugindir}/egldeviceintegrations
- qt5-qtbase-static missing dependencies (#1311311)
- pull in upstream gcc-4.8.0 buildfix
- workaround gold linker issue with duplicate symbols (f27+, #1458003)
- pull upstream patches (upstreamed versions, gcc6-related bits mostly)
- add better fix for compile error on big endian
- drop 5.5 XCB patches, the rebase is incomplete and does not work properly with Qt 5.4
- fix the allow-forcing-llvmpipe patch to patch actual caller of __glXInitialize
- -examples subpkg
- Upstream official release
- drop disconnect_displays.patch so we can better test latest xcb/display work
- restore previously dropped patches
- Multiple Vulnerabilities in Qt Image Format Handling (CVE-2015-1860 CVE-2015-1859 CVE-2015-1858)
- use linux-g++ platform unconditionally
- use valgrind to debug qdoc HTML generation
- Update to final release 5.5.1
- update to 5.4.1
- (re)enable -docs
- Fix build on MIPS (#1322537)
- drop BR: valgrind (not used, for awhile)
- Don't allow remote attacker to bypass security restrictions caused by
flaw in certificate validation (CVE-2023-34410) (version #2)
Resolves: bz#2212753
- Beta 3 release
- workaround 'make docs' crasher on el6 (QTBUG-43057)
- enable -qt-xcb to fix non-US keys under VNC (#1295713)
- rebuild for ICU 54.1
- Prefer QPA implementation in qsystemtrayicon_x11 if available
- drop dep on xorg-x11-xinit (own shared dirs instead)
- fix/improve qtchooser support using alternatives (#1122316)
- respin lowmem patch to apply (unconditionally) to gcc-4.7.2 too
- 5.0 (final)
- 5.10.0
- Bump for rebuild.
- ship /etc/xdg/qtchooser/5.conf alternative instead (of qt5.conf)
- make the QMAKE_STRIP sed not sensitive to whitespace (see #1074041 in Qt 4)
- -examples: include %{_qt5_docdir}/qdoc/examples-manifest.xml (#1212750)
- Update to final RC
- sync latest xcb/screen/display related upstream commits
- Initial update for 5.8.0
- QOpenGLShaderProgram: glProgramBinary() resulting in LINK_STATUS=FALSE not handled properly (QTBUG-66420)
- restore moc_system_defines.patch lost in 5.7.0 rebase
- +%_qt5_libexecdir
- fix %_qt5_examplesdir macro
- fix big endian builds
- don't inject $RPM_OPT_FLAGS/$RPM_LD_FLAGS into qmake defaults f24+ (#1279265)
qt5-qtconnectivity-5.15.3-1.el8.x86_64.rpm | - Enabled docs
- BR: cmake, use %license, update Source URL
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Official beta release
- Upstream beta 3
- 5.4.0-beta
- New upstream version
- 5.9.2
- 5.3.2
- 5.12.5
Resolves: bz#1733137
- 5.10.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Compiled with gcc
- 5.15.3
Resolves: bz#2061382
- 5.3.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- 5.4.0 (final)
- Update to 5.6.1
- 5.10.0
- 5.4.2
- 5.4.1
- out-of-tree build, use %qmake_qt5
- sanitize .prl files
- Update RC release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- 5.7.1 dec5 snapshot, drop cmake/pkgconfig style BR
- Update to final RC
- Update for official RC1 released packages
- Start to implement 5.6.0 beta
- cleaner qtbase dep, .spec cosmetics
- 5.9.3
- filter qml provides
- New final upstream release Qt 5.5.0
- rebuild (gcc5)
- 5.15.2
Resolves: bz#1930042
- Rebuild to fix CET notes
Resolves: bz#1657221
=- Qt 5.7.0 release
- Update to final beta release
- Upstream official release
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- 5.6.0 final release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to final release 5.5.1
- 5.3.0
- Upstream Release Candidate retagged
- Qt 5.5.0 RC1
- 5.4.0-rc
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- first try
- rebuild
- -docs: BuildRequires: qt5-qhelpgenerator, standardize bootstrapping macros
- New upstream version
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild
- Rebuild (binutils)
Resolves: bz#1930042
- 5.11.1
- 5.2.1
- rebuild
- 5.9.1
- rebuild
- include the bswap patch in F-20 and F-21 builds too
- Prepare 5.7.0
- Rebuilt for GCC 5 C++11 ABI change
- Update to Qt 5.5.1 RC1
qt5-qtdeclarative-5.15.3-2.el8.x86_64.rpm | - include crasher workaround (#1259472,kde#346118)
- BR: qt5-qtxmlpatterns-devel (#1048558)
- -docs: BuildRequires: qt5-qhelpgenerator
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- use debian's i686/sse2 support patch
- use %license
- fix qmlplugindump conflict with qt4-devel
- include license files, dist/changes*
- 5.4.0-beta3
- %ix84: drop sse2-optimized bits, need to rethink if/how to support it now
- Escape macros in %changelog
- rebuild
- -devel: don't own libQt5QuickWidgets.so.5 (#1337621)
- 5.4.1
- 5.15.2
Resolves: bz#1930043
- %ix86: cannot assume sse2 (and related support) or the JIT that requires it... disable.
- Update RC tarball from git
- 5.1.1
- 5.2.0-alpha
- Obsoletes: qt5-qtjsbackend
- -doc subpkg
- fix non-sse2 support (kde#346244) and optimize sse2 binaries
- 5.6.0 final release
- fix qmlprofiler conflict with qt-creator
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- workaround QQuickShaderEffectSource::updatePaintNode deadlock (#1237269, kde#348385)
- Second round of builds now with bootstrap enabled due new qttools
- drop useless qtdeclarative-opensource-src-5.9.0-v4bootstrap.patch,
apply correct qtdeclarative-opensource-src-5.9.0-no_sse2.patch to
fix the build issue in JIT on ppc64/ppc64le/s390x
- rebuild
- 5.9.1
- bootstrap ppc
- Add AArch64 support (RHBUG: 1040452, QTBUG-35528)
- first try
- Use system double-conversion (#1078524)
- rebuild
- support out-of-src-tree builds
- %ix86: install sse2/jit version to %_qt5_libdir/sse2/
- Upstream Release Candidate 1
- Fix V4 JIT generating bad JIT code on ARM64
Resolves: bz#2178625
- BR: gcc-c++, use %make_build %make_install %ldconfig_scriptlets
- drop local -fno-delete-null-pointer-checks hack, used in all Qt5 builds now
- add %check
- Update RC release
- Update to final beta3 release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- New upstream version
- 5.4.2
- Update for official RC1 released packages
- rebuild (gcc)
- revert commit causing regresions (QTBUG-64017)
- New final upstream release Qt 5.5.0
- BR: cmake (cmake autoprovides)
- qt5-qtjsbackend only supports ix86, x86_64 and arm
- backport upstream fixes
- drop -fno-delete-null-pointer-checks hack (included in qt5-rpm-macros as needed now)
- restore bootstrap/doc macros, drop pkgconfig-style deps (for now)
- build -doc on all archs
- macro'ize no_sse2 hack (to make it easier to enable/disable)
- re-introduce -fno-delete-null-pointer-checks here (following upstream)
- add -fno-lifetime-dse too, helps fix i686/qml crasher (#1331593)
- disable tests (for now, not useful yet)
- Fix cmake dir ownerhips
- 5.2.1
- de-bootstrap
- 5.11.1
- Drop dependency on Python2
- enable -doc only on primary archs (allow secondary bootstrap)
- Obsoletes: qt5-qtdeclarative-render2d
- 5.2.0
- 5.15.3 + sync with Fedora
Resolves: bz#2061380
- rebuild (arm/qreal)
- 5.12.5
Resolves: bz#1733139
- use new %qmake_qt5 macro
- filter qml provides
- Fix BuildRequires for /usr/bin/python3
- Resolves: #1615562
- tighten qtbase dep (#1233829), .spec cosmetics
- BR: qt5-rpm-macros
- fix Source URL, Release: 1%{?dist}
- 5.3.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Compiled with gcc
- New upstream version
- bootstrap
- New upstream beta release
- pull in some upstream fixes, for QTBUG-45753/kde-345544 in particular
- Update to 5.6.1
- 5.4.0 (final)
- 5.10.0
- Enable SSE2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- New upstream beta3 release
- de-bootstrap
- Qt 5.7.0 release
- 5.10.1
- BR: qt5-qtbase-private-devel, -devel: Provides: -private-devel
- backport fix for older compilers (aka rhel6)
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- Conflict in qt5-qtdeclarative-devel (#1441343), fix Release: 1%{?dist}
- 5.3.0
- Upstream Release Candidate retagged
- epel7 bootstrapped
- -examples subpkg
- Disable bootstrap
- 5.7.1 dec5 snapshot
- Prepare for 5.7.0
- Update to final RC
- Rebuild to fix CET notes
Resolves: bz#1657232
- 5.9.2
- 5.2.0-rc1
- -qt5 wrappers for qml qmlbundle qmlmin qmlscene
- BR: mesa-dri-drivers (tests)
- restore fix for QTBUG-45753/kde-345544 lost in 5.4.2 rebase
- 5.3.1
- 5.9.3
- rebuild (gcc5)
- pull in candidate memleak fix (review#224684)
- build -examples only if supported
- Upstream official release
- Start to implement 5.6.0 beta3, bootstrap
- Update to final release 5.5.1
- 5.4.0-rc
- drop BR: cmake (handled by qt5-rpm-macros now)
- Rebuild (binutils)
Resolves: bz#1930043
- pull in upstream qml/jsruntime workaround (ie, apply compiler workarounds only for src/qml/)
- 5.2.0-beta31
- 5.0.2
- build with -fno-delete-null-pointer-checks to workaround gcc6-related runtime crashes (#1303643)
- Update to Qt 5.5.1 RC1
- Official beta3 release
qt5-qtlocation-5.15.3-1.el8.x86_64.rpm | - Upstream beta 3
- Rebuild to fix CET notes
Resolves: bz#1657251
- 5.4.0-beta
- build docs on all archs
- 5.9.2
- 5.3.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- 5.15.2
Resolves: bz#1930047
- 5.10.1
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- directly reference other qt5-related build deps
- Compiled with gcc
- 5.3.1
- Update to 5.6.1
- New upstream version
- Update to final RC
- BR: pkgconfig(Qt5Qml) > 5.4.0 (#1177986)
- 5.10.0
- rebuild
- Update RC release
- 5.4.1
- 5.4.0 (final)
- out-of-tree build, use %qmake_qt5
- -examples subpkg
- (re)add bootstrap macro support
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Update for official RC1 released packages
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Start to implement 5.6.0 beta
- BR: qt5-qtbase-private-devel
- 5.9.3
- New final upstream release Qt 5.5.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- 5.12.5
Resolves: bz#1733143
- rebuild (gcc5)
- Qt 5.7.0 release
- Upstream official release
- filter plugins too
- 5.6.0 final release
- filter qml provides, BR: qt5-qtdeclarative explicitly
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to final beta release
- 5.3.0
- Update to final release 5.5.1
- first try
- tighten qtbase dep (#1233829), .spec cosmetics, (re)enable docs
- Upstream Release Candidate retagged
- Qt 5.5.0 RC1
- 5.4.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- 5.4.0-rc
- rebuild
- Rebuild for ICU 60.1
- rebuild (gcc)
- use %make_build %ldconfig_scriptlets
- New upstream version
- rebuild (gcc5)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild
- 5.15.3
Resolves: bz#2061396
- 5.2.1
- drop BR: cmake (handled by qt5-rpm-macros now)
- 5.7.1 dec5 snapshot
- rebuild
- Official beta release
- build -examples only when supported
- -docs: BuildRequires: qt5-qhelpgenerator, standardize bootstrapping
- 5.9.1
- (re) add bootstrap macro support
- drop geoclue(1) dep (unused at build time anyway (#1286886)
- drop (deprecated) gypsy support (#1069225)
- update source URL, use %license, BR: cmake
- Rebuild (binutils)
Resolves: bz#1930047
- sanitize .prl file(s)
- Rebuilt for GCC 5 C++11 ABI change
- Rebuild to fix GCC 8 mis-compilation
See https://da.gd/YJVwk ("GCC 8 ABI change on x86_64")
- 5.11.1
- Update to Qt 5.5.1 RC1
qt5-qtmultimedia-5.15.3-1.el8.x86_64.rpm | - ExclusiveArch: %{ix86} x86_64 %{arm} (to match qt5-qtdeclarative)
- -devel: pkgconfig(libpulse-mainloop-glib) (#1438077)
- drop gst support on el6 (QTBUG-48939)
- Update RC release
- Official beta release
- Upstream beta 3
- rebuild (arm/qreal)
- 5.4.0-beta
- 5.9.2
- Update to final beta release
- 5.2.0-rc1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- 5.10.1
- Compiled with gcc
- pull in upstream fixes, QTBUG-48939 in particular
- 5.3.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- New upstream version
- update Source URL (and refetch tarball)
- improved summary/description
- Update to 5.6.1
- 5.10.0
- include BR: qt5-qdoc only in -doc subpkg
- restore bootstrap macro support
- make openal support unconditional (#1069231)
- 5.4.1
- out-of-tree build, use %qmake_qt5
- 5.1.1
- -examples subpkg
- update source URL, use %license, BR: cmake
- 5.7.1 dec5 snapshot, drop cmake/pkgconfig style BR
- Update for official RC1 released packages
- Start to implement 5.6.0 beta
- wip/gstreamer1 snapshot (#1149885)
- 5.9.3
- Rebuild (binutils)
Resolves: bz#1930048
- filter qml provides
- New final upstream release Qt 5.5.0
- use standard (same as qtbase) .prl sanitation
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- rebuild (gcc5)
- build -examples only if supported
- Rebuild to fix CET notes
Resolves: bz#1657249
- Upstream official release
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- 5.6.0 final release
- 5.3.2
- filter plugin provides too
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- rebuild (for pulseaudio, bug #1117683)
- 5.15.2
Resolves: bz#1930048
- BR: qt5-qtdeclarative-devel
- Fix spec file conditionals
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to final release 5.5.1
- 5.3.0
- Upstream Release Candidate retagged
- 5.2.0-alpha
- -doc subpkg
- Qt 5.5.0 RC1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- 5.4.2
- rebuild
- Update to final RC
- 5.4.0 (final) + backported gst1 support from dev/ branch
- New upstream version
- 5.2.0-beta1
- 5.15.3
Resolves: bz#2061396
- 5.2.1
- rebuild
- BR: qt5-qtbase-private-devel
- -docs: BuildRequires: qt5-qhelpgenerator, standardize bootstrapping
- 5.9.1
- 5.2.0
- Qt 5.7.0 release
- bootstrap ppc
- 5.0.2
- tighten qtbase dep (#1233829)
- Rebuilt for GCC 5 C++11 ABI change
- first try
- 5.12.5
Resolves: bz#1733144
- 5.11.1
- Update to Qt 5.5.1 RC1
qt5-qtsensors-5.15.3-1.el8.x86_64.rpm | - Upstream beta 3
- restore bootstrap macro support
- only BR: qt5-qdoc in -doc subpkg
- 5.4.0-beta
- build docs on all archs
- Rebuild to fix CET notes
Resolves: bz#1657245
- 5.9.2
- 5.3.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- 5.10.1
- drop BR: cmake (handled by qt5-rpm-macros now)
- Rebuild (binutils)
Resolves: bz#1930052
- Compiled with gcc
- 5.4.0-rc
- 5.3.1
- Update to 5.6.1
- New upstream version
- Update for official RC1 released packages
- update source URL, BR: cmake, use %license
- 5.10.0
- Update RC release
- 5.4.1
- 5.4.0 (final)
- out-of-tree build, use %qmake_qt5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- sanitize .prl files
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- tighten qtbase dep (#1233829), (re)enable docs
- Start to implement 5.6.0 beta
- 5.2.1
- 5.9.3
- New final upstream release Qt 5.5.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- rebuild (gcc5)
- filter provides, BR: qtbase-private-devel qtdeclarative explicitly
- Upstream official release
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- 5.6.0 final release
- 5.12.5
Resolves: bz#1733148
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to final beta release
- 5.3.0
- Update to final release 5.5.1
- first try
- BR: pkgconfig(Qt5Qml) > 5.4.0 (#1177985)
- Upstream Release Candidate retagged
- restore bootstrap macro support
- 5.4.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Update to final RC
- rebuild
- 5.15.3
Resolves: bz#2061401
- rebuild (gcc5)
- New upstream version
- 5.7.1 dec5 snapshot
- rebuild
- 5.15.2
Resolves: bz#1930052
- Official beta release
- -docs: BuildRequires: qt5-qhelpgenerator, standardize bootstrapping
- 5.9.1
- Qt 5.7.0 release
- -examples subpkg
- Rebuilt for GCC 5 C++11 ABI change
- 5.11.1
- Update to Qt 5.5.1 RC1
qt5-qtserialport-5.15.3-1.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- 5.9.2
- Rebuild to fix CET notes
Resolves: bz#1657236
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- 5.10.1
- Update to final beta3 release
- Start to implement 5.6.0 beta3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- New upstream version
- Update for official RC1 released packages
- 5.4.0 (final)
- 5.10.0
- update source URL, use %license, BR: cmake
- Update to 5.6.1
- New upstream beta 3 version
- 5.4.2
- Update RC release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Update to final RC
- Rebuild for broken CI
Resolves: bz#1657236
- 5.2.1
- 5.15.2
Resolves: bz#1930054
- 5.9.3
- New final upstream release Qt 5.5.0
- 5.4.1
- Qt 5.7.0 release
- New upstream beta version
- Rebuild (binutils)
Resolves: bz#1930054
- 5.7.1 dec5 snapshot
- drop BR: cmake (handled by qt5-rpm-macros now)
- BR: qt5-qtbase-private-devel
- clean .prl files (buildroot, excessive deps) (#1091630)
- 5.4.0-beta3
- Compiled with gcc
- Upstream official release
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- 5.6.0 final release
- 5.3.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to final release 5.5.1
- 5.3.0
- Upstream Release Candidate retagged
- 5.4.0-rc
- Qt 5.5.0 RC1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- first try
- rebuild
- out-of-tree build, use %qmake_qt5
- New upstream version
- 5.12.5
Resolves: bz#1733150
- 5.3.1
- rebuild
- Add qt5-qtserialport-examples (#1190202)
- -docs: BuildRequires: qt5-qhelpgenerator, standardize bootstrapping
- 5.9.1
- 5.15.3
Resolves: bz#2061404
- ready -examples subpkg
- tighten qtbase dep (#1233829)
- Official beta3 release
- 5.11.1
- Update to Qt 5.5.1 RC1
- Upstream Release Candidate 1
qt5-qtsvg-5.15.3-2.el8.x86_64.rpm | - 5.15.2
Resolves: bz#1930055
- Update RC release
- 5.9.2
- 5.2.0-rc1
- build -doc unconditionally
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Fix out of bounds read in function QRadialFetchSimd from crafted svg file
Resolves: bz#1945643
- Rebuild (binutils)
Resolves: bz#1930055
- 5.10.1
- New upstream beta release
- Compiled with gcc
- 5.3.1
- Start to implement 5.6.0 beta3
- Update to final beta3 release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- New upstream version
- Update for official RC1 released packages
- 5.4.0 (final)
- 5.10.0
- 5.4.1
- Update to 5.6.1
- rebuild (arm/qreal)
- Fix uninitialized variable usage in m_unitsPerEm (CVE-2023-32573)
Resolves: bz#2208141
- 5.15.3
Resolves: bz#2061405
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- New upstream beta3 release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- 5.2.1
- ppc bootstrap
- 5.9.3
- New final upstream release Qt 5.5.0
- use standard (same as qtbase) .prl sanitation
- rebuild (gcc5)
- Qt 5.7.0 release
- 5.7.1 dec5 snapshot
- drop BR: cmake (handled by qt5-rpm-macros now)
- BR: qt5-qtbase-private-devel
- Rebuild to fix CET notes
Resolves: bz#1657241
- 5.4.0-beta3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- 5.1.1
- Upstream official release
- (re)add bootstrap macro support
- 5.6.0 final release
- 5.3.2
- update source URL, BR: cmake, use %license
- Fix out-of-bound write that may lead to DoS
Resolves: bz#2038487
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to final release 5.5.1
- 5.3.0
- Upstream Release Candidate retagged
- 5.4.0-rc
- Qt 5.5.0 RC1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- 5.4.2
- rebuild
- Update to final RC
- out-of-tree build, use %qmake_qt5
- New upstream version
- 5.2.0-alpha
- -doc subpkg
- rebuild
- 5.12.5
Resolves: bz#1733151
- -docs: BuildRequires: qt5-qhelpgenerator, standardize bootstrapping
- 5.9.1
- 5.2.0
- 5.2.0-beta31
- -examples subpkg
- 5.0.2
- tighten qtbase dep (#1233829)
- rebuild
- Rebuilt for GCC 5 C++11 ABI change
- first try
- use macros in Source0, apply examples patch, +whitespace between .spec sections
- 5.11.1
- Update to Qt 5.5.1 RC1
- Upstream Release Candidate 1
- Official beta3 release
qt5-qttools-common-5.15.3-6.el8.noarch.rpm | - drop deprecated Encoding= key from .desktop files
- add justification for desktop vendor usage
- Downgrade llvm_toolset version
- Rebuild (LLVM-16)
Resolves: bz#2192951
- 5.15.3
Resolves: bz#2061406
- use system clucene09-core
- Upstream beta 3
- Update to Qt 5.5.1 RC1
- lupdate can't find qmake configuration file default (#1009893)
- Update for official RC1 released packages
- 5.4.1
- Rebuild (LLVM-17)
Resolves: RHEL-10694
- -assistant: Provides: bundled(clucene09) (f26+)
- BR and rebuild against reference-counting-enabled clucene09 (#1128293)
- 5.15.2
Resolves: bz#1930043
- respin system-clucene.patch
- disable system_lucene on f26+ (#1424227, #1424046)
- 5.6.0 final release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- 5.4.2
- Second round of builds now with bootstrap enabled due new qttools
- epel7 bootstrapped
- workaround Qt5Designer.pc reference to non-existent Qt5UiPlugin.pc
- rebuild
- 5.9.1
- ExclusiveArch: {ix86} x86_64 {arm}
- epel-6 love
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- bootstrap ppc
- Reenable examples. Some interfaces marked as examples are needed from phonon
- Update to second rc snapshot
- rebuild (gcc5)
- first try
- rebuild (arm/qreal)
- rebuild (gcc5)
- rebuild
- Add versioned dependencies between subpackages
Resolves: bz#2144798
- Fix unit tests for gating
Resolves: bz#1681905
- Remove obsolete scriptlets
- use upstream cmake fix(es) (QTBUG-32570, #1006254)
- fix icon name in qdbusviewer-qt5.desktop
- Qt 5 Designer has 128x128 icon in 32x32 folder (#1400972)
- Rebuld for LLVM 7.0.1
Resolves: bz#1657229
- libQt5Designer should be in a subpackage (#1156685)
- -doc: disable(boostrap for new clucene), drop dep on main pkg
- BR: pkgconfig(zlib)
- -static subpkg
- Start to implement 5.6.0 rc, bootstrapped
- Qt 5 Designer has 128x128 icon in 32x32 folder (#1400972)
- qt5-designer, qt5-linguist, qt5-qhelpgenerator subpkgs
- New final upstream release Qt 5.5.0
- Add explicit -latomic on 32-bit MIPS
- update source URL, use %license
- qt5-linguist: move lconvert,lrelease,lupdate, cmake Qt5LinguistTools here
- add .desktop/icons for assistant, designer, linguist, qdbusviewer
- fix Release, Obsoletes: qt5-qttools-libs-clucene (#1454531)
- qttools-5.1.1
- qt5-assistant, qt5-qdbusviewer, qt5-designer-plugin-webkit subpkgs (to match qt4)
- 5.2.1
- 5.2.0
- -examples subpkg
- 5.6.0 final release
- disable bootstrap (reenable -doc)
- system-clucene patch: drop -fpermissive flag
- system-clucene patch: use toLocal8Bit instead of toStdString
- system_clucene: BR clucene09-core-devel >= 0.9.21b-12 (-11 was broken)
- de-bootstrap, enable -doc/-webkit
- 5.2.0-rc1
- Update RC release
- Update to final RC
- Obsoletes: qt5-designer-plugin-webkit (upgrade path when webkit support is not enabled)
- resurrect bootstrap macro (commented)
- 5.11.1
- out-of-tree build, use %qmake_qt5
- 5.3.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Compiled with gcc
- de-bootstrap
- bootstrap 5.8.0 (rawhide)
- Created a meta package called qt5-doctools to avoid the mess of multiple tools
- port QTBUG-43057 workaround
- Rebuild (LLVM-10)
Resolves: bz#1832857
- 5.4.0 (final)
- 5.10.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- New upstream version
- de-bootstrap
- Qt 5.7.0 release
- 5.10.1
- install Linguist icon as linguist-qt5.png, fixes file conflict (#1169127)
- Rebuild to fix CET notes
Resolves: bz#1657229
- 5.3.0
- Upstream Release Candidate retagged
- rebuild
- wrong path to lrelease (#1006254)
- %check: first try
- -devel: Requires: qt5-designer-plugin-webkit
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuild (LLVM-15)
Resolves: bz#2119038
- BR: qt5-qtbase-private-devel
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Update to final rc release
- Disable bootstrap
- 5.4.0-rc
- de-bootstrap
- restore system-clucene patch, rm the bundled copy
- Rebuild only in CentOS Stream for the right llvm links
- 5.9.2
- 5.2.0-rc1
- 5.12.5
Resolves: bz#1733152
- 5.3.1
- (re)fix bootstrap macro
- include qt5-qdoc/qt5-qhelpgenerator build dep deps in -doc subpkg only
- fix whitespace
- 5.2.0-alpha
- -doc subpkg
- Official rc release
- Rebuild (LLVM-12)
Resolves: bz#1930043
- enable -doc only on primary archs (allow secondary bootstrap)
- 5.4.0-rc
- Create a tests subpkg with unit tests for gating
Resolves: bz#1681905
- 5.9.3
- rebuild (gcc5)
- Rebuild (LLVM-14)
Resolves: bz#2064527
- Rebuild for LLVM 8.0.0
Resolves: bz#1709949
- Upstream official release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- system-clucene patch: create path recursively in QtCLucene, CLucene can't
- Update to final release 5.5.1
- Qt 5.5.0 RC1
- Rebuild (binutils)
Resolves: bz#1930043
- -static: move qt_lib_uitools*.pri here (#1396836)
- Fix unit tests for gating
Resolves: bz#1681905
- Rebuild (LLVM-13)
Resolves: bz#2001153
- 5.7.1 dec5 snapshot
- 5.0.2
- -devel: restore Requires: qt5-designer qt5-linguist
- Prepare 5.7.0
- enable qdoc
qt5-qttools-libs-designer-5.15.3-6.el8.x86_64.rpm | - drop deprecated Encoding= key from .desktop files
- add justification for desktop vendor usage
- Downgrade llvm_toolset version
- Rebuild (LLVM-16)
Resolves: bz#2192951
- 5.15.3
Resolves: bz#2061406
- use system clucene09-core
- Upstream beta 3
- Update to Qt 5.5.1 RC1
- lupdate can't find qmake configuration file default (#1009893)
- Update for official RC1 released packages
- 5.4.1
- Rebuild (LLVM-17)
Resolves: RHEL-10694
- -assistant: Provides: bundled(clucene09) (f26+)
- BR and rebuild against reference-counting-enabled clucene09 (#1128293)
- 5.15.2
Resolves: bz#1930043
- respin system-clucene.patch
- disable system_lucene on f26+ (#1424227, #1424046)
- 5.6.0 final release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- 5.4.2
- Second round of builds now with bootstrap enabled due new qttools
- epel7 bootstrapped
- workaround Qt5Designer.pc reference to non-existent Qt5UiPlugin.pc
- rebuild
- 5.9.1
- ExclusiveArch: {ix86} x86_64 {arm}
- epel-6 love
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- bootstrap ppc
- Reenable examples. Some interfaces marked as examples are needed from phonon
- Update to second rc snapshot
- rebuild (gcc5)
- first try
- rebuild (arm/qreal)
- rebuild (gcc5)
- rebuild
- Add versioned dependencies between subpackages
Resolves: bz#2144798
- Fix unit tests for gating
Resolves: bz#1681905
- Remove obsolete scriptlets
- use upstream cmake fix(es) (QTBUG-32570, #1006254)
- fix icon name in qdbusviewer-qt5.desktop
- Qt 5 Designer has 128x128 icon in 32x32 folder (#1400972)
- Rebuld for LLVM 7.0.1
Resolves: bz#1657229
- libQt5Designer should be in a subpackage (#1156685)
- -doc: disable(boostrap for new clucene), drop dep on main pkg
- BR: pkgconfig(zlib)
- -static subpkg
- Start to implement 5.6.0 rc, bootstrapped
- Qt 5 Designer has 128x128 icon in 32x32 folder (#1400972)
- qt5-designer, qt5-linguist, qt5-qhelpgenerator subpkgs
- New final upstream release Qt 5.5.0
- Add explicit -latomic on 32-bit MIPS
- update source URL, use %license
- qt5-linguist: move lconvert,lrelease,lupdate, cmake Qt5LinguistTools here
- add .desktop/icons for assistant, designer, linguist, qdbusviewer
- fix Release, Obsoletes: qt5-qttools-libs-clucene (#1454531)
- qttools-5.1.1
- qt5-assistant, qt5-qdbusviewer, qt5-designer-plugin-webkit subpkgs (to match qt4)
- 5.2.1
- 5.2.0
- -examples subpkg
- 5.6.0 final release
- disable bootstrap (reenable -doc)
- system-clucene patch: drop -fpermissive flag
- system-clucene patch: use toLocal8Bit instead of toStdString
- system_clucene: BR clucene09-core-devel >= 0.9.21b-12 (-11 was broken)
- de-bootstrap, enable -doc/-webkit
- 5.2.0-rc1
- Update RC release
- Update to final RC
- Obsoletes: qt5-designer-plugin-webkit (upgrade path when webkit support is not enabled)
- resurrect bootstrap macro (commented)
- 5.11.1
- out-of-tree build, use %qmake_qt5
- 5.3.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Compiled with gcc
- de-bootstrap
- bootstrap 5.8.0 (rawhide)
- Created a meta package called qt5-doctools to avoid the mess of multiple tools
- port QTBUG-43057 workaround
- Rebuild (LLVM-10)
Resolves: bz#1832857
- 5.4.0 (final)
- 5.10.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- New upstream version
- de-bootstrap
- Qt 5.7.0 release
- 5.10.1
- install Linguist icon as linguist-qt5.png, fixes file conflict (#1169127)
- Rebuild to fix CET notes
Resolves: bz#1657229
- 5.3.0
- Upstream Release Candidate retagged
- rebuild
- wrong path to lrelease (#1006254)
- %check: first try
- -devel: Requires: qt5-designer-plugin-webkit
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuild (LLVM-15)
Resolves: bz#2119038
- BR: qt5-qtbase-private-devel
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Update to final rc release
- Disable bootstrap
- 5.4.0-rc
- de-bootstrap
- restore system-clucene patch, rm the bundled copy
- Rebuild only in CentOS Stream for the right llvm links
- 5.9.2
- 5.2.0-rc1
- 5.12.5
Resolves: bz#1733152
- 5.3.1
- (re)fix bootstrap macro
- include qt5-qdoc/qt5-qhelpgenerator build dep deps in -doc subpkg only
- fix whitespace
- 5.2.0-alpha
- -doc subpkg
- Official rc release
- Rebuild (LLVM-12)
Resolves: bz#1930043
- enable -doc only on primary archs (allow secondary bootstrap)
- 5.4.0-rc
- Create a tests subpkg with unit tests for gating
Resolves: bz#1681905
- 5.9.3
- rebuild (gcc5)
- Rebuild (LLVM-14)
Resolves: bz#2064527
- Rebuild for LLVM 8.0.0
Resolves: bz#1709949
- Upstream official release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- system-clucene patch: create path recursively in QtCLucene, CLucene can't
- Update to final release 5.5.1
- Qt 5.5.0 RC1
- Rebuild (binutils)
Resolves: bz#1930043
- -static: move qt_lib_uitools*.pri here (#1396836)
- Fix unit tests for gating
Resolves: bz#1681905
- Rebuild (LLVM-13)
Resolves: bz#2001153
- 5.7.1 dec5 snapshot
- 5.0.2
- -devel: restore Requires: qt5-designer qt5-linguist
- Prepare 5.7.0
- enable qdoc
qt5-qttools-libs-help-5.15.3-6.el8.x86_64.rpm | - drop deprecated Encoding= key from .desktop files
- add justification for desktop vendor usage
- Downgrade llvm_toolset version
- Rebuild (LLVM-16)
Resolves: bz#2192951
- 5.15.3
Resolves: bz#2061406
- use system clucene09-core
- Upstream beta 3
- Update to Qt 5.5.1 RC1
- lupdate can't find qmake configuration file default (#1009893)
- Update for official RC1 released packages
- 5.4.1
- Rebuild (LLVM-17)
Resolves: RHEL-10694
- -assistant: Provides: bundled(clucene09) (f26+)
- BR and rebuild against reference-counting-enabled clucene09 (#1128293)
- 5.15.2
Resolves: bz#1930043
- respin system-clucene.patch
- disable system_lucene on f26+ (#1424227, #1424046)
- 5.6.0 final release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- 5.4.2
- Second round of builds now with bootstrap enabled due new qttools
- epel7 bootstrapped
- workaround Qt5Designer.pc reference to non-existent Qt5UiPlugin.pc
- rebuild
- 5.9.1
- ExclusiveArch: {ix86} x86_64 {arm}
- epel-6 love
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- bootstrap ppc
- Reenable examples. Some interfaces marked as examples are needed from phonon
- Update to second rc snapshot
- rebuild (gcc5)
- first try
- rebuild (arm/qreal)
- rebuild (gcc5)
- rebuild
- Add versioned dependencies between subpackages
Resolves: bz#2144798
- Fix unit tests for gating
Resolves: bz#1681905
- Remove obsolete scriptlets
- use upstream cmake fix(es) (QTBUG-32570, #1006254)
- fix icon name in qdbusviewer-qt5.desktop
- Qt 5 Designer has 128x128 icon in 32x32 folder (#1400972)
- Rebuld for LLVM 7.0.1
Resolves: bz#1657229
- libQt5Designer should be in a subpackage (#1156685)
- -doc: disable(boostrap for new clucene), drop dep on main pkg
- BR: pkgconfig(zlib)
- -static subpkg
- Start to implement 5.6.0 rc, bootstrapped
- Qt 5 Designer has 128x128 icon in 32x32 folder (#1400972)
- qt5-designer, qt5-linguist, qt5-qhelpgenerator subpkgs
- New final upstream release Qt 5.5.0
- Add explicit -latomic on 32-bit MIPS
- update source URL, use %license
- qt5-linguist: move lconvert,lrelease,lupdate, cmake Qt5LinguistTools here
- add .desktop/icons for assistant, designer, linguist, qdbusviewer
- fix Release, Obsoletes: qt5-qttools-libs-clucene (#1454531)
- qttools-5.1.1
- qt5-assistant, qt5-qdbusviewer, qt5-designer-plugin-webkit subpkgs (to match qt4)
- 5.2.1
- 5.2.0
- -examples subpkg
- 5.6.0 final release
- disable bootstrap (reenable -doc)
- system-clucene patch: drop -fpermissive flag
- system-clucene patch: use toLocal8Bit instead of toStdString
- system_clucene: BR clucene09-core-devel >= 0.9.21b-12 (-11 was broken)
- de-bootstrap, enable -doc/-webkit
- 5.2.0-rc1
- Update RC release
- Update to final RC
- Obsoletes: qt5-designer-plugin-webkit (upgrade path when webkit support is not enabled)
- resurrect bootstrap macro (commented)
- 5.11.1
- out-of-tree build, use %qmake_qt5
- 5.3.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Compiled with gcc
- de-bootstrap
- bootstrap 5.8.0 (rawhide)
- Created a meta package called qt5-doctools to avoid the mess of multiple tools
- port QTBUG-43057 workaround
- Rebuild (LLVM-10)
Resolves: bz#1832857
- 5.4.0 (final)
- 5.10.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- New upstream version
- de-bootstrap
- Qt 5.7.0 release
- 5.10.1
- install Linguist icon as linguist-qt5.png, fixes file conflict (#1169127)
- Rebuild to fix CET notes
Resolves: bz#1657229
- 5.3.0
- Upstream Release Candidate retagged
- rebuild
- wrong path to lrelease (#1006254)
- %check: first try
- -devel: Requires: qt5-designer-plugin-webkit
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuild (LLVM-15)
Resolves: bz#2119038
- BR: qt5-qtbase-private-devel
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Update to final rc release
- Disable bootstrap
- 5.4.0-rc
- de-bootstrap
- restore system-clucene patch, rm the bundled copy
- Rebuild only in CentOS Stream for the right llvm links
- 5.9.2
- 5.2.0-rc1
- 5.12.5
Resolves: bz#1733152
- 5.3.1
- (re)fix bootstrap macro
- include qt5-qdoc/qt5-qhelpgenerator build dep deps in -doc subpkg only
- fix whitespace
- 5.2.0-alpha
- -doc subpkg
- Official rc release
- Rebuild (LLVM-12)
Resolves: bz#1930043
- enable -doc only on primary archs (allow secondary bootstrap)
- 5.4.0-rc
- Create a tests subpkg with unit tests for gating
Resolves: bz#1681905
- 5.9.3
- rebuild (gcc5)
- Rebuild (LLVM-14)
Resolves: bz#2064527
- Rebuild for LLVM 8.0.0
Resolves: bz#1709949
- Upstream official release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- system-clucene patch: create path recursively in QtCLucene, CLucene can't
- Update to final release 5.5.1
- Qt 5.5.0 RC1
- Rebuild (binutils)
Resolves: bz#1930043
- -static: move qt_lib_uitools*.pri here (#1396836)
- Fix unit tests for gating
Resolves: bz#1681905
- Rebuild (LLVM-13)
Resolves: bz#2001153
- 5.7.1 dec5 snapshot
- 5.0.2
- -devel: restore Requires: qt5-designer qt5-linguist
- Prepare 5.7.0
- enable qdoc
qt5-qtwebchannel-5.15.3-1.el8.x86_64.rpm | - 5.4.2
- add versioned dep on qt5-qtbase due to private api usage
- Update RC release
- Upstream beta 3
- Official rc release
- Initial release.
- Rebuild to fix CET notes
Resolves: bz#1657242
- 5.9.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- 5.10.1
- Compiled with gcc
- update source URL, use %license, BR: cmake
- 5.5.0
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- refer to other qt5- builddeps directly
- Update to 5.6.1
- New upstream version
- 5.10.0
- Update for final qt 5.5.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- 5.9.3
- Update to final rc release
- Qt 5.7.0 release
- Start to implement 5.6.0 rc
- Upstream official release
- 5.6.0 final release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Upstream Release Candidate retagged
- 5.12.5
Resolves: bz#1733155
- restore bootstrap macro support
- rebuild
- Update to final RC
- New upstream version
- 5.15.3
Resolves: bz#2061409
- drop BR: cmake (handled by qt5-rpm-macros now)
- 5.7.1 dec5 snapshot
- Rebuild (binutils)
Resolves: bz#1930059
- rebuild
- -docs: BuildRequires: qt5-qhelpgenerator, standardize bootstrapping
- 5.9.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- tighten qtbase dep (#1233829)
- 5.15.2
Resolves: bz#1930059
- 5.11.1
- Update to Qt 5.5.1 RC1
qt5-qtwebsockets-5.15.3-1.el8.x86_64.rpm | - 5.4.2
- Upstream beta 3
- Initial release.
- Rebuild (binutils)
Resolves: bz#1930060
- build docs on all archs
- 5.9.2
- Update to final beta release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- 5.10.1
- 5.5.0
- Update to 5.6.1
- New upstream version
- 5.10.0
- Add a public api to set max frame and message size
Resolves: bz#1815187
- update source URL, use %license, BR: cmake
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Start to implement 5.6.0 beta
- New upstream release
- 5.9.3
- 5.15.2
Resolves: bz#1930060
- 5.12.5
Resolves: bz#1733156
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Qt 5.7.0 release
- filter qml provides, BR: qtbase qtdeclarative explicitly
- Upstream official release
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- 5.6.0 final release
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- 5.4.1
- Update to final release 5.5.1
- Upstream Release Candidate retagged
- restore bootstrap macro support
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- rebuild
- Update to final RC
- 5.7.1 dec5 snapshot
- rebuild
- Official beta release
- BR: qt5-qtbase-private-devel
- -docs: BuildRequires: qt5-qhelpgenerator, standardize bootstrapping
- 5.9.1
- Integrate RC release
- Rebuild to fix CET notes
Resolves: bz#1657244
- 5.15.3
Resolves: bz#2061410
- tighten qtbase dep (#1233829)
- 5.11.1
- Update to Qt 5.5.1 RC1
qt5-qtx11extras-5.15.3-1.el8.x86_64.rpm | - 5.7.1 dec5 snapshot
- drop BR: cmake (handled by qt5-rpm-macros now)
- Remove ppc64 exclude
- rebuild (arm/qreal)
- Official beta release
- Rebuild (binutils)
Resolves: bz#1930062
- 5.4.0-beta
- build docs on all archs
- 5.9.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- 5.10.1
- Compiled with gcc
- -doc subpkg
- use %version macro in Source0,
- use %autosetup
- +whitespace between .spec sections
- 5.3.0
- 5.3.1
- Update to 5.6.1
- New upstream version
- Update for official RC1 released packages
- 5.4.0 (final)
- 5.10.0
- 5.4.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- out-of-tree build, use %qmake_qt5
- Rebuild to fix CET notes
Resolves: bz#1657239
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- Start to implement 5.6.0 beta
- 5.2.1
- 5.9.3
- Integrate rc packages
- New final upstream release Qt 5.5.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- rebuild (gcc5)
- Qt 5.7.0 release
- 5.12.5
Resolves: bz#1733158
- Update to final beta release
- New upstream beta
- Upstream official release
- 5.15.2
Resolves: bz#1930062
- 5.6.0 final release
- 5.3.2
- 5.15.3
Resolves: bz#2061411
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Initial packaging
- Update to final release 5.5.1
- Upstream Release Candidate retagged
- 5.4.0-rc
- Qt 5.5.0 RC1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- 5.4.2
- rebuild
- Update to final RC
- Beta 3 release
- 5.2.0-beta1
- New upstream release
- rebuild
- BR: cmake, update source URL, use %license
- 5.2 alpha
- 5.9.1
- 5.2.0
- use standard (same as qtbase) .la/.prl sanitation
- tighten qtbase dep (#1233829)
- Bulk sad and useless attempt at consistent SPEC file formatting
- Rebuilt for GCC 5 C++11 ABI change
- 5.11.1
- Update to Qt 5.5.1 RC1
- Upstream Release Candidate 1
qt5-qtxmlpatterns-5.15.3-1.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- 5.12.5
Resolves: bz#1733157
- Official beta3 release
- New upstream version
- Prepare 5.7.0 release
- BR: qt5-qtbase-private-devel, use %autosetup
- 5.9.2
- 5.3.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Compiled with gcc
- 5.2.0-rc1
- New upstream beta release
- 5.3.0
- rebuild (gcc5)
- update source URL, BR: cmake, use %license
- 5.3.1
- Add qt5-qtbase-doc as requires to doc creation.
- Start to implement 5.6.0 beta3
- Update to 5.6.1
- New upstream version
- Update to final RC
- Update for official RC1 released packages
- 5.10.0
- rebuild
- 5.4.1
- 5.4.0 (final)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- rebuild (arm/qreal)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- New upstream beta3 release
- 5.9.3
- New final upstream release Qt 5.5.0
- use standard (same as qtbase) .prl sanitation
- Beta 2
- 5.6.0 release
- Qt 5.7.0 release
- rebuild (gcc5)
- 5.4.0-beta3
- %doc LICENSE.GPL LICENSE.LGPL LGPL_EXCEPTION.txt
- update Source URL
- 5.1.1
- 5.10.1
- Upstream official release
- drop shadow/out-of-tree builds (#1456211,QTBUG-37417)
- 5.7.1 dec5 snapshot
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to final release 5.5.1
- Upstream Release Candidate retagged
- 5.2.0-alpha
- -doc subpkg
- drop BR: cmake (handled by qt5-rpm-macros now)
- Qt 5.5.0 RC1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- 5.15.3
Resolves: bz#2061412
- bootstrap
- 5.15.2
Resolves: bz#1930061
- 5.4.2
- 5.4.0-rc
- Rebuild (binutils)
Resolves: bz#1930061
- Rebuild to fix CET notes
Resolves: bz#1657227
- out-of-tree build, use %qmake_qt5
- de-bootstrap
- 5.11.1
- rebuild
- 5.2.1
- epel7 bootstrapped
- build -doc on all archs
- -docs: BuildRequires: qt5-qhelpgenerator, standardize bootstrapping
- Integrate RC builds.
- 5.9.1
- rebuild
- de-bootstap
- Second round of builds now with bootstrap enabled due new qttools
- -examples subpkg
- 5.2.0
- tighten qtbase dep (#1233829)
- 5.2.0-beta31
- bootstrap ppc
- 5.0.2
- Rebuilt for GCC 5 C++11 ABI change
- Update to final beta3 release
- first try
- (re)enable bootstrap
- Update to Qt 5.5.1 RC1
- Upstream Release Candidate 1
samba-4.19.4-12.el8_10.x86_64.rpm | - New upstream version
- Add Nalin's signing-shortkey patch.
- Fix error in PREIN scriptlet in rpm package samba-common
- related: RHEL-16483 - Update to version 4.19.4
- move to 3.0.25rc3
- do not put comments inline on smb.conf options, they may be read
as part of the value (for example log files names)
- resolves: rhbz#2059151 - Fix username map for unix groups
- resolves: rhbz#2065212 - Fix 'create krb5 conf = yes` when a KDC has a single IP address.
- Add "net ads join createcomputer=ou1/ou2/ou3" fix (BZO #5465)
- Create separate packages for samba-winbind and samba-winbind-devel
- Add cifs.spnego helper
- resolves: #1227911 - Enable tar support for smbclient
- resolves: #1234908 - Own the /var/lib/samba directory
- Enable hardened build
- Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
- related: rhbz#2132051
- Upgrade to 3.0.5, which is a regression from 3.0.5pre1 for a
security fix.
- Include the 3.0.4-backport patch from the 3E branch. This restores
some of the 3.0.5pre1 and 3.0.5rc1 functionality.
- resolves: #919333 - Create /run/samba too.
- fix logrotate script (#13698)
- resolves: #1638001 - Rebase Samba to version 4.10
- bugfix for smbadduser script (#15148)
- related: rhbz#2132051 - Update to version 4.17.4
- resolves: rhbz#2154370 - Fix CVE-2022-38023
- resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
- resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory
- resolves: #1337260 - Small fix to the example smb.conf file
- Update to Samba 4.2.0rc5
- Call ldconfig at libwbclient and -winbind-clients post(un)install time.
- Fix empty localization files, use %find_lang to find and %lang-mark them.
- Escape macros in %changelog.
- Fix source tarball URL.
- convert to systemd
- restore epoch from f15
- related: rhbz#1944657 - Fix possible upgrade issues
- Make the logrotate script look the correct place for the pid files
- resolves: #1261230 - Update to Samba 4.3.1
- Update to Samba 4.4.4
- resolves: #1343529
- Update to Samba 4.6.0rc2
- resolves: rhbz#2221594 - Fix broken symlink for libwbclient
- resolves: rhbz#2221600 - Fix segfault of winbind child when listing users with `winbind scan trusted domains = yes`
- resolves: rhbz#2175385 - Fix access of Samba share with veto files = /.*/
- resolves: rhbz#2218237 - Fix Python tarfile extraction to avoid a warning
- resolves: #1491137 - dcerpc/__init__.py is not packaged for py3
- related: #884169 - Fix the upgrade path.
- Update to Samba 4.1.9.
- resolves: #1112251 - Fix CVE-2014-0244 and CVE-2014-3493.
- related: rhbz#1979959 - Fix typo in testparm output
- set passdb backend = tdbsam as default in smb.conf
- remove samba-docs dependency from swat, that was a mistake
- put back COPYING and other files in samba-common
- put examples in samba not in samba-docs
- leave only stuff under docs/ in samba-doc
- Update to 3.2.0pre2
- Add talloc and tdb lib and devel packages
- Add domainjoin-gui package
- Fixes: #1219832: Samba 4.2 broke FreeIPA trusts to AD
- Remove usage of deprecated API from gnutls
- Update to Samba 4.6.0rc3
- turn of SSL, kerberos
- Rebuilt for Python 3.7
- Fix dependencies to samba-common
- resolves: rhbz#2169339 - Fix winbind memory leak
- resolves: rhbz#2152899 - Fix Samba shares not accessible issue
- Fix #64804
- 2.2.4
- Removed some zero-length and CVS internal files
- Make it build
- add a patch to fix dropped reconnection attempts
- resolves: rhbz#2076505 - PAM Kerberos authentication fails with a clock skew error
- final 3.0.25
- includes security fixes for CVE-2007-2444,CVE-2007-2446,CVE-2007-2447
- go back to stop/start for restart (-HUP didn't work in testing)
- fix trigger, again.
- turn off mmap. ;)
- Rebuilt for new readline.
- exit successfully from preun script (bug #30644).
- resolves: RHEL-101902 - Fix DC discovery after Windows netlogon hardening - follow-up
- resolves: RHEL-111318 - Fix winbind fork bomb in 'IPA with AD trust' environment
- Update to Samba 4.15.4
- related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
- resolves: rhbz#2039153 - Fix CVE-2021-20316
- resolves: rhbz#1912549 - Winexe: Kerberos flag not invoking Kerberos Auth
- resolves: rhbz#2039157 - Fix CVE-2021-43566
- resolves: rhbz#2038148 - Failed to authenticate users after upgrade samba package to release samba-4.14.5-7
- resolves: rhbz#2035528 - [smb] Segmentation fault when joining the domain
- resolves: rhbz#2038796 - filename_convert_internal: open_pathref_fsp [xxx] failed: NT_STATUS_ACCESS_DENIED
- fixes for ia64
- #resolves: #1451486 - Add source tarball comment
- Reduce dependencies of samba-devel and create samba-test-devel package.
- Update to 3.6.0pre2
- Samba 3.0.3 released.
- enable Kerberos 5 and SSL support
- patch for duplicate profile.h headers
- Update to Samba 4.5.1
- resolves: #1642092 - Harden [homes] share export
- resolves: #1648846 - Fix out of bound array access in ctdb
- resolves: #1657266 - Fix tmp directory creation in /run
- rebuilt
- resolves: #1042845 - Do not build with libbsd.
- Update to Samba 4.7.0
- resolves: #1493441 - Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163
- Update to Samba 4.4.0rc4
- resolves: #1315942 - CVE-2015-7560 Incorrect ACL get/set allowed on symlink path
- adjust the Requires: for the scripts, add "chkconfig --add smb"
- rename samba logs (#11606)
- Fix printing tdb upgrade for 3.6.6
- resolves: #841609
- Improve dependencies of vfs-glusterfs and vfs-cephfs.
- Remove unused python_libdir.
- Fix malformed changelog entries.
- Update to 3.6.0pre1
- fixes in smb.conf
- advice in smb.conf to put scripts in /var/lib/samba/scripts
- create /var/lib/samba/scripts so that selinux can be happy
- fix Vista problems with msdfs errors
- add a %defattr for -common
- Update to Samba 4.5.0rc1
- Update to Samba 4.4.0
- Fix awk as a dependency (and require gawk)
- Fix the -logfiles patch to close
bz#199607 Samba compiled with wrong log path.
bz#199206 smb.conf has incorrect log file path
- put smbpasswd in samba-common (#25429)
- Update to 3.3.0 final
- Add upstream fix for ldap connections to AD (Bug #6073)
- Remove bogus perl dependencies (resolves: #473051)
- Update the -man patch to fix ntlm_auth.1 too.
- Move pam_smbpass.so to the -common package, so both the 32
and 64-bit versions will be installed on multiarch platforms.
This closes bz#143617
- Added new -delim patch to fix mount.cifs so it can accept
passwords with commas in them (via environment or credentials
file) to close bz#144198
- Update to Samba 4.7.0rc3
- Perl 5.20 rebuild
- Update to Samba 4.8.0rc4
- Updated version and codepage info.
- Release to test name resolve order
- Rebuild with krb5 1.18
- Resolves: #1817578 - support krb5 1.18
- related: #1754409 - Fix pidl packaging
- Perl 5.24 rebuild
- add domain parsing to mount.smb
- Update to Samba 4.6.0rc1
- related: #1856315 - Fix net-ads-join with LDAP over TLS
- 2.2.1a bugfix release
- Add libsmbclient.a w/headerfile for KDE (#62202)
- Update to Samba 4.7.3
- resolves: #1515692 - Security fix for CVE-2017-14746 and CVE-2017-15275
- Rebuild for openldap bump
- related: rbhz#2019674 - Fix CVE-2020-25717
- Add missing checks for IPA DC server role
- Update to Samba 4.6.5
- Create python[2|3]-samba-dc packages
- Update to Samba 4.1.8.
- resolves: #1102528 - CVE-2014-0178.
- New upstream version
- use % { SOURCE1 } instead of a hardcoded path
- include -winbind patch from Gerald (Jerry) Carter (jerry@samba.org)
https://bugzilla.samba.org/show_bug.cgi?id=1315
to make winbindd work against Windows versions that do not have
128 bit encryption enabled.
- Moved %{_bindir}/net to the -common package, so that folks who just
want to use winbind, etc don't have to install -client in order to
"net join" their domain.
- New upstream version obsoletes the patches added in 3.0.3-5
- Remove smbgetrc.5 man page, since we don't ship smbget.
- Update to 3.2.2
- Add fixes for libsmbclient and support for r/o relocations
- build as 2.2.0-1 release
- skip the documentation-directories docbook, manpages and yodldocs
- don't include *.sgml documentation in package
- moved codepage-directory to /usr/share/samba/codepages
- make it compile with glibc-2.2.3-10 and kernel-headers-2.4.2-2
- Fix glfs_realpath allocation in vfs_glusterfs
- related: rhbz#1944657 - Update to version 4.14.5
- resolves: rhbz#1969787 - Fix memory leak in RPC server
- resolves: rhbz#1954974 - Validate smb.conf option for domain members with testparm
- resolves: rhbz#1963298 - Fix smbd trying to delete files with wrong permissions
- resolves: rhbz#1890008 - Update rpcclient manpage to list all available commands
- resolves: rhbz#1857254 - Update smbcacls manpage to document inhertance flags
- Fix release number
- Update to Samba 4.6.4
- resolves: #1455050 - Security fix for CVE-2017-7494
- New upstream release.
- Update to Samba 4.0.6.
- Remove SWAT.
- Fix nmbd init script nmbd reload was causing smbd not nmbd to reload the
configuration
- Fix upstream bug 6224, nmbd was waiting 5+ minutes before running elections on
startup, causing your own machine not to show up in the network for 5 minutes
if it was the only client in that workgroup (fix committed upstream)
- separate out CIFS tools into cifs-utils package
- Don't include smbpasswd in samba, it's in samba-common (#51598)
- Add a disabled "obey pam restrictions" statement - it's not
active, as we use encrypted passwords, but if the admin turns
encrypted passwords off the choice is available. (#31351)
- Compile default auth methods into smbd.
- rebuild in new environment
- epochs from deps, req exact release
- rebuild against new openssl
- Move the post/preun of winbind into the -common subpackage,
where the script is (#66128)
- related: #1614232 - Update to Samba 4.9.0rc5
- resolves: #1610909 - Re-enable glubsterfs vfs module
- resolves: #1624170 - Build with -fstack-protectore-strong if available
- resolves: #1602685 - Fixed issues found by covscan
- script cleanups. Again.
- resolves: #1754409 - Rebase to Samba version 4.11.2
- resolves: #1776312 - Winbind is not restarted on upgrade
- resolves: #1764469 - Fix CVE-2019-10218
- resolves: #1746241 - Fix CVE-2019-10197
- resolves: #1710980 - Add support for KCM ccache in pam_winbind
- Update to Samba 4.6.2
- related: #1435156 - Security fix for CVE-2017-2619
- Add the /etc/samba directory to samba-common
- Update to Samba 4.6.1
- resolves: #1435156 - Security fix for CVE-2017-2619
- update to 2.0.4a
- fix mount.smb arg ordering
- Add improvements to the smb.conf as suggested in #16931
- resolves: #1902198 - Document weak crypto output of testparm
- munge post scripts slightly
- Use alternatives to configure winbind_krb5_locator.so
- Fix Requires for winbind.
- Various updates to inline documentation in default smb.conf file
- resolves: #483703
- resolves: #1174412 - Build VFS Ceph module.
- resolves: #1169067 - Move libsamba-cluster-support.so to samba-libs package.
- resolves: #1016122 - Move smbpasswd to samba-common package.
- initscript munging
- More spec file fixes
- 2.2.5
- mount.smb/mount.smbfs go in /sbin, *not* %{_sbindir}
- Update to Samba 4.9.0rc1
- Make sure ncacn_ip_tcp client code looks for NBT_NAME_SERVER name types.
- resolves: #1319098 - Add missing Requires for pre-required packages
- fix unresolved symbols in libsmbclient which caused applications
such as KDE's konqueror to fail when accessing smb:// URLs. #139894
- Update to Samba 4.2.0
- Update to 3.6.0rc1
- Backport base64_decode patche to close CAN-2004-0500
- Backport hash patch to close CAN-2004-0686
- use_authtok patch from Nalin Dahyabhai
- smbclient-kerberos patch from Alexander Larsson
- passwd patch uses "*" instead of "x" for "hashed" passwords for
accounts created by winbind. "x" means "password is in /etc/shadow" to
brain-damaged pam_unix module.
- resolves: RHEL-119843 - Fix stale sharemode entries which can cause deadlocks
- Re-enable the x_fclose patch that was accidentally disabled
in 3.0.8-0.pre1.1. This closes #135832
- include Nalin's -fqdn and -salt patches.
- resolves: #948509 - Fix manpage correctness.
- Upgrade to 2.2.8
- removed commented out patches.
- removed old patches and .md5 files from the repository.
- remove duplicate /sbin/chkconfig --del winbind which causes
warnings when removing samba.
- Fixed minor bug in smbprint that causes it to fail when called with
more than 10 parameters: the accounting file (and spool directory
derived from it) were being set wrong due to missing {}. This closes
bug #86473.
- updated smb.conf patch, includes new defaults to close bug #84822.
- resolves: #1033595 - Fix segfault in winbind.
- rebuilt
- fix pam_smbpass patch.
- New upstream release.
- the -64bit-timestamps, -clitar, -establish_trust, user_rights_v1,
winbind_find_dc_v2 patches are now obsolete.
- fix arch macro which reported Vista to Samba clients.
- Fix systemd library detection (incomplete patch upstream)
- Perl 5.18 rebuild
- related: #1638001 - Rebase to Samba version 4.10.3
- automatic rebuild
- New upstream RC release.
- Update the -logfiles, and -passwd patches for
3.0.23rc3
- Include the change to smb.init from Bastien Nocera )
to close
bz#182560 Wrong retval for initscript when smbd is dead
- Update this spec file to build with 3.0.23rc3
- Remove the -install.mount.smbfs patch, since we don't install
mount.smbfs any more.
- Update to Samba 4.5.0
- Use workaround for winbind default domain only when set.
- Build with old ctdb support.
- Move dsdb libs to python2-samba-dc
- resolves: rhbz#2190417 - Update to version 4.18.4
- Fix security=server
- resolves: #449038, #449039
- rebuild with AD DNS Update support
- related: #1614232 - Add CTDB examples with a config migration script
- Package smbprint again.
- Update to Samba 4.3.0rc3
- automated rebuild
- Update to 3.5.4
- resolves: #996160 - Fix winbind with trusted domains.
- add proper ldconfig calls
- resolves: #1552652 - Fix usage of nc in ctdb tests and only recommned it
- Add systemd integration to the service daemons.
- Make it not depend on Net::LDAP - those are doc files and examples
- Spec file cleanup
- Fix sources upstream location
- Remove conditionals to build talloc and tdb, now they are completely indepent
packages in Fedora
- Add defattr() where missing
- Turn all tabs into 4 spaces
- Remove unused migration script
- Split winbind-clients out of main winbind package to avoid multilib to include
huge packages for no good reason
- Update to Samba 4.0.3.
- resolves: #907544 - Add unowned directory /usr/lib64/samba.
- resolves: #906517 - Fix pidl code generation with gcc 4.8.
- resolves: #908353 - Fix passdb backend ldapsam as module.
- Update to 4.0.0rc1.
- Fix winbind cache upgrade.
- resolves: #760137
- rebuild to fox dependencies
- man pages are compressed
- auto rebuild in the new build environment (release 3)
- resolves: #1476175 - Create seperate package for bind_dlz module
- Update to Samba 4.8.3
- Remove python(2|3)-subunit dependency
- Fix cli_read()
- resolves: #516165
- Avoid private krb5_locate_kdc usage
- resolves: #754783
- related: rhbz#2077468 - Rebase Samba to 4.16.3
- resolves: rhbz#2106672 - The pcap background queue process should not be stopped
- resolves: rhbz#2106263 - Fix crash in rpcd_classic
- resolves: rhbz#2100093 - Fix net ads info returns LDAP server and LDAP server name
- Require samba-common-tools in samba package
- Require samba-common-tools in samba-client package
- resolves: #1215631 - /usr/bin/net moved to samba-common-tools but the package is not required by samba
- New upstream release
- Fix packaging issue wrt idmap modules used only by smbd
- Addedd Vista Patchset for compatibility with Windows Vista
- Change default of "msdfs root", it seem to cause problems with
some applications and it has been proposed to change it for
3.0.25 upstream
- New upstream version fixes CAN-2004-0930. This obsoletes the
disable-sendfile, salt, signing-shortkey and fqdn patches.
- Add my ugly non-ascii-domain patch.
- Updated the pie patch for 3.0.8.
- Updated the logfiles patch for 3.0.8.
- move initscript back
- remove 'Using Samba' book from %doc
- move stuff to /etc/samba (#13708)
- default configuration tweaks (#13704)
- some logrotate tweaks
- New upstream release
- add my -quoting patch, to fix swat with strings that contain
html meta-characters, and to use correct quote characters in
lists, closing bz#134310
- include the upstream winbindd_2k3sp1 patch
- include the -smbclient patch.
- include the -hang patch from upstream.
- Fix typo in winbind-krb-locator post uninstall script.
- new upstream release. This obsoletes the ldapsam_compat patches.
- Move pam_winbind.conf and the manpages to the right package.
- resolves: #1785134 - Fix libwbclient manual alternative settings
- Update to 3.3.3
- Rescue the install.mount.smbfs patch from Juanjo Villaplana
(villapla@si.uji.es) to prevent building the srpm from trashing your
installed /usr/bin/smbmount
- Update to Samba 4.8.1
- Enable VFS support and compile the "recycling" module (#69796)
- more selective includes of the examples dir
- related: rhbz#2013596 - Remove unneeded lmdb dependency
- Add commented out 'max protocol' to the default config.
- resolves: #1904174 - Fix ldap timeout with 'net ads join'
- Patch to allow password changes from machines patched with
Microsoft hotfix MS04-011.
- Include patches for https://bugzilla.samba.org/show_bug.cgi?id=1302
and https://bugzilla.samba.org/show_bug.cgi?id=1309
- resolves: rhbz#2084162 - Fix printer displays only after 300 seconds timeout
- Update to Samba 4.1.4.
- update to 2.0.3
- Update to Samba 4.4.5
- resolves: #1353504 - CVE-2016-2119
- add copytruncate to logrotate file (#14360)
- fix init script (#13708)
- resolves: rhbz#2019662 - Fix CVE-2016-2124
- resolves: rhbz#2019668 - Fix CVE-2021-23192
- resolves: rbhz#2019674 - Fix CVE-2020-25717
- Update to Samba 4.2.0rc2.
- resolves: #966130 - Fix build with MIT Kerberos.
- List vfs modules in spec file.
- Fix creation of /var/run/samba.
- resolves: #751625
- use internal dep generator.
- resolves: rhbz#2057503 - Fix winbind kerberos ticket refresh
- so many releases, so little time
- explicitly uncomment 'printing = bsd' in sample config
- resolves: #1663421 - Fix perl interpreter dependencies
- resolves: rhbz#2190417 - Rebuild to trigger distrobaker sync
- New 3.0.0 final release
- merge nmbd-netbiosname and testparm patches from 3E branch
- updated the -logfiles patch to work against 3.0.0
- updated the pie patch
- update the VERSION file during build
- use make -j if avaliable
- merge the winbindd_privileged change from 3E
- merge the "rm /usr/lib" patch that allows Samba to build on 64-bit
platforms despite the broken Makefile
- fix one problem with mount.smb script
- fix smbpasswd on sparc with a really ugly kludge
- fix ownership in -common package
- resolves: RHEL-33813 - Add option to request only POSIX groups from AD in idmap_ad
- resolves: 1375973 - Fix tevent incompatibility issue
- add smbspool back in (#15827)
- fix absolute symlinks (#16125)
- Update to Samba 4.6.0
- Created a samba-test-libs package.
- Use the updated filter-requires-samba.sh file, so we don't accidentally
pick up a dependency on perl(Crypt::SmbHash)
- Include the corrected docs tarball, and use it instead of the
obsolete docs from the upstream 3.0.8 tarball.
- Update the logfiles patch to work with the updated docs.
- Fix DC discovery after Windows netlogon hardening
- resolves: RHEL-101902
- New upstream version.
- Upgrade to 3.0.2a
- Fix provides for of libwclient-devel for samba-winbind-devel.
- Update to 3.4.2
- Security Release, fixes CVE-2009-2813, CVE-2009-2948 and CVE-2009-2906
- Add python3 support
- Fix %posttrans for libwbclient-devel
- Update to 3.5.0rc3
- New upstream version.
- Include post 3.0.6 patch from "Gerald (Jerry) Carter"
to fix a duplicate in the LDAP schema.
- Include 64-bit timestamp patch from Ravikumar (rkumar@hp.com)
to allow correct timestamp handling on 64-bit platforms and fix #126109.
- reenable the -pie patch. Samba is too widely used, and too vulnerable
to potential security holes to disable an important security feature
like -pie. The correct fix is to have the toolchain not create broken
executables when programs compiled -pie are stripped.
- Remove obsolete patches.
- Modify this spec file to put libsmbclient.{a,so} in the right place on
x86_64 machines.
- Apply the DEBUG patch
- resolves: #1924615 - Fix a memcache bug when cache is full
- resolves: #1924571 - Ensure that libwbclient has been updated before
restarting services
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Force samba-dc to use the same libldb version as LDB modules compiled
- resolves: #1507420 - LDB / Samba module version mismatch
- Fix missing doc files.
- Fix multilib issues
- rebuild
- sed "s|nawk|gawk|" /usr/bin/convert_smbpasswd
- upgrade to 2.2.8a
- remove old .md5 files
- add "pid directory = /var/run" to the smb.conf file. Fixes #88495
- Patch from jra@dp.samba.org to fix a delete-on-close regression
- 32/64bit padding fix (affects multilib installations)
- fix yp_get_default_domain in autoconf
- only link against readline for smbclient
- fix log rotation (#9909)
- Use password-auth common PAM configuration instead of system-auth
- fix for bug #176649
- Remove cifs.upcall and mount.cifs entirely
- Fix the cache dir to be /var/lib/samba to support upgrades.
- resolves: rhbz#2190417 - Add missing tests to fix osci.brew-build.tier0.functional
- New upstream version
- updated spec file to make libsmbclient.so executable. This closes
bugzilla #121356
- resolves: RHEL-45842 - Fix idmap_ad with trusted domains
- Update to Samba 4.0.4.
- Update to Samba 4.15.5
- related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
- resolves: rhbz#2046127 - Fix CVE-2021-44141
- resolves: rhbz#2046153 - Fix CVE-2021-44142
- resolves: rhbz#2044404 - Printing no longer works on Windows 7
- resolves: rhbz#2043154 - Fix systemd notifications
- resolves: rhbz#2049602 - Disable NTLMSSP for ldap client connections (e.g. libads)
- Update to Samba 4.1.0rc1.
- Update to 3.6.0rc2
- Build Samba with Active Directory support!
- Remove samba-common-tools from samba-client package as it brings back Python 2.7
- remove old source
- add patch to fix samba bugzilla 4772
- related: #985609 - Update to Samba 4.1.0.
- Fix ldonfig.
- Require systemd for samba-common package.
- resolves: #829197
- Correctly use system iniparser library
- Update to 2.2.7a
- Change default printing system to CUPS
- Turn on pam_smbpass
- Turn on msdfs
- change /var/log/samba to 0700
- turn on mmap support
- New upstream release.
- Use modified filter-requires-samba.sh from packaging/RHEL/setup/
to get rid of bogus dependency on perl(Unicode::MapUTF8)
- Update the -logfiles and -smb.conf patches to work with 3.0.23
- Perl 5.26 rebuild
- Merge from samba-3E-branch after samba-3.0.0rc1 was released
- make it possible to print against Vista and XP SP3 as servers
- resolves: #439154
- rebuilt
- Update to 3.5.0pre2
- Remove umount.cifs
- Update to Samba 4.4.0rc3
- Fix libsystemd patch (#1125086) so that it actually works
- Use Python 2 explicitly for samba-tool and other Python-based tools
- Install samba.service as it is required for the AD DC case
- Add smbclient fix (BZO #5452)
- resolves: #907915 - libreplace.so => not found
- resolves: #1614232 - Update to Samba 4.9.1
- resolves: #1088911 - Update to Samba 4.3.0
- Enable PAM session controll and password sync
- Update to 3.5.0rc1
- New upstream release. This obsoletes the -secret patch.
Include my changetrustpw patch to make "net ads changetrustpw" stop
aborting. This closes #134694
- Remove obsolete triggers for ancient samba versions.
- Move /var/log/samba to the -common rpm. This closes #76628
- Remove the hack needed to get around the bad docs files in the
3.0.8 tarball.
- Change the comment in winbind.init to point at the correct pidfile.
This closes #76641
- Perl 5.22 rebuild
- update to 2.0.6
- Update to Samba 4.1.2.
- New upstream version
- Updated configure line to remove --with-fhs and to explicitly set all
the directories that --with-fhs was setting. We were overriding most of
them anyway. This closes #118598
- resolves: #1508871 - Update to Samba 4.7.1
- related: #1842844 - Fix TLS connections with GnuTLS
- rebuilt
- update to 3.0.25a as it contains many fixes
- add a fix for pam_smbpass made by Günther but committed upstream after 3.0.25a was cut.
- rebuilt with new gnutls
- Temporarily remove smbtorture from samba-test due to Python 2 linkage
- related: #1609661 - samba-test package cannot be installed due to unresolved dependencies
- update to 2.0.0
- add %dir entries for %{_libdir}/samba and %{_libdir}/samba/charset
- Upgrade to new upstream version
- build mount.cifs for the new cifs filesystem in the 2.6 kernel.
- resolves: #1301002 - Enable avahi support
- Try to fix GCC 4.3 build
- Add --with-dnsupdate flag and also make sure other flags are required just to
be sure the features are included without relying on autodetection to be
successful
- resolves: #923765 - Improve packaging of README files.
- Add fix for CUPS problem, fixes bug #453951
- add -gcc4 patch to compile with gcc 4.
- remove the now obsolete -smbclient-kerberos.patch
- Include four upstream patches from
http://samba.org/~jerry/patches/post-3.0.11/
(Slightly modified the winbind_find_dc_v2 patch to apply easily with
rpmbuild).
- add samba.schema to /etc/openldap/schema
- Move /usr/lib{64,}/samba/libdsdb-garbage-collect-tombstones-samba4.so to samba-dc-libs
- Rebuild in rawhide against new krb5 1.16 and docbook-xml
- Upgrade to new upstream 3.0.23a
- include upstream samr_alias patch
- New major relase, minor switched from 0 to 2
- License change, the code is now GPLv3+
- Numerous improvements and bugfixes included
- package libsmbsharemodes too
- remove smbldap-tools as they are already packaged separately in Fedora
- Fix bug 245506
- related: #1637861 - Fix trust creation if weak crypto is disallowed
- update to 2.0.5
- fix mount.smb - smbmount options changed again.........
- fix postun. oops.
- update some stuff from the samba team's spec file.
- fixed logrotate script
- Update to Samba 4.8.2
- remove patch for bug 106483 as it introduces a new bug that prevents
the use of a credentials file with the smbclient tar command
- move the samba private dir from being the same as the config dir
(/etc/samba) to /var/lib/samba/private
- add a mount.smb to make smb mounting a little easier.
- smb filesystems apparently don't work on alpha. Oops.
- Convert more rpc modules to python3
- Explicitly specify Python artifacts in the spec to be able to catch unpackaged ones
- Split 'make test' Python code into separate python2-samba-test/python3-samba-test sub-packages
- Remove embedded python2-dns version, require python{2,3}-dns instead
- make sure all binaries are stripped
- Update to Samba 4.4.0rc2
- resolves: #1823612 - Fix segfault in 'net ads dns gethostbyname'
- resolves: #1792553 - Fix 'net ads join createcomputer=OU'
- Fix nmbd startup
- resolves: #741630
- add i18n support, japanese patch (#26253)
- Update to Samba 4.0.7.
- Fix the AD build.
- Create samba-client-libs subpackage.
- Fix multiarch issues by splitting the samba-common package.
- Update to Samba 4.7.0rc1
- Update to Samba 4.4.2, fix badlock security bug
- resolves: #1326453 - CVE-2015-5370
- resolves: #1326453 - CVE-2016-2110
- resolves: #1326453 - CVE-2016-2111
- resolves: #1326453 - CVE-2016-2112
- resolves: #1326453 - CVE-2016-2113
- resolves: #1326453 - CVE-2016-2114
- resolves: #1326453 - CVE-2016-2115
- resolves: #1326453 - CVE-2016-2118
- Update to 3.6.7
- updated init script to use graceful restart (not stop/start)
- Security Release, fixes CVE-2012-2111
- resolves: #817551
- update to 1.9.18p10.
- fix %triggerpostun.
- resolves: #1781232 - Fix smbclient debug message
- fix swat only_from line (#18726, others)
- fix attempt to write outside buildroot on install (#17943)
- resolves: #1300038 - PANIC: Bad talloc magic value - wrong talloc version used/mixed
- Update to Samba 4.7.0rc5
- version 2.0.7
- resolves: #1018856 - Fix installation of pam_winbind after upgrade.
- related: #1010722 - Split out a samba-winbind-modules package.
- related: #985609
- Fix rpminspect abidiff
- related: rhbz#2077468 - Rebase Samba to 4.16.2
- Fix Obsoletes/Provides for update from samba4.
- Bump release number to be bigger than samba4.
- Move tmpfiles.d config to common package as it is needed for smbd and
winbind.
- Make sure tmpfiles get created after installation.
- Do not install conflicting file _ldb_text.py
- Security update to 3.5.1
- Fixes CVE-2010-0728
- resolves: #867893 - Move /var/log/samba to samba-common package for
winbind which requires it.
- actually use the correct samba.pamd file not the old samba.pamd.stack file
- fix logifles and use upstream convention of log.* instead of our old *.log
Winbindd creates its own log.* files anyway so we will be more consistent
- install our own (enhanced) default smb.conf file
- Fix pam_winbind acct_mgmt PAM result code (prevented local users from
logging in). Fixed by Guenther.
- move some files from samba to samba-common as they are used with winbindd
as well
- resolves: rhbz#2013596 - Rebase to version 4.15.2
- resolves: rhbz#1999294 - Remove noisy error message in winbindd
- resolves: rhbz#1958881 - Don't require winbind being online for krb5 auth
with one-way trusts
- resolves: rhbz#2019461 - Fix deleting directories with dangling symlinks
- Add printadmin group for printer driver handling
- Update to Samba 4.3.0rc4
- include -smbspool patch to close bz#104136
- Update to 3.6.0pre3
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Fix pidfile locations so it runs properly again (2.2.4
added a new directtive - #65007)
- Include disable-sendfile patch to default "use sendfile" to "no".
This closes #132779
- Change all requires lines to list an explicit epoch. Closes #102715
- Add an explicit Epoch so that %{epoch} is defined.
- resolves: rhbz#2021425 - Add missing PAC buffer types to krb5pac.idl
- Update to Samba 4.0.0rc6.
- Add /etc/pam.d/samba for swat to work correctly.
- resolves #882700
- related: #1817557 - Move DECRPC mdssvc data files to correct package
- resolves: #1856676 - Fix lookuprids in winbind
- Update to Samba 4.6.3
- Activate multi channel support (switched off by default)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Add dependencies for ctdb.
- rebuilt
- 2.2.2
- New upstream version.
- Since the rawhide kernel has dropped support for smbfs, remove smbmount
and smbumount. Users should use mount.cifs instead.
- Upgrade to 3.0.21b
- edited spec file to put .so files in the correct directories
on 64-bit platforms that have 32-bit compatability issues
(sparc64, x86_64, etc). This fixes bugzilla #83782.
- Added samba-2.2.7a-error.patch from twaugh. This fixes
bugzilla #82454.
- resolves: RHEL-115067 - Fix regression with symlinks inside shares
- resolves: #1554754, #1554756 - Security fixes for CVE-2018-1050 CVE-2018-1057
- resolves: #1555112 - Update to Samba 4.8.0
- related: rbhz#2019674 - Fix regression with 'allow trusted domains = no'
- resolves: #1644327 - Segfault if wrong 'passdb backend' is configured
- resolves: #1647959 - Segfault in the debug system with hardended build
- resolves: #1270568 - Samba fails to start after update to 4.3.0
- Add fix for CVE-2008-1105
- resolves: #446724
- Fix typo in winbind-krb-locator post uninstall script.
- Update to 3.6.1
- tweak logrotate configurations to use the PID file in /var/lock/samba
- update to 2.0.2
- Make the talloc and ldb packages optionsl and disable their build within
the samba3 package, they are now built as part of the samba4 package
until they will both be released as independent packages.
- Update to 3.5.0
- integrate most of merge review proposed changes (bug #226387)
- remove libsmbclient-devel-static and simply stop shipping the
static version of smbclient as it seem this is deprecated and
actively discouraged
- Use separate lockdir
- logrotate fixes (#65007)
- related: rhbz#2013596 - Rebase to version 4.15.3
- resolves: rhbz#2028029 - Fix possible null pointer dereference in winbind
- resolves: rhbz#1912549 - Winexe: Kerberos Auth is respected via --use-kerberos=desired
- turn on quota support
- Update to Samba 4.7.4
- rebuild (libldb)
- resolves: #1790353 - Fix access check in DsRGetForestTrustInformation
- resolves: #1791209 - Fix CVE-2019-14907
- related: rhbz#2190417 - Update to version 4.18.6
- resolves: rhbz#2232564 - Fix the rpc dsgetinfo command
- resolves: RHEL-16483 - Update to version 4.19.3
- resolves: RHEL-11361
- Fix CVE-2023-3961 CVE-2023-4091 CVE-2023-42669
- resolves: RHEL-2228 - Logging Format Enhancement
- resolves: RHEL-1965 - Fix smbget issues with DFS shares
- resolves: RHEL-2108 - Fix force user/group issues with 'allow trusted domains = yes'
- resolves: RHEL-17122 - Fix memory corruption in libnss_winbind
- Update to Samba 4.8.0rc3
- Bump Epoch to fix a problem with a Samba4 update in testing.
- Update to 3.2.1
- simplify preun
- related: #985609 - Update to Samba 4.1.0rc4.
- resolves: #1010722 - Split out a samba-winbind-modules package.
- resolves: #1878109 - Rebase Samba to version 4.13.2
- resolves: #1872833 - Add samba-winexe subpackage
- resolves: #1891688 - Fix CVE-2020-14323
- resolves: #1892633 - Fix CVE-2020-14318
- resolves: #1892639 - Fix CVE-2020-14383
- resolves: #1879835 - Fix CVE-2020-1472
- resolves: #1888990 - Update smb.conf manpages to describe how to apply
config changes.
- resolves: #1869702 - Fix %U substitution for 'valid users' option
- resolves: #1818038 - Improve FIPS compliance
- fix init script
- related: #1614232 - Fix some spec file issues detected by rpmdiff
- related: #985609 - Update to Samba 4.1.0rc3.
- resolves: #1005422 - Add support for KEYRING ccache type in pam_winbindd.
- Perl 5.18 rebuild
- add a -common package, shuffle files around.
- Rebuild with binutils fix for ppc64le (#1475636)
- turn on -DLDAP_DEPRECATED to allow access to ldap functions that have
been depricated in 2.3.11, but which don't have well-documented
replacements (ldap_simple_bind_s(), for example).
- Upgrade to 3.0.20b, which includes all the previous upstream patches.
- Updated the -warnings patch for 3.0.20a.
- Include --with-shared-modules=idmap_ad,idmap_rid to close
bz#156810 --with-shared-modules=idmap_ad,idmap_rid
- Include the new samba.pamd from Tomas Mraz (tmraz@redhat.com) to close
bz#170259 pam_stack is deprecated
- desktop file fixes (#69505)
- related: #1499140 - Fix several dependency issues
- Fix building with MIT Kerberos 1.16
- resolves: rhbz#2070522 - Fix UPNs handling in lookup_name*() calls
- Directories reorg, tdb files must go to /var/lib, not
to /var/cache, add migration script in %post common
- Split out libsmbclient, devel and doc packages
- Remove libmsrpc.[h|so] for now as they are not really usable
- Remove kill -HUP from rotate, samba use -HUP for other things
noit to reopen logs
- Rename samba-python to python2-samba
- Update build requirement for libcephfs
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- resolves: #1574177 - Fix smbspool command line argument handling
- Update to Samba 4.6.0rc4
- Add back the AES patches which didn't make it in rc3.
- resolves: #1666737 - Add a new smbc_readdirplus2() function to libsmbclient
- resolves: #1842844 - Fix GnuTLS priority list for TLS connections
- logrotate changes
- rebuilt
- fixes in the spec file
- moved to 3.0.25rc1
- addedd patches (merged upstream so they will be removed in 3.0.25rc2)
- Update to Samba 4.8.0rc1
- Update systemd Requires to reflect latest packaging guidelines.
- Update to Samba 4.0.1.
- Fixes CVE-2013-0172.
- Use /var/cache/samba instead of /var/lock/samba
- Remove "domain controller" keyword from smb.conf, it's
deprecated (from #13704)
- Sync some examples with smb.conf.default
- Fix password synchronization (#16987)
- Update to 3.2.4
- resolves: #456889
- move cifs.upcall to /usr/sbin
- resolves: RHEL-19753 - Fix smbget interactive authentication
- automated rebuild
- resolves: #1778130 - Remove usage of DES encryption types in krb5
- related: #1638001 - Fix package upgrades
- Security fix for CVE-2008-3789
- (these changes are from the non-head version)
- Don't include /usr/sbin/samba, it's the same as the initscript
- unset TMPDIR, as samba can't write into a TMPDIR owned
by root (#41193)
- Add pidfile: lines for smbd and nmbd and a config: line
in the initscript (#15343)
- don't use make -j
- explicitly include /usr/share/samba, not just the files in it
- handle cases defined in #243766
- rebuild with openssl-0.9.7e
- More spec file fixes
- resolves: #1306542 - scriptlet failure because of comments
- resolves: RHEL-84117 - fd_handle_destructor() can panic within an smbd_smb2_close()
- resolves: rhbz#2222884 - Fix trust relationship between workstation and DC
- rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- resolves: #1859277 - Allow a user to use gencache
- Fix pid-file reference in logrotate script
- include pam and nss modules for winbind
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- resolves: rhbz#2190417 - Update to version 4.18.2
- i18n-ize initscript
- add a sysconfig file for daemon options (#23550)
- clarify smbpasswd man page (#23370)
- build with LFS support (#22388)
- avoid extraneous pam error messages (#10666)
- add Urban Widmark's bug fixes for smbmount (#19623)
- fix setgid directory modes (#11911)
- split swat into subpackage (#19706)
- configure the swat stuff usefully
- re-integrate some specfile tweaks that got lost somewhere
- Fix requirement generation for shared libraries
- Update to Samba 4.16.1
- resolves: rhbz#2077468 Rebase Samba to the the latest 4.16.x release
- resolves: rhbz#1974792 - Create a subpackage for vfs-io-uring
- resolves: rhbz#1965397 - Raise log level for dfs ENOENT debug message
- Update to 3.3.1
- related: rhbz#2132051 - Create package dc-libs also for 'non-dc build'
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Fix Bug #6551 (vuid and tid not set in sessionsetupX and tconX)
- Specify required talloc and tdb version for BuildRequires
- Teach smbadduser about "getent passwd"
- Fix more pid-file references
- Add (conditional) winbindd startup to the initscript, configured in
/etc/sysconfig/samba
- resolves: #1637861 - Use GnuTLS for crypto
- resolves: #1207381 - Fix libsystemd detection.
- Upgrade to 3.0.7, which fixes CAN-2004-0807 CAN-2004-0808
This obsoletes the 3.0.6-schema patch.
- Update BuildRequires line to include openldap-devel openssl-devel
and cups-devel
- Fix required talloc version number
- resolves: #516086
- New upstream release.
- Fix LSASD daemon
- resolves: #1217346 - FreeIPA trusts to AD broken due to Samba 4.2 failure to run LSARPC pipe externally
- relink libnss_wins.so with SHLD="%{__cc} -lnsl" to force libnss_wins.so to
link with libnsl, avoiding unresolved symbol errors on functions in libnsl
- enable encypted passwords by default
- Add vfs snapper module.
- Enable quota support
- set a default CA certificate path in smb.conf (#19010)
- require openssl >= 0.9.5a-20 to make sure we have a ca-bundle.crt file
- resolves: RHEL-87030 - Fix winbind memory leak
- resolves: #1348899 - Import of samba.ntacls fails
- resolves: #1513452 - Update to Samba 4.7.2
- Fix deamon startup with systemd
- Include patch from Steven Lawrance (slawrance@yahoo.com) that modifies
smbmnt to work with 32-bit uids.
- Update to 3.0.1
- Removed testparm patch as it's already merged
- Removed Samba.7* man pages
- Fixed .buildroot patch
- Fixed .pie patch
- Added new /usr/bin/tdbdump file
- rebuilt
- Fix CVE-2013-4496 and CVE-2013-6442.
- Fix installation of pidl.
- resolves: #1855711 - Fix 'require_membership_of' documentation in
pam_winbind manpage
- remove swat.desktop file
- Update to Samba 4.8.0rc2
- Update to Samba 4.0.2.
- Fixes CVE-2013-0213.
- Fixes CVE-2013-0214.
- resolves: #906002
- resolves: #905700
- resolves: #905704
- Fix conn->share_access which is reset between user switches.
- resolves: #903806
- Add missing example and make sure we don't introduce perl dependencies.
- resolves: #639470
- Update to 3.2.0pre3
- /usr/lib was used in place of %{_libdir} in three locations (#72554)
- enable PAM and NSS dlopen checks during build
- fix unresolved symbols in libnss_wins.so (bug #198230)
- Do not package Python 2 artefacts by default
- related: #1614232 - Update to Samba 4.9.0rc3
- resolves: #1554753 - Fix CVE-2018-1050
- resolves: #1617912 - Fix CVE-2018-10858
- resolves: #1617913 - Fix CVE-2018-10918
- resolves: #1617914 - Fix CVE-2018-10919
- resolves: #1617915 - Fix CVE-2018-1139
- resolves: #1612522 - Manpage fixes
- resolves: #996160 - Fix winbind nbt name lookup segfault.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- New upstream release
Includes five upstream patches -bug3010_v1, -groupname_enumeration_v3,
-regcreatekey_winxp_v1, -usrmgr_groups_v1, and -winbindd_v1
This obsoletes the -pie and -delim patches
the -warning and -gcc4 patches are obsolete too
The -man, -passwd, and -smbspool patches were updated to match 3.0.20pre1
Also, the -quoting patch was implemented differently upstream
There is now a umount.cifs executable and manpage
We run autogen.sh as part of the build phase
The testprns command is now gone
libsmbclient now has a man page
- Include -bug106483 patch to close
bz#106483 smbclient: -N negates the provided password, despite documentation
- Added the -warnings patch to quiet some compiler warnings.
- Removed many obsolete patches from CVS.
- Enable ACLs
- Fix usrmove paths.
- resolves: #829197
- use cp rather than mv to preserve /etc/services perms (#4938 et al).
- use mktemp to generate /etc/tmp.XXXXXX file name.
- add prereqs on sed/mktemp/killall (need to move killall to /bin).
- fix trigger syntax (i.e. "samba < 1.9.18p7" not "samba < samba-1.9.18p7")
- Fix smbspool alternatives handling during samba-client uninstall
- resolves: #1899113 - Fix following dfs links with smb clients
- turn on mmap again. Wheee.
- ship smbmount on alpha
- resolves: rhbz#1979959 - Improve idmap autorid sanity checks and documentation
- Update to 3.4.0pre1
- Update to upstream Samba 4.1.11 release
- resolves: #1126015 - Fix CVE-2014-3560
- Update to 3.4.0
- related: rhbz#2132051 - Update to version 4.17.5
- add "reload" to the usage string in the startup script
- add initdir macro to handle the initscript directory
- add a new macro to handle /etc/pam.d/system-auth
- Update to Samba 4.4.3
- resolves: #1332178
- Create a libwbclient package.
- Replace winbind-devel with libwbclient-devel package.
- Update to 3.6.3
- Fixes CVE-2012-0817
- Update to 3.5.0rc2
- resolves: #717484 - Enable profiling data support.
- Enable build of idmap_tdb2 for clustered setups
- related: #884169 - Fix strict aliasing warnings.
- fix typo in mount.smb
- resolves: #919405 - Fix and improve large_readx handling for broken clients.
- resolves: #924525 - Don't use waf caching.
- resolves: #1282931 - Fix DCE/RPC bind nak parsing
- add libsmbclient.so for gnome-vfs-extras
- Edit specfile to specify /var/run for pid files
- Move /tmp/.winbindd/socket to /var/run/winbindd/socket
- update to 2.2.7
- add patch for LFS in smbclient ()
- Autorebuild for GCC 4.3
- resolves: #1995849 - [RFE] Change change password change prompt phrasing
- resolves: #2029417 - virusfilter_vfs_openat: Not scanned: Directory or special file
- minor tidy up in preparation for release of 1.9.18p5
- added findsmb utility from SGI package
- related: rbhz#2019674 - Fix CVE-2020-25717
- Fix running ktest (selftest)
- Rebuilt for switch to libxcrypt
- Update to 4.0.0rc3.
- resolves: #805562 - Unable to share print queues.
- resolves: #863388 - Unable to reload smbd configuration with systemctl.
- swat swat
- Fix library dependencies of libnetapi.
- resolves: rhbz#2120956 - Do not require samba package in python3-samba
- fix a few places were "open" is used an interfere with the new glibc
- add fix reported upstream for heavy idmap_ldap memleak
- related: #884169 - Add direct dependency to samba-libs in the
glusterfs package.
- resolves: #996567 - Fix userPrincipalName composition.
- related: #884169 - Fix memset call with zero length in in ntdb.
- resolves: #1754575 - Avoid overlinking with librt and libpthread
- resolves: #1755440 - Fix forest trusts enumeration
- resolves: #1755445 - Fix CUPS username/password authentication with smbspool
- resolves: RHEL-16483 - Update to version 4.19.4
- Update to Samba 4.9.0rc2
- Update to Samba 4.1.5.
- Tweaks of BuildRequires (#49581)
- Rebase to version 4.16.4
- resolves: rhbz#2108331 - Fix CVE-2022-32742
- Update to 3.4.0rc1
- resolves: #1508092 - Add missing dependency for tdbbackup
- change PAM setup to use system-auth
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Perl 5.20 mass
- Fix libnetconf, libnetapi and msrpc DSSETUP call
- revert dependencies to samba-common and -tools
- Update to 3.4.0pre2
- related: #1760824 - Removed additional issues with overlinking
- rebuild in new environment
- add a chmod in %postun so /etc/services & inetd.conf don't become unreadable
- resolves: rhbz#2167691 - Create package samba-tools
- Rebuild to drop libsystemd-daemon dependency (#1125086)
- Update to 3.2.0rc2
- resolves: #449522
- resolves: #448107
- resolves: #1909647 - Fix winbind in trust scenarios with connection issues
- update to 3.0.25c
- Put winbind krb5 locator plugin into a separate rpm
- resolves: #627181
- turn of 64-bit locking on 32-bit platforms
- resolves: #1499140 - Move libdfs-server-ad to the correct subpackage
- fix tempfile security problems, officially ()
- update to 2.0.8
- Update to Samba 4.1.12.
- Update to 3.2.0rc1
- Update to Samba 4.2.0rc4
- resolves: #1154600 - Install missing samba pam.d configuration file.
- tweak the PAM code some more to try to do a setcred() after initgroups()
- pull in all of the optflags on i386 and sparc
- don't explicitly enable Kerberos support -- it's only used for password
checking, and if PAM is enabled it's a no-op anyway
- related: #1869702 - Fix spoolss crash
- resolves: #1896736 - Fix name lookups of FreeIPA users
- resolves: #1899113 - Fix DFS links
- Update to 3.4.3
- split off clients into separate package
- don't run samba by default
- Fix resolving trusted domain users on domain member
- fix initscripts req (prereq /etc/init.d)
- Explicitly BR: rpcsvc-proto-devel
- Update to Samba 4.2.1
- resolves: #1213373 - Fix DEBUG macro issues in public headers
- related: #985609 - Update to Samba 4.1.0rc2.
- Update to 3.3.0rc1
- resolves: rhbz#2132051 - Update to version 4.17.2
- resolves: rhbz#2126174 - Fix CVE-2022-1615
- resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients
- Update to Samba 4.1.3.
- resolves: #1039454 - CVE-2013-4408.
- resolves: #1039500 - CVE-2012-6150.
- resolves: #1088911 - Update to Samba 4.2.3
- resolves: #1024544 - Fix CVE-2013-4475.
- Update to Samba 4.1.1.
- Export arcfour_crypt_blob to Python as samba.crypto.arcfour_encrypt
- Makes possible to run trust to AD in FreeIPA in FIPS mode
- Update to 3.6.6
- related: #1754409 - Add patch to avoid overlinking with libnsl and libsocket
- related: #1754409 - Fix permissions for pidl
- related: #1754409 - Fix logrotate script
- related: #1754409 - Add missing README files
- Security Release, fixes CVE-2008-4314
- Merge from 3.0.0-2beta3.3E
- (Correct log file names (#100981).)
- (Fix pidfile directory in samab.log)
- (Remove obsolete samba-3.0.0beta2.tar.bz2.md5 file)
- (Move libsmbclient to the -common package (#99449))
- Use alternatives for libwbclient.
- Add cwrap to BuildRequires.
- 2.2.0a security fix
- Mark lograte and pam configuration files as noreplace
- updated to samba 2.2.0
- moved codepages to %{_datadir}/samba/codepages
- use all available CPUs for building rpm packages
- use %{_xxx} defines at most places in spec-file
- "License:" replaces "Copyright:"
- dropped excludearch sparc
- de-activated japanese patches 100 and 200 for now
(they need to be fixed and tested wth 2.2.0)
- separated swat.desktop file from spec-file and added
german translations
- moved /etc/sysconfig/samba to a separate source-file
- use htmlview instead of direct call to netscape in
swat.desktop-file
- resolves: #1856315 - Fix net-ads-join with LDAP over TLS
- resolves: rhbz#1944657 - Update to version 4.14.4
- resolves: rhbz#1949445 - Fix CVE-2021-20254
- resolves: rhbz#1947945 - Fix libsmbldap.so.2 not being a symbolic link
- resolves: rhbz#1908506 - Fix creating the gencache user directory
- resolves: rhbz#1901029 - Build the vfs_io_uring module
- don't use rpms internal dep generator
- Fix piddir to match with systemd files.
- Fix crash bug in the debug system.
- resolves: #754525
- Rebuild
- Add missing Requries for python modules.
- Add NetworkManager dispatcher script for winbind.
- initscript oopsie. killproc -HUP, not other way around.
- made the %postun script a tad less agressive; no reason to remove
the logs or lock file (after all, if the lock file is still there,
samba is still running)
- the %postun and %preun should only exectute if this is the final
removal
- migrated %triggerpostun from Red Hat's samba package to work around
packaging problems in some Red Hat samba releases
- Update to Samba 4.5.3
- resolves: #1405984 - CVE-2016-2123,CVE-2016-2125 and CVE-2016-2126
- resolves: RHEL-63770 - Fix notifyd performance issue
- Update to Samba 4.0.0rc5.
- resolves: #1868558 - cannot create a directory in home over SMB2, mkdirat returns EBADF
- Enable cluster support
- Escape macros in %changelog
- resolves: #1430761 - credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case
- upgrade to the latest upstream realease
- includes security fixes released today in 3.0.26
- Initscript fix (#70720)
- resolves: #1261230 - Update to Samba 4.3.2
- resolves: RHEL-16483 - Update to version 4.19.2
- Update to 3.4.1
- resolves: #1020329 - Build glusterfs VFS plguin.
- Upgrade to new upstream version
- Removed '-pie' patch - 3.0.5 uses -fPIC/-PIC, and the combination
- resulted in executables getting corrupt stacks, causing smbmnt to
- get a SIGBUS in the mount() call (bug 127420).
- make winbindd start earlier in the init process, at the same time
ypbind is usually started as well
- add a sepoarate init script for nmbd called nmb, we need to be able
to restart nmbd without dropping al smbd connections unnecessarily
- Remove old crufty coreutils requires
- Update to Samba 4.0.5.
- Add UPN enumeration to passdb internal API (bso #9779).
- resolves: #928947 - samba-doc is obsolete now.
- resolves: #948606 - LogRotate should be optional, and not a hard "Requires".
- resolves: #1802182 - Fix join using netbios name
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- New pam configuration file for samba
- Update to 3.3.4
- add a %trigger to work around (sort of) broken scripts in
previous releases
- fix trigger.
- Update to 3.6.0rc3
- Update to Samba 4.3.3
- resolves: #1292069
- CVE-2015-3223 Remote DoS in Samba (AD) LDAP server
- CVE-2015-5252 Insufficient symlink verification in smbd
- CVE-2015-5296 Samba client requesting encryption vulnerable to
downgrade attack
- CVE-2015-5299 Missing access control check in shadow copy code
- CVE-2015-7540 DoS to AD-DC due to insufficient checking of asn1
memory allocation
- Update to Samba 4.0.0rc4.
- Update to 3.6.4
- Fixes CVE-2012-1182
- Update to 4.0.0rc2.
- Update to Samba 4.5.2
- Update to Samba 4.2.2
- Fix the lpq parser for better handling of LPRng systems (#69352)
- fix tempfile security problems (patch from )
- Use %{__python2}, not "python", as the Python2 interpreter
- Add workaround to allow building with Python 2
- Change unversioned python macros to python2
- Disable gluster temporarily
- resolves: #870630 - Fix scriptlets interpeting a comment as argument.
- Update to Samba 4.5.0rc2
- related: #1638001 - Rebase to Samba version 4.10.4
- resolves: #1597298 - Build Samba with python3
- resolves: #1658558 - Add 'net ads leave --keep-account' option
- resolves: #1669004 - Fix systemd status notifications
- resolves: #1672167 - Fix printing cache timeout in debug output
- resolves: #1696525 - Fix CVE-2019-3880
- Update to 3.2.0 final
- resolves: #452622
- resolves: rhbz#2190417 - Update to version 4.18.3
- resolves: #1520163 - Link libaesni-intel-samba4.so with -z noexecstack
- Enable AES acceleration on Intel compatible CPUs by default
- resolves: #1658690 - Add smbc_setOptionProtocols()
- resolves: #1658678 - Fix spoolss client operations against Windows
- i18n improvements in initscript (#26537)
- Update to Samba 4.5.0rc3
- Update docs section to not carryover the docs/manpages directory
This moved many files from /usr/share/doc/samba-3.0.7/docs/* to
/usr/share/doc/samba-3.0.7/*
- Modify spec file as suggested by Rex Dieter (rdieter@math.unl.edu)
to correctly create libsmbclient.so.0 and to use %_initrddir instead
of rolling our own. This closes #132642
- Add patch to default "use sendfile" to no, since sendfile appears to
be broken
- Add patch from Volker Lendecke to help make
ldapsam_compat work again.
- Add patch from "Vince Brimhall" for ldapsam_compat
These two patches close bugzilla #132169
- resolves: #1817557 - Rebase to version 4.12.3
- resolves: #1813833 - Fix 'net ads join createupn='
- resolves: #1214973 - Fix libwbclient alternatives link.
- Move winbind files to samba-common. Add separate initscript for
winbind
- Fixes for winbind - protect global variables with mutex, use
more secure getenv
- update to 3.0.25b
- better error codes for init scripts: #244823
- switch to %configure
- resolves: #872818 - Fix perl dependencies.
- 2.2.3a
- Update to Samba 4.4.0rc5
- Update to 3.6.0 final
- resolves: #1850980 - Add "additional dns hostname" to keytab
- resolves: #1850981 - Add net-ads-join dnshostname=fqdn option
- updated japanese stuff (#27683)
- New upstream release that closes CAN-2004-1154 bz#142544
- Include the -64bit patch from Nalin. This closes bz#142873
- Update the -logfiles patch to work with 3.0.10
- Create /var/run/winbindd and make it part of the -common rpm to close
bz#142242
- Many optimisations (some suggested by Manoj Kasichainula
- Use of chkconfig in place of individual symlinks to /etc/rc.d/init/smb
- Compounded make line
- Updated smb.init restart mechanism
- Use compound mkdir -p line instead of individual calls to mkdir
- Fixed smb.conf file path for log files
- Fixed smb.conf file path for incoming smb print spool directory
- Added a number of options to smb.conf file
- Added smbadduser command (missed from all previous RPMs) - Doooh!
- Added smbuser file and smb.conf file updates for username map
- Add "--with-utmp" to configure options (#55372)
- Include winbind, pam_smbpass.so, rpcclient and smbcacls
- start using /var/cache/samba, we need to keep state and there is
more than just locks involved
- fix condrestart stuff
- 2.2.3
- related: #1781232 - Improve debug output of smbclient
- resolves: #1794461 - Do not return bogus inode numbers in
cli_qpathinfo2()/cli_qpathinfo3() for SMB1
- resolves: #1794442 - Fix segfault in smbd_do_qfilepathinfo()
- Update to Samba 4.2.0rc3
+ Samba provides ctdb packages now.
- resolves: #985985 - Fix file conflict between samba and wine.
- resolves: #985107 - Add support for new default location for Kerberos
credential caches.
- initscript munging
- resolves: #972692 - Build with PIE and full RELRO.
- resolves: #884169 - Add explicit dependencies suggested by rpmdiff.
- resolves: #981033 - Local user's krb5cc deleted by winbind.
- resolves: #984331 - Fix samba-common tmpfiles configuration file in wrong
directory.
- Add libcap-devel to requires list (resolves: #488559)
- New upstream version.
- Updated -pie and -logfiles patches for 3.0.3pre1
- add krb5-devel to buildrequires, fixes #116560
- Add patch from Miloslav Trmac (mitr@volny.cz) to allow non-root to run
"service smb status". This fixes #116559
- Add %ghost entry for /var/run using tmpfs
- resolves: #656685
- Add kerberos AES support.
- Fix printing initialization.
- Update to 3.3.2
- resolves: #489547
- Fix systemd dependencies
- resolves: #751397
- Update to 3.5.2
- disable the -salt patch, because it causes undefined references in
libsmbclient that prevent gnome-vfs from building.
- patch configure.ing (patch11) to disable cups test
- turn off swat by default
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rebuilt for rpm dependency generator failure (#1131892)
- Don't use /etc/samba.d in smbadduser, it should be /etc/samba
- Fix issues with conflicting DEBUG macros.
- rebuild to get rid of cups dependency
- auth/credentials: Always set the the realm if we set the principal from the ccache
- resolves: #1430761 - credentials_crb5: use gss_acquire_cred for client-side GSSAPI use case
- fix bash2 breakage in post script
- Update to 3.5.3
- Make sure nmb and smb initscripts return LSB compliant return codes
- Fix winbind over ipv6
- Don't build dns and dsdb-related modules without AD DC
- resolves: #1712378 - Fix smbspool CUPS backend
- resolves: #1696612 - Fix 'net ads join -U admin@parentdomain'
- Update to Samba 4.0.0.
- Update to Samba 4.7.0rc6
- shift some files into -client
- remove /home/samba from package.
- new i18n stuff
- related: rhbz#1980346 - Rebuild for libtalloc 0.11.0
- include interfaces.o in pam_smbpass.so, which needs symbols from interfaces.o
(patch posted to samba-list by Ilia Chipitsine)
- Add patch from Jeremy Allison to fix IA64 alignment problems (#51497)
- related: #1878109 - Rebase Samba to version 4.13.3
- resolves: #1019469 - Fix winbind debug message NULL pointer derreference.
- Update to Samba 4.4.0rc1
- fix trigger (#26859)
- New upstream version: 3.0.2 final includes security fix for #114995
(CAN-2004-0082)
- Edit postun script for the -common package to restart winbind when
appropriate. Fixes bugzilla #114051.
- resolves: RHEL-17283 - Fix smbget password interactive authentication
- add a "exit 0" to the postun of the main samba package
- Rename ldb* tools to ldb3* to avoid conflicts with newer ldb releases
- 2.2.1, which should work better for XP
- resolves: #1261230 - Update to Samba 4.3.4
- Add UPN enumeration to passdb internal API (bso #9779).
- fix quota support, and quotas with the 2.4 kernel (#31362, #33915)
- More spec file fixes
- updated postun triggerscript to check $0
- clear /etc/codepages from %preun instead of %postun
- always create codepages
- device-remove security fix again ()
- Fix ctdb and libcephfs dependencies.
- resolves: rhbz#2222894 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968
- bump again for double-long bug on ppc(64)
setools-4.3.0-5.el8.x86_64.rpm | - setools-python{,3} packages should have a weak dependency on libselinux-python{,3}
(#1447747)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Disable/remove neverallow options in frontends (#2184141)
- AVRuleXperm: Fix permission set creation for AVTAB_XPERMS_IOCTLDRIVER (#2174376)
- SETools 4.2.0 release
- bswap_* macros are defined in byteswap.h
- Update upstream source to 4.2.0-rc
- SELinuxPolicy: Create a map of aliases on policy load (#1672631)
- SETools 4.3.0 release (#1820079)
- Revised sediff method for TE rules. This drastically reduced memory and run time.
- Added infiniband context support to seinfo, sediff, and apol.
- Added apol configuration for location of Qt assistant.
- Fixed sediff issue where properties header would display when not requested.
- Fixed sediff issue with type_transition file name comparison.
- Fixed permission map socket sendto information flow direction.
- Added methods to TypeAttribute class to make it a complete Python collection.
- Genfscon now will look up classes rather than using fixed values which
were dropped from libsepol.
- setools requires -console, -console-analyses and -gui packages (#1820078)
- SETools 4.2.1 release (#1581761, #1595582)
- setools-python2 requires python2-enum34
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650548
- Add support for SCTP protocol (#1568333)
- Python 2 binary package renamed to python2-setools
See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
- Python 3 binary package renamed to python3-setools
- Move gui python files to -gui subpackage
- Do not build gui and console-analyses by default
- Move python networkx dependency to -gui and -console-analyses
- Ship sedta and seinfoflow in setools-console-analyses
- Support old boolean names in policy queries (#1595572, #1581848)
- Build setools-console-analyses and setools-gui (#1731519)
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- Use
CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ;
CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ;
FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ;
FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ;
LDFLAGS="${LDFLAGS:--Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
- Add Provides for the old name without %_isa
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Fix SCTP patch - https://github.com/SELinuxProject/setools/issues/9
- Disable/remove neverallow options in sediff (#2184141)
- SETools 4.2.2 release
- Don't build the Python 2 subpackage (#1567362)
- New upstream release.
- Make seinfo output predictable (#2019961)
- New upstream release
setools-console-4.3.0-5.el8.x86_64.rpm | - setools-python{,3} packages should have a weak dependency on libselinux-python{,3}
(#1447747)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Disable/remove neverallow options in frontends (#2184141)
- AVRuleXperm: Fix permission set creation for AVTAB_XPERMS_IOCTLDRIVER (#2174376)
- SETools 4.2.0 release
- bswap_* macros are defined in byteswap.h
- Update upstream source to 4.2.0-rc
- SELinuxPolicy: Create a map of aliases on policy load (#1672631)
- SETools 4.3.0 release (#1820079)
- Revised sediff method for TE rules. This drastically reduced memory and run time.
- Added infiniband context support to seinfo, sediff, and apol.
- Added apol configuration for location of Qt assistant.
- Fixed sediff issue where properties header would display when not requested.
- Fixed sediff issue with type_transition file name comparison.
- Fixed permission map socket sendto information flow direction.
- Added methods to TypeAttribute class to make it a complete Python collection.
- Genfscon now will look up classes rather than using fixed values which
were dropped from libsepol.
- setools requires -console, -console-analyses and -gui packages (#1820078)
- SETools 4.2.1 release (#1581761, #1595582)
- setools-python2 requires python2-enum34
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650548
- Add support for SCTP protocol (#1568333)
- Python 2 binary package renamed to python2-setools
See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
- Python 3 binary package renamed to python3-setools
- Move gui python files to -gui subpackage
- Do not build gui and console-analyses by default
- Move python networkx dependency to -gui and -console-analyses
- Ship sedta and seinfoflow in setools-console-analyses
- Support old boolean names in policy queries (#1595572, #1581848)
- Build setools-console-analyses and setools-gui (#1731519)
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- Use
CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ;
CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ;
FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ;
FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ;
LDFLAGS="${LDFLAGS:--Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
- Add Provides for the old name without %_isa
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Fix SCTP patch - https://github.com/SELinuxProject/setools/issues/9
- Disable/remove neverallow options in sediff (#2184141)
- SETools 4.2.2 release
- Don't build the Python 2 subpackage (#1567362)
- New upstream release.
- Make seinfo output predictable (#2019961)
- New upstream release
setools-console-analyses-4.3.0-5.el8.x86_64.rpm | - setools-python{,3} packages should have a weak dependency on libselinux-python{,3}
(#1447747)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Disable/remove neverallow options in frontends (#2184141)
- AVRuleXperm: Fix permission set creation for AVTAB_XPERMS_IOCTLDRIVER (#2174376)
- SETools 4.2.0 release
- bswap_* macros are defined in byteswap.h
- Update upstream source to 4.2.0-rc
- SELinuxPolicy: Create a map of aliases on policy load (#1672631)
- SETools 4.3.0 release (#1820079)
- Revised sediff method for TE rules. This drastically reduced memory and run time.
- Added infiniband context support to seinfo, sediff, and apol.
- Added apol configuration for location of Qt assistant.
- Fixed sediff issue where properties header would display when not requested.
- Fixed sediff issue with type_transition file name comparison.
- Fixed permission map socket sendto information flow direction.
- Added methods to TypeAttribute class to make it a complete Python collection.
- Genfscon now will look up classes rather than using fixed values which
were dropped from libsepol.
- setools requires -console, -console-analyses and -gui packages (#1820078)
- SETools 4.2.1 release (#1581761, #1595582)
- setools-python2 requires python2-enum34
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650548
- Add support for SCTP protocol (#1568333)
- Python 2 binary package renamed to python2-setools
See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
- Python 3 binary package renamed to python3-setools
- Move gui python files to -gui subpackage
- Do not build gui and console-analyses by default
- Move python networkx dependency to -gui and -console-analyses
- Ship sedta and seinfoflow in setools-console-analyses
- Support old boolean names in policy queries (#1595572, #1581848)
- Build setools-console-analyses and setools-gui (#1731519)
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- Use
CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ;
CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ;
FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ;
FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ;
LDFLAGS="${LDFLAGS:--Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
- Add Provides for the old name without %_isa
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Fix SCTP patch - https://github.com/SELinuxProject/setools/issues/9
- Disable/remove neverallow options in sediff (#2184141)
- SETools 4.2.2 release
- Don't build the Python 2 subpackage (#1567362)
- New upstream release.
- Make seinfo output predictable (#2019961)
- New upstream release
setools-gui-4.3.0-5.el8.x86_64.rpm | - setools-python{,3} packages should have a weak dependency on libselinux-python{,3}
(#1447747)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Disable/remove neverallow options in frontends (#2184141)
- AVRuleXperm: Fix permission set creation for AVTAB_XPERMS_IOCTLDRIVER (#2174376)
- SETools 4.2.0 release
- bswap_* macros are defined in byteswap.h
- Update upstream source to 4.2.0-rc
- SELinuxPolicy: Create a map of aliases on policy load (#1672631)
- SETools 4.3.0 release (#1820079)
- Revised sediff method for TE rules. This drastically reduced memory and run time.
- Added infiniband context support to seinfo, sediff, and apol.
- Added apol configuration for location of Qt assistant.
- Fixed sediff issue where properties header would display when not requested.
- Fixed sediff issue with type_transition file name comparison.
- Fixed permission map socket sendto information flow direction.
- Added methods to TypeAttribute class to make it a complete Python collection.
- Genfscon now will look up classes rather than using fixed values which
were dropped from libsepol.
- setools requires -console, -console-analyses and -gui packages (#1820078)
- SETools 4.2.1 release (#1581761, #1595582)
- setools-python2 requires python2-enum34
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650548
- Add support for SCTP protocol (#1568333)
- Python 2 binary package renamed to python2-setools
See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
- Python 3 binary package renamed to python3-setools
- Move gui python files to -gui subpackage
- Do not build gui and console-analyses by default
- Move python networkx dependency to -gui and -console-analyses
- Ship sedta and seinfoflow in setools-console-analyses
- Support old boolean names in policy queries (#1595572, #1581848)
- Build setools-console-analyses and setools-gui (#1731519)
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
- Use
CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ;
CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ;
FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ;
FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ;
LDFLAGS="${LDFLAGS:--Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
- Add Provides for the old name without %_isa
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Fix SCTP patch - https://github.com/SELinuxProject/setools/issues/9
- Disable/remove neverallow options in sediff (#2184141)
- SETools 4.2.2 release
- Don't build the Python 2 subpackage (#1567362)
- New upstream release.
- Make seinfo output predictable (#2019961)
- New upstream release
soundtouch-2.0.0-3.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Add license tag.
- Add back sed on -O3 .
- Not modify soundtouch_config.h because looks correct, just have one line !.
- New upstream release 1.4.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Fix compilation with libtool 2.x
- FE6 Rebuild
- Rebuilt for Fedora 23 Change
https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Add BR libtool
- Add BR: automake, because upstream uses symlinks to instead of copies of some
needed automake files.
- initial build.
- Patch makefiles so that our RPM_OPT_FLAGS get used instead of the custom
upstream CFLAGS.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- New upstream version 1.3.1
- Minor specfile cleanups for livna submission.
- Give the .so a proper version instead of 0.0.0
- Don't use rpath in soundstretch binary
- Fix compilation with gcc 4.3
- Rebuild for buildId
- Update license tag for new license guidelines compliance
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- fix pkgconfig links
- Rebuild for the annobin fixes
- Remove an unused patch
- Resolves: rhbz#1704123
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuilt for GCC 5 C++11 ABI change
- Update soundtouch to 2.0.0
- Autorebuild for GCC 4.3
- Add Requires: pkgconfig to -devel subpackage
- Replace installed autoheader generated header file with our own version
which contains only the nescesarry soundtouch specific defines, thus avoiding
possible conflicts with other autoheader generated headers.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Update to 1.9.2 (#961876).
- Modernize spec file.
- Makefile.am handles mmx and sse flags well, so no need patch 01 and sed anymore.
- Patch 02 disabled, I hope we already have asm fixed on X86_64.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Fix building with automake-1.10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
sssd-dbus-2.9.4-5.el8_10.2.x86_64.rpm | - Decrease priority of sssd-libwbclient 20 -> 5
- It should be lower than priority of samba veriosn of libwbclient.
- https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18
- Add explicit requirement on selinux-policy version to address new SBUS
symlinks.
- Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
certificate EKU and perform an action based
on value when generating SSH key from a certificate
- Resolves: rhbz#752495 - Crash when apply settings
- Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
repository
- This just required a raise in release number
and changelog for the record.
- Only BuildRequire libcmocka on Fedora
- Resolves: rhbz#1256849 - SUDO: Support the IPA schema
- Use alternatives for libwbclient
- New upstream release 1.12.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.4
- Resolves: rhbz#1754996 - [sssd] Tier 0 Localization
- Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
- Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
file from package sssd-common-1.15.1-1.fc25.x86_64
- Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4
- Unify return type of list_active_domains for python{2,3}
- Fix incorrect tarball URL
- Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
of gen_new to avoid a subsequent switch call
failure
- Fix upgrade issues from old (pre-0.5.0) releases of SSSD
- Resolves: rhbz#1672780 - gdm login not prompting for username when smart
card maps to multiple users
- Resolves: rhbz#683267 - sssd 1.5.1-9 breaks AD authentication
- Fix broken ARM build
- Add missing DP_OPTION_TERMINATOR in AD provider options
- Backport upstream patches for 1.15.3 pre-release
- required for building freeipa-4.5.x in rawhide
- Resolves: rhbz#606887 - sssd stops on upgrade
- Fix nested group member filter sanitization for RFC2307bis
- Put translated tool manpages into the sssd-tools subpackage
- Fix regression with krb5_map_user
- Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
- Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
default if nonexistent domain is mentioned
- New upstream release 1.6.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
- Fixes a major cache performance issue introduced in 1.6.2
- Fixes a potential infinite-loop with certain LDAP layouts
- Related: rhbz#1638150 - session not recording for local user when groups defined
- Also add silence a Coverity warning, which is related to rhbz#1637131
- New upstream release 1.4.1
- Add support for netgroups to the proxy provider
- Fixes a minor bug with UIDs/GIDs >= 2^31
- Fixes a segfault in the kerberos provider
- Fixes a segfault in the NSS responder if a data provider crashes
- Correctly use sdap_netgroup_search_base
- Resolves: rhbz#1636397 - SSSD not fetching all sudo rules from AD
- Change the default ccache location to DIR:/run/user/${UID}/krb5cc
and patch man page accordingly
- Resolves: rhbz#851304
- Resolves: rhbz#1615590 - Do not rely on "python" for el8
- Install systemd unit file instead of sysv init script
- New upstream release 1.9.0 beta7
- obsoletes patches #1-#3
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
- Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
- Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
- Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
- Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
- Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade
- Rebuild for libldb 1.1.19
- Version 0.2.1
- New stable upstream version 1.2.1
- Resolves: rhbz#595529 - spec file should eschew %define in favor of
- %global
- Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
- to fail while restart.
- Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
- keyring
- Resolves: rhbz#599724 - sssd is broken on Rawhide
- Resolves: rhbz#1729055 - sssd does not pass correct rules to sudo
- New upstream release 1.5.6
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
- Fixed a serious memory leak in the memberOf plugin
- Fixed a regression with the negative cache that caused it to be essentially
- nonfunctional
- Fixed an issue where the user's full name would sometimes be removed from
- the cache
- Fixed an issue with password changes in the kerberos provider not working
- with kpasswd
- Fix regression on 64-bit platforms
- Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
suggests using * for backend sss
- New upstream release 1.6.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
- Fixes a serious issue with LDAP connections when the communication is
dropped (e.g. VPN disconnection, waking from sleep)
- SSSD is now less strict when dealing with users/groups with multiple names
when a definitive primary name cannot be determined
- The LDAP provider will no longer attempt to canonicalize by default when
using SASL. An option to re-enable this has been provided.
- Fixes for non-standard LDAP attribute names (e.g. those used by Active
Directory)
- Three HBAC regressions have been fixed.
- Fix for an infinite loop in the deref code
- New upstream release 1.10 beta2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
- BuildRequire libcmocka-devel in order to run all upstream tests during build
- BuildRequire libnl3 instead of libnl1
- No longer BuildRequire initscripts, we no longer use /sbin/service
- Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
older krb5-libs version
- This is to bump version to allow rebuild against rebased libldb.
- New upstream release 1.11.5.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5.1
- Backport patches from upstream 1.12.5 prerelease - contains many fixes
- New upstream release 1.9.0
- New upstream release 1.7.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
- Support for case-insensitive domains
- Support for multiple search bases in the LDAP provider
- Support for the native FreeIPA netgroup implementation
- Reliability improvements to the process monitor
- New DEBUG facility with more consistent log levels
- New tool to change debug log levels without restarting SSSD
- SSSD will now disconnect from LDAP server when idle
- FreeIPA HBAC rules can choose to ignore srchost options for significant
performance gains
- Assorted performance improvements in the LDAP provider
- Resolves: rhbz#1466503 - Snippets are not used when sssd.conf does not exist
- New upstream release 1.13.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.4
- New upstream release 1.5.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
- Fixes for support of FreeIPA v2
- Fixes for failover if DNS entries change
- Improved sss_obfuscate tool with better interactive mode
- Fix several crash bugs
- Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
- Delete users from the local cache if initgroups calls return 'no such user'
- (previously only worked for getpwnam/getpwuid)
- Use new Transifex.net translations
- Better support for automatic TGT renewal (now survives restart)
- Netgroup fixes
- New upstream release 1.8.0 beta 3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
- Fixed a regression in group enumeration since 1.7.0
- Fixed several memory-corruption bugs
- Finalized the ABI for the autofs support
- Fixed a regression in the proxy provider
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
- Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
- Resolves: rhbz#1803134 - Improve "unlock" time when user session already active
- Resolves: rhbz#1328108 - Protocol error with FreeIPA on CentOS 6
- Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
- doesn't require it
- Rebuild against libldb 1.10
- Build with _hardened_build macro
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- New upstream release 1.1.1
- Fixed the IPA provider (which was segfaulting at start)
- Fixed a bug in the SSSDConfig API causing some options to revert to
- their defaults
- This impacted the Authconfig UI
- Ensure that SASL binds to LDAP auto-retry when interrupted by a signal
- Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
- Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter
- Rebuild against new libtevent
- latest upstream release.
- also add a patch that fixes debugging output (potential segfault)
- Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
groups during getgrnam and getgrgid
- Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
in call to 'print'
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features
- Rebuild against PCRE 8.30
- CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Rebuild SSSD against ding-libs 0.3.0beta1
- Fix endianness bug in service map protocol
- Fix pre and post script requirements
- sssd-tools should require sssd-common, not sssd
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
- Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
- Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
- Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
- Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
- Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #
raise(): /usr/libexec/sssd/sssd_autofs killed by 6
- Fix segfault in TGT renewal
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
- Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
- Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
- Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
- Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
- Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]
- Only create the SELinux login file if there are SELinux mappings on
the IPA server
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
- Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)
- Add plugin for cifs-utils
- Resolves: rhbz#998544
- Fix memberOf install path
- Related: rhbz#1638006 - Files: The files provider always enumerates
which causes duplicate when running getent passwd
- New upstream release 1.14.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.1
- New upstream release 1.14 alpha
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0alpha
- Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
setnetgrent_result_timeout
- Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
or machine swaps
- Resolves: failure in glibc tests
https://sourceware.org/bugzilla/show_bug.cgi?id=22530
- Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
auth_provider ldap, login fails if the LDAP server
is not allowing anonymous binds
- Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
corrected with AD
- Resolves: upstream#3586 - Give a more detailed debug and system-log message
if krb5_init_context() failed
- Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
in /etc/systemd/system
- Backport few upstream features from 1.16.1
- Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
new ones (kcm)
- Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
- Resolves: rhbz#1646168 - sssctl access-report always prints an error message
- Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
configuration without having to restart the whole
sssd
- Resolves: rhbz#1640576 - sssctl reports incorrect information about local
user's cache entry expiration time
- Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
- Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys
- the cmocka toolkit exists only on selected arches
- Fixes a serious memory hierarchy bug causing unpredictable behavior in the
LDAP provider.
- New upstream release 1.11.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0
- Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
/usr/libexec/sssd/proxy_child killed by 6
- Fix building of sssd-nfs-idmap with libnfsidmap.so.1
- New upstream release 1.10
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0
- Backport more sbus2 fixes
- Related: rhbz#1623878 - crash related to sbus_router_destructor()
- Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
certificate EKU and perform an action based
on value when generating SSH key from a certificate
(additional patch)
- Solve a shutdown race-condition that sometimes left processes running
- Resolves: rhbz#606887 - SSSD stops on upgrade
- Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
with no specific host/hostgroup set
- Resolves: upstream#3621 - FleetCommander integration must not require
capability DAC_OVERRIDE
- Remove %files reference to sss_debuglevel copied from wrong upstreeam
spec file.
- Resolves: rhbz#1713368 - Add sssd-dbus package as a dependency of sssd-tools
- Resolves: RHEL-33957 - ad: refresh root domain when read directly
- Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
- Make sure to properly convert to systemd if upgrading from newer
- updates for Fedora 14
- Fix build issues: Update expided certificate in unit tests
- New upstream release 0.7.0
- New upstream release 1.14.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0
- Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
sssd_ifp killed by SIGSEGV
- New upstream version 1.2.91 (1.3.0rc1)
- Improved LDAP failover
- Synchronous sysdb API (provides performance enhancements)
- Better online reconnection detection
- New LDAP access provider allows for filtering user access by LDAP attribute
- Reduced default timeout for detecting offline status with LDAP
- GSSAPI ticket lifetime made configurable
- Better offline->online transition support in Kerberos
- Release new upstream version 1.1.91
- Enhancements when using SSSD with FreeIPA v2
- Support for deferred kinit
- Support for DNS SRV records for failover
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
- Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
- Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
- Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
- Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
- Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
- Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
- Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
- Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
- Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
- Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
- Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf
- Resolves: rhbz#1646113 - Missing concise documentation about valid options
for sssd-files-provider
- Fix typo in libwbclient-devel %preun
- Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
- Also sync. kcm multihost tests with master
- Switch unicode library from libunistring to Glib
- Drop unnecessary explicit Requires on keyutils
- Guarantee that versioned Requires include the correct architecture
connection timeout
- Resolves: rhbz#1139962 - Fedora 21, FreeIPA 4.0.2: sssd does not find user
private group from server
- New upstream release 1.5.5
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
- Fixes for several crash bugs
- LDAP group lookups will no longer abort if there is a zero-length member
- attribute
- Add automatic fallback to 'cn' if the 'gecos' attribute does not exist
- New upstream bugfix release 0.99.1
- Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
- Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
- Several segfault bugfixes
- Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
retrieve AD users through IPA Trust
- New upstream release 1.5.10
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
- Fixed a regression introduced in 1.5.9 that could result in blocking calls
- to LDAP
- Rebuilt for libnfsidmap.so.1
- Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
specified up to the seconds
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
if ID provider is authenticated with GSSAPI
- New upstream release 1.9.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Release SSSD 1.1.0 final
- Fix two potential segfaults
- Fix memory leak in monitor
- Better error message for unusable confdb
- New upstream release 1.6.4
- Rolls up previous patches applied to the 1.6.3 tarball
- Fixes a rare issue causing crashes in the failover logic
- Fixes an issue where SSSD would return the wrong PAM error code for users
that it does not recognize.
- Related: rhbz#1635595 - Cant login with smartcard with multiple certs
- New upstream release 1.9.0 beta 1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
- Add native support for autofs to the IPA provider
- Support for ID-mapping when connecting to Active Directory
- Support for handling very large (> 1500 users) groups in Active Directory
- Support for sub-domains (will be used for dealing with trust relationships)
- Add a new fast in-memory cache to speed up lookups of cached data on
repeated requests
- Backport important patches from upstream 1.13 prerelease
- Relax libldb BuildRequires to be greater-or-equal
- Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
- Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
- Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
- Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
inotify events, and no updates are triggered
- Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
on GDM login with smart-card
- Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
- Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
- Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
- Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
if LDAP entries do not contain AD forest root information
- Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
in SSSD-AD direct integration.
- Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
- Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
- Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma
- add missing configure check that broke stopping the daemon
- also fix default config to add a missing required option
- New upstream release 1.9.0 beta 6
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
- A new option, override_shell was added. If this option is set, all users
managed by SSSD will have their shell set to its value.
- Fixes for the support for setting default SELinux user context from FreeIPA.
- Fixed a regression introduced in beta 5 that broke LDAP SASL binds
- The SSSD supports the concept of a Primary Server and a Back Up Server in
failover
- A new command-line tool sss_seed is available to help prime the cache with
a user record when deploying a new machine
- SSSD is now able to discover and save the domain-realm mappings
between an IPA server and a trusted Active Directory server.
- Packaging changes to fix ldconfig usage in subpackages (#843995)
- Rebuild against libldb 1.1.9
- New upstream release 1.9.4
- Rebuild against libldb 1.1.4
- package git snapshot
- Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
access on the sock_file system_bus_socket
- Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
fails to download desktop profile data
- Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
- Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
after applying ID Views for them in IPA server
- Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
mapping is applied
- Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
differs from the default
- Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
- Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
- Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
- Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
- Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
- Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
- Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
- Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
- Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
- Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
- Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
- Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization
- Apply a number of patches from upstream to fix issues found post-beta,
in particular:
-- segfault with a high DEBUG level
-- Fix IPA password migration (upstream #1873)
-- Fix fail over when retrying SRV resolution (upstream #1886)
- Rebuild for libldb 1.1.18
- Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
pam libraries
- Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
prompts (e.g. Password + Token)
- Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
by remote host" if locale not available
- Resolves: rhbz#1733372 - permission denied on logs when running sssd as
non-root user
- Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
information
- Fix Obsoletes: to account for dist tag
- Convert post and pre scripts to run on the sssd-common subpackage
- Remove old conversion from SYSV
- Fix regression in endianness patch
- New upstream release 1.4.0
- Added support for netgroups to the LDAP provider
- Performance improvements made to group processing of RFC2307 LDAP servers
- Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
- Build-system improvements to support Gentoo
- Split out several libraries into the ding-libs tarball
- Manpage reviewed and updated
- Fix regressions and bugs in sssd upstream 1.12.2
- https://fedorahosted.org/sssd/ticket/{id}
- Regressions: #2471, #2475, #2483, #2487, #2529, #2535
- Bugs: #2287, #2445
- New upstream release 1.8.0
- Support for the service map in NSS
- Support for setting default SELinux user context from FreeIPA
- Support for retrieving SSH user and host keys from LDAP (Experimental)
- Support for caching autofs LDAP requests (Experimental)
- Support for caching SUDO rules (Experimental)
- Include the IPA AutoFS provider
- Fixed several memory-corruption bugs
- Fixed a regression in group enumeration since 1.7.0
- Fixed a regression in the proxy provider
- Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
- Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
logged at each login
- Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
/usr/sbin/sssd was killed by signal 11 (SIGSEGV)
- Resolves: rhbz#743133 - Performance regression with Kerberos authentication
against AD
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features
- Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc
- New upstream release 1.10 beta1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta1
- New upstream release 1.12.5
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.5
- Backport few upstream patches/fixes
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
- Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
- Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
- Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
- Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
- Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
- Resolves: rhbz#2098617 - Harden kerberos ticket validation
- Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
- Resolves: rhbz#1164156 - libsss_simpleifp should pull sssd-dbus
- Resolves: rhbz#1179379 - gzip: stdin: file size changed while
zipping when rotating logfile
- Include the 1.9.2 tarball
- Resolves: rhbz#1578014 - sssd does not work under non-root user
- Note: Actually the patches were in the 2.0.0-37, this one just adds this
changelog because it was missing.
- Use mcpath insted of mcachepath macro to be consistent with
upsteam spec file
- Add missing %license macro
- New upstream release
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
- Fix two minor manpage bugs
- Include the IPA AutoFS provider
- Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
and libtevent to avoid an issue in GPO processing
- Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
- against LDAP
- Resolves: upstream#3618 - selinux_child segfaults in a docker container
- Check the validity of naming context
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- New upstream release 1.15.3
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_3.html
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Resolves: rhbz#1726945 - negative cache does not use values from
'filter_users' config option for known domains
- Related: rhbz#1637131 - pam_unix unable to match fully qualified username
provided by sssd during smartcard auth using gdm
- New upstream release 1.5.1
- Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Vast performance improvements when enumerate = true
- All PAM actions will now perform a forced initgroups lookup instead of just
- a user information lookup
- This guarantees that all group information is available to other
- providers, such as the simple provider.
- For backwards-compatibility, DNS lookups will also fall back to trying the
- SSSD domain name as a DNS discovery domain.
- Support for more password expiration policies in LDAP
- 389 Directory Server
- FreeIPA
- ActiveDirectory
- Support for ldap_tls_{cert,key,cipher_suite} config options
-Assorted bugfixes
- Resolves: #967012 - [abrt] sssd-1.9.5-1.fc18: sss_mmap_cache_gr_invalidate_gid:
Process /usr/libexec/sssd/sssd_nss was killed by
signal 11 (SIGSEGV)
- Resolves: #996214 - sssd proxy_child segfault
- Resolves: rhbz#1687281
Rebase sssd in RHEL-8.1 to the latest upstream release
- Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
- Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
- Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working
- Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
- cached password with predicatable filename
- Backport important patches from upstream 1.13 prerelease
- Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
attribute for group name
- Resolves: upstream #2335 - Investigate using the krb5 responder
for driving the PAM conversation with OTPs
- Enable cmocka tests for secondary architectures
- Split internal helper libraries into a shared object
- Significantly reduce disk-space usage
- Resolves: rhbz#1687281
Rebase sssd in RHEL-8.1 to the latest upstream release
-Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
UnknownProperty: Unknown property
- Re-add manpage translations
- Resolves: rhbz#632615 - the krb5 locator plugin isn't packaged for multilib
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Patch SSSDConfig API to address
- https://bugzilla.redhat.com/show_bug.cgi?id=549482
- Fix slow login with ipa and SELinux
- Resolves: upstream #2624 - Only set the selinux context if the context
differs from the local one
for match rules sss-certmap
- Resolves: RHEL-39085 - [RfE] SSSD Failover Enhancements
- Rebuild for new libldb
- Don't duplicate libsss_autofs.so in two packages
- Set explicit package contents instead of globbing
- New upstream release 1.5.3
- Support for libldb >= 1.0.0
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
- Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user
- Change selinux policy requirement to Conflicts: with the old version,
rather than Requires: the supported version.
- New upstream release 0.5.0
- Backport extended NSS API from upstream master branch
- Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
with smart card
- New upstream release 1.9.0 rc1
- Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
- Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
- Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
- Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
- Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
- Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
- Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
- Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
- Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
- Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
- Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
- Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
- Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
- Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
- Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
- Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
- Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
- Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
- Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
- Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
- Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
- Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
- Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
- Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'
- Rebuild against libldb 1.12
- New upstream release 0.6.0
- Fix build with new automake versions
- Add a patch to fix krb5 ccache creation issue with krb5 1.11
- Resolves: rhbz#1431153 - sssd: libsss_proxy.so needs to be linked with -ldl
- Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
the IP address of the machine updated in IPA upon
sssd.service startup
- Rebuilt for Python3.5 rebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Add a patch to fix krb5 unit tests
- New upstream release 0.99.0
- New upstream release 1.14 beta
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0beta
- Apply a couple of patches from upstream git that resolve crashes when
ID mapping object was not initialized properly but needed later
- Make LDB dependency a strict equivalency
- New upstream release 1.12.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.1
- Backport patches with Python3 support from upstream
- Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
commands in man pages since local provider
is deprecated
- Include upstream patch to build with krb5-1.11
- Include couple of patches from upstream 1.11 branch
- Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
Rebuild against Samba rebase.
- Enable hardened build for RHEL7
- Update to 1.16.2 release
- Cleanup unused global definitions
- Remove python2 references from the spec file
- Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x
- Resolves: rhbz#1625842 id_provider= local causes SSSD to abort startup
- Resolves: rhbz#697057 - kpasswd fails when using sssd and
- kadmin server != kdc server
- Upgrades from SysV should now maintain enabled/disabled status
- Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
should not cause files domain entries to be
qualified, this can break sudo access
- Related: rhbz#1611011 - Support for "require smartcard for login option"
- Additional upstream fixes
- Fix double free in monitor
- Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
sssd killed by SIGABRT
- Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
systemd-user service in the account phase in RHEL-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
- Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
- Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
- Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
- Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
- Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
- Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
- Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
- Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
- Resolves: rhbz#2087745 - 2FA prompting setting ineffective
- Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language
- Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
- Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
- Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend
- Backport important patches from upstream 1.14.2 prerelease
- Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
boot
- Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14
- Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
omitted and auth_provider is krb5
- Change default kerberos credential cache location to /run/user/
- Fix failover from Global Catalog to LDAP in case GC is not available
- New upstream release 1.5.8
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
- Support for the LDAP paging control
- Support for multiple DNS servers for name resolution
- Fixes for several group membership bugs
- Fixes for rare crash bugs
- Own several directories create during make install (#839782)
- Move the sss_cache tool to the main package
- New upstream release 1.15.2
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_2.html
- Move sssd_pac to the sssd-krb5 subpackage
- Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
in ding-libs
- Fix SSH integration with fully-qualified domains
- Add the ability to dynamically discover the NetBIOS name
- Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
Rebuild against rebased Samba libs
- Resolves: rhbz#1820574 - [sssd] RHEL 8.3 Tier 0 Localization
- New upstream release 1.5.0
- Fixed issues with LDAP search filters that needed to be escaped
- Add Kerberos FAST support on platforms that support it
- Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
- Added a Kerberos access provider to honor .k5login
- Addressed several thread-safety issues in the sss_client code
- Improved support for delayed online Kerberos auth
- Significantly reduced time between connecting to the network/VPN and
- acquiring a TGT
- Added feature for automatic Kerberos ticket renewal
- Provides the kerberos ticket for long-lived processes or cron jobs
- even when the user logs out
- Added several new features to the LDAP access provider
- Support for 'shadow' access control
- Support for authorizedService access control
- Ability to mix-and-match LDAP access control features
- Added an option for a separate password-change LDAP server for those
- platforms where LDAP referrals are not supported
- Added support for manpage translations
- New upstream release 1.15.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_1.html
- New upstream release 1.12.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3
- Fix spelling errors in description (fedpkg lint)
- Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
- Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
- Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL
- Rebuild sssd against libldb 1.0.2 so the memberof module loads again.
- Related: rhbz#677425
- Log startup errors to the syslog
- Allow cache cleanup to be disabled in sssd.conf
- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
- Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
- Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
- Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
- Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
- Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
- Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)
- require the latest libldb
- Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
users
- Rebuild for libldb 1.1.3
- Rebuild due to rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
- New upstream release 1.9.0 beta 4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
- Add a new AD provider to improve integration with Active Directory 2008 R2
or later servers
- SUDO integration was completely rewritten. The new implementation works
with multiple domains and uses an improved refresh mechanism to download
only the necessary rules
- The IPA authentication provider now supports subdomains
- Fixed regression for setups that were setting default_tkt_enctypes
manually by reverting a previous workaround.
- Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
- Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
- Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
- Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior
error messages with line numbers
- bugfix release 0.3.2
- includes previous release patches
- change permissions of the /etc/sssd/sssd.conf to 0600
- Resolves: rhbz#1615460 - Rebase SSSD to the latest released version
- New upstream release 1.6.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
- Add host access control support for LDAP (similar to pam_host_attr)
- Finer-grained control on principals used with Kerberos (such as for FAST or
- validation)
- Added a new tool sss_cache to allow selective expiring of cached entries
- Added support for LDAP DEREF and ASQ controls
- Added access control features for Novell Directory Server
- FreeIPA dynamic DNS update now checks first to see if an update is needed
- Complete rewrite of the HBAC library
- New libraries: libipa_hbac and libipa_hbac-python
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Fix licenses in sources and on RPMs
- New upstream release 1.10 alpha1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0alpha1
- Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
for D-bus, resulting in a crash
- Rebuild with libldb-1.2.0
- Fix systemd conversion. Upgrades from SysV to systemd weren't properly
- enabling the systemd service.
- Fix a serious memory leak in the memberOf plugin
- Fix an issue where the user's full name would sometimes be removed
- from the cache
- Backport simplification of ccache management from 1.11.1
- Resolves: rhbz#1010553 - sssd setting KRB5CCNAME=(null) on login
- Resolves: rhbz#1382750 - Conflicting default timeout values
- Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"
- Resolves: rhbz#1175511 - sssd-libwbclient conflicts with Samba's and causes
crash in wbinfo
- in addition to the patch libwbclient.so is
filtered out of the Provides list of the package
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
- Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
- Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
- Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
- Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
- Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
- Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
- Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
- Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
- Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
- Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
- Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
- Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
- Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
- Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
- Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
- Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
- Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
- Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
- Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
- Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
- Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
- Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
- Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
- Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
- Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive
- Resolves: rhbz#1448094 - sssd-kcm cannot handle big tickets
- New upstream release 1.11 beta 2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0beta2
- Fix few segfaults
- Resolves: upstream #2811 - PAM responder crashed if user was not set
- Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step
- Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
keyring
- Also apply a patch to fix gating tests issue
- Cherry-pick patches from upstream that enable the files provider
- Enable the files domain
- Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
which is superseded by the files domain autoconfiguration
- Related: rhbz#1357418 - SSSD fast cache for local users
- Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
kdestroy caused by KCM returning a wrong error
code during the delete operation
- Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
username in getpwnam()
- Resolves: rhbz#758425 - LDAP failover not working if server refuses
connections
- Improved handling of users and groups with multi-valued name attributes
(aliases)
- Performance enhancements
Initgroups on RFC2307bis/FreeIPA
HBAC rule processing
- Improved process-hang detection and restarting
- Enabled the midpoint cache refresh by default (fewer cache misses on
commonly-used entries)
- Cleaned up the example configuration
- New tool to change debug level on the fly
- New upstream release 1.12 beta1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0beta1
- fixed items found during review
- added initscript
- Resolves: 1658813 - PKINIT with KCM does not work
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features - fix netgroups and sudo as well
- Fix building pac responder with the krb5-1.14
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization
- Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
- Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
- Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]
- release out of the official 0.3.2 tarball
- Rebuild against new libldb
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
- Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
- Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
- Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
- Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
- Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
- Resolves: RHEL-10721 - very bad performance when requesting service tickets
- Resolves: RHEL-19011 - Invalid handling groups from child domain
- Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]
- Don't discard HBAC rule processing result if SELinux is on
Resolves: rhbz#846792 (CVE-2012-3462)
- New stable upstream version 1.2.0
- Support ServiceGroups for FreeIPA v2 HBAC rules
- Fix long-standing issue with auth_provider = proxy
- Better logging for TLS issues in LDAP
- New upstream release 1.13.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.0
- New upstream release 1.14.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.2
- Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
- Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
- Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11
- Fix ipa-migration bug
- Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
migration mode
- Rebuild against new ding-libs
- Version 0.3.1
- includes previous release patches
- Remove the ability to create public ccachedir (#1015089)
- Fix bug in generation of systemd unit file
- Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
- Fixed "requires/provides" rpmdiff warning
- Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
- Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
- Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
- Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
- Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization
- Move sssd_pac to the sssd-ipa and sssd-ad subpackages
- Trim out RHEL5-specific macros since we don't build on RHEL 5
- Trim out macros for Fedora older than F18
- Update libldb requirement to 1.1.16
- Trim RPM changelog down to the last year
- New upstream release
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
- Support for the service map in NSS
- Support for setting default SELinux user context from FreeIPA
- Support for retrieving SSH user and host keys from LDAP (Experimental)
- Support for caching autofs LDAP requests (Experimental)
- Support for caching SUDO rules (Experimental)
- Fix uninitialized value bug causing crashes throughout the code
- Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup
- Add OSCP checks for p11_child
- Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
users
- Resolves: rhbz#1494002 - sssd_nss crashed in cache_req_search_domains_next
- python-sssdconfig: Fix parssing sssd.conf without config_file_version
- Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed
- Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
done here in order to unblock gating changes before rebase.
- Related: rhbz#1682305
- Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
realm join
- Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
default for AD Provider
- Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
parent directory when logging in
- New upstream stable release 1.0.0
- Switch hardcoded python3 shebangs into the %{__python3} macro
- Version 0.3.0
- Provides file based configuration and lots of improvements
- Resolves: rhbz#1369130 - nss_sss should not link against libpthread
- Resolves: rhbz#1392916 - sssd failes to start after update
- Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
on the directory /etc/sssd
- Rebuild against libldb 1.11
- Fix segfault in sssd_pam when cache_credentials was enabled
- Update the sample configuration
- Fix upgrade issues caused by data provider service removal
- Add support for python3 bindings
- Add requirement to python3 or python3 bindings
- Resolves: rhbz#1014594 - sssd: Support Python 3
- New upstream release 1.9.0 beta 5
- Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
- Many fixes for the support for setting default SELinux user context from
FreeIPA, most notably fixed the specificity evaluation
- Fixed an incorrect default in the krb5_canonicalize option of the AD
provider which was preventing password change operation
- The shadowLastChange attribute value is now correctly updated with the
number of days since the Epoch, not seconds
- Resolves: rhbz#1657980 - sssd_nss memory leak
- Also relax libldb Requires
- Remove --enable-ldb-version-check
- New upstream release 1.10.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.1
- Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
PKCS#11 URI
- New upstream release 1.9.0 beta 2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
- Add support for the Kerberos DIR cache for storing multiple TGTs
automatically
- Major performance enhancement when storing large groups in the cache
- Major performance enhancement when performing initgroups() against Active
Directory
- SSSDConfig data file default locations can now be set during configure for
easier packaging
- New upstream release 1.16.0
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_0.html
- Rebuilt for glibc bug#747377
- Rebuild for Python 3.6
- Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
- Fix release version for upgrades
- New upstream release 1.13.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Add last minute bug fixes, found in testing the package
- Resolves: rhbz#1623878 - crash related to sbus_router_destructor()
- Rebuild against new libldb
- Resolves: rhbz#1652719 - [SECURITY] sssd returns '/' for emtpy home directories
- Fix issue with IPA + SELinux in containers
- Resolves: upstream https://fedorahosted.org/sssd/ticket/3297
- Add support for libldb 1.0.0
- Try to fix build adding automake as an explicit BuildRequire
- Add also a couple of last minute patches from upstream
- Fix systemd executions/requirements
- New upstream release 1.11.4
- Remove upstreamed patch
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.4
- Small cleanup and fixes in the spec file
- BuildRequire recent libini_config to ensure consistent behaviour
- added sss_client
- New upstream release 1.13.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.3
- New upstream release 1.13 alpha
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.0alpha
- Fix potential crash with external groups in trusted IPA-AD setup
- Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
without a password. (Patch by Stephen Gallagher)
- Resolves: rhbz#1736265 - Smart Card auth of local user: endless
loop if wrong PIN was provided
- Resolves: rhbz#2149241 - [sssd] SSSD enters failed state after heavy load in the system
- Resolves: rhbz#1642372 - SSSD Python getgrouplist API was removed but required for IPA
- Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
- Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
- Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
- Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1
- Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files (additional patch)
- Ensure that SSSD builds against libldb-1.0.0 on F15 and later
- Remove .la for memberOf
- Fix CVE-2010-0014
- Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
- Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
- Resolves: rhbz#1893159 - Default debug level should report all errors / failures
- Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication
- Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently
- New upstream release 1.12.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0
- Resolves: rhbz#1718193 - p11_child should have an option to skip
C_WaitForSlotEvent if the PKCS#11 module
does not implement it properly
- Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied
- New upstream release 1.8.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
- Several fixes to case-insensitive domain functions
- Fix for GSSAPI binds when the keytab contains unrelated principals
- Fixed several segfaults
- Workarounds added for LDAP servers with unreadable RootDSE
- SSH knownhostproxy will no longer enter an infinite loop preventing login
- The provided SYSV init script now starts SSSD earlier at startup and stops
it later during shutdown
- Assorted minor fixes for issues discovered by static analysis tools
- Resolve groups from AD correctly
- Restore Requires: cyrus-sasl-gssapi as it is not auto-detected during
- rpmbuild
- Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
not FIPS140 compliant
- Fixes link error on platforms that do not do implicit linking
- Fixes double-free segfault in PAM
- Fixes double-free error in async resolver
- Fixes support for TCP-based DNS lookups in async resolver
- Fixes memory alignment issues on ARM processors
- Manpage fixes
- Resolves: upstream#3529 - sssd-kcm Fix restart during/after upgrade
- Resolves: upstream#3621 - backport bug found by static analyzers
- Fix building on rawhide. Remove -Wl,-z,defs from LDFLAGS
- Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
no members
- New upstream release 1.5.11
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
- Fix a serious regression that prevented SSSD from working with ldaps:// URIs
- IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
- address being saved to the AAAA record
- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
- Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
- Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
- Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
- Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
- Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed
- Resolves: rhbz#1628122 - Printing incorrect information about domain
with sssctl utility
- Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
fails with the KCM ccache
- New upstream release 1.16.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_1.html
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Resolves: rhbz#1673443 - sssd man pages: The default value of
"ldap_user_home_directory" is not mentioned
with AD server configuration
- New upstream release 1.9.1
- Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
- Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
- Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)
- Fix multicast checks in the SSSD
- Resolves: rhbz#1007475 - The multicast check is wrong in the sudo source
code getting the host info
- New upstream release 1.11.3
- Remove upstreamed patches
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.3
- Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
- Resolves: rhbz#1915395 - Memory leak in the simple access provider
- Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
- Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)
- Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
started due to a misconfiguration
- Release candidate for SSSD 1.1
- Add simple access provider
- Create subpackages for libcollection, libini_config, libdhash and librefarray
- Support IPv6
- Support LDAP referrals
- Fix cache issues
- Better feedback from PAM when offline
- Add workaround patch for RHBZ #1366403
- Do not write out dots in the domain-realm mapping file (#905650)
- Fix the Kerberos password expiration warning (#912223)
- Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
- Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
- Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]
- Version 0.2.0
- Add SSSDConfig API
- Update polish translation for 0.6.0
- Fix long timeout on ldap operation
- Make dp requests more robust
- New upstream release 1.12.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.2
- Fix several regressions since 1.5.x
- Ensure that the RPM creates the /var/lib/sss/mc directory
- Add support for Netscape password warning expiration control
- Rebuild against libldb 1.1.6
- Related: rhbz#1637513 - sssd crashes when refreshing expired sudo rules
- Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
the trailing colon
- Fix changelog dates to make F19 rpmbuild happy
-Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
subdomain service name being used
- Fix libwbclient alternatives
- Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
- Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
- Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
- Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
- Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
- Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
- Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
- Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
- Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
- Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
- Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
- Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
- Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
- Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
- Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
- Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
- Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
- Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate
- Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
- Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
- Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently
- New upstream release 1.5.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
- Fixes for Active Directory when not all users and groups have POSIX attributes
- Fixes for handling users and groups that have name aliases (aliases are ignored)
- Fix group memberships after initgroups in the IPA provider
- New upstream release 1.11.5
- Remove upstreamed patch
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5
- Fix regressions with ipa and SELinux
- Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
context on client is staff_u
- Do not crash on resolving a group SID in IPA server mode
- Apply a number of patches from upstream to fix issues found 1.12.3
- Resolves: rhbz#1176373 - dyndns_iface does not accept multiple
interfaces, or isn't documented to be able to
- Resolves: rhbz#988068 - getpwnam_r fails for non-existing users when sssd is
not running
- Resolves: upstream #2557 authentication failure with user from AD
- Fix tests on big-endian
- Fix previous changelog entry
- New upstream release 1.9.0 beta 3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
- Add a new PAC responder for dealing with cross-realm Kerberos trusts
- Terminate idle connections to the NSS and PAM responders
- Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
/usr/libexec/sssd/sssd_be killed by 11 crash
func _dbus_list_unlink
- Fix %postun
- New upstream release 1.8.1
- Resolve issue where we could enter an infinite loop trying to connect to an
auth server
- Fix serious issue with complex (3+ levels) nested groups
- Fix netgroup support for case-insensitivity and aliases
- Fix serious issue with lookup bundling resulting in requests never
completing
- IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
in addition to pam_authenticate
- Fix several regressions in the proxy provider
- Resolves: rhbz#743133 - Performance regression with Kerberos authentication
against AD
- Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work
- Fix a couple of segfaults that may happen on reload
- Fix OTP bug
- Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
entered separately
- Fix missing file permissions for sssd-clients
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Recreate Kerberos ccache directory if it's missing
- Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
directory /run/user/UID/ccdir does not exist
- New upstream release 1.9.3
- Resolves: rhbz#626205 - Unable to unlock screen
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
- Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization
- Initial release (based on version 0.1.0 upstream code)
- New upstream release 1.11.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.1
- New upstream release 1.12 beta2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0beta2
- libwbclient-sssd: update interface to version 0.13
- Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
1.x, this can result in time outs
- Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
searching in local cache database access on
the sock_file system_bus_socket
- Bump up release number to avoid library sub-packages version issues with
previous releases.
- Ensure that the configuration upgrade script always writes the config
file with 0600 permissions
- Eliminate an infinite loop in group enumerations
- Backport upstream patches required by FreeIPA 4.2.1
- Fix accidental disabling of the DIR cache support
- Resolves: upstream#3684 - A group is not updated if its member is removed
with the cleanup task, but the group does not
change
- Resolves: upstream#3558 - sudo: report error when two rules share cn
- Tone down shutdown messages for socket activated responders
- IPA: Qualify the externalUser sudo attribute
- Resolves: upstream#3550 - refresh_expired_interval does not work with
netgrous in 1.15
- Resolves: upstream#3402 - Support alternative sources for the files provider
- Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
- Resolves: upstream#3679 - Make nss netgroup requests more robust
- Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
configured
- Resolves: upstream#3469 - extend sss-certmap man page regarding priority
processing
- Improve docs/debug message about GC detection
- Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
list out of bound?
- Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
set.
- Document which principal does the AD provider use
- Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
defined, but contains no SIDs
- Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
- Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
Provider returned an error
[org.freedesktop.sssd.Error.DataProvider.Fatal]
- New upstream release 1.11.2
- Remove upstreamed patches
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2
- New upstream release 1.15.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.15.0
- New upstream release 1.5.9
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
- Support for overriding home directory, shell and primary GID locally
- Properly honor TTL values from SRV record lookups
- Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
- servers)
- Properly escape IPv6 addresses in the failover code
- Do not crash if inotify fails (e.g. resource exhaustion)
- Don't add multiple TGT renewal callbacks (too many log messages)
- Fix typo in Requires that prevented an upgrade (#973916)
- Use a hardcoded version in Conflicts, not less-than-current
- New upstream release 1.8.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
- Numerous manpage and translation updates
- LDAP: Handle situations where the RootDSE isn't available anonymously
- LDAP: Fix regression for users using non-standard LDAP attributes for user
information
- Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
- Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
- Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)
- Handle OTP response from FreeIPA server gracefully
- Resolves: rhbz#1283798 - sssd failover does not work on connecting to
non-responsive ldaps:// server
- Handle new error code for IPA password migration
- Resolves: rhbz#677768 - name service caches names, so id command shows
- recently deleted users
- Backport several patches from upstream.
- Fix a potential crash against old (pre-4.0) IPA servers
- Resolves: upstream#3573 - sssd won't show netgroups with blank domain
- Resolves: upstream#3660 - confdb_expand_app_domains() always fails
- Resolves: upstream#3658 - Application domain is not interpreted correctly
- Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
json_loads()
- Resolves: upstream#3386 - KCM: Payload buffer is too small
- Resolves: upstream#3666 - Fix usage of str.decode() in our tests
- A few KCM misc fixes
- New upstream release 1.13.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.1
sssd-idp-2.9.4-5.el8_10.2.x86_64.rpm | - Decrease priority of sssd-libwbclient 20 -> 5
- It should be lower than priority of samba veriosn of libwbclient.
- https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18
- Add explicit requirement on selinux-policy version to address new SBUS
symlinks.
- Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
certificate EKU and perform an action based
on value when generating SSH key from a certificate
- Resolves: rhbz#752495 - Crash when apply settings
- Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
repository
- This just required a raise in release number
and changelog for the record.
- Only BuildRequire libcmocka on Fedora
- Resolves: rhbz#1256849 - SUDO: Support the IPA schema
- Use alternatives for libwbclient
- New upstream release 1.12.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.4
- Resolves: rhbz#1754996 - [sssd] Tier 0 Localization
- Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
- Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
file from package sssd-common-1.15.1-1.fc25.x86_64
- Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4
- Unify return type of list_active_domains for python{2,3}
- Fix incorrect tarball URL
- Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
of gen_new to avoid a subsequent switch call
failure
- Fix upgrade issues from old (pre-0.5.0) releases of SSSD
- Resolves: rhbz#1672780 - gdm login not prompting for username when smart
card maps to multiple users
- Resolves: rhbz#683267 - sssd 1.5.1-9 breaks AD authentication
- Fix broken ARM build
- Add missing DP_OPTION_TERMINATOR in AD provider options
- Backport upstream patches for 1.15.3 pre-release
- required for building freeipa-4.5.x in rawhide
- Resolves: rhbz#606887 - sssd stops on upgrade
- Fix nested group member filter sanitization for RFC2307bis
- Put translated tool manpages into the sssd-tools subpackage
- Fix regression with krb5_map_user
- Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
- Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
default if nonexistent domain is mentioned
- New upstream release 1.6.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
- Fixes a major cache performance issue introduced in 1.6.2
- Fixes a potential infinite-loop with certain LDAP layouts
- Related: rhbz#1638150 - session not recording for local user when groups defined
- Also add silence a Coverity warning, which is related to rhbz#1637131
- New upstream release 1.4.1
- Add support for netgroups to the proxy provider
- Fixes a minor bug with UIDs/GIDs >= 2^31
- Fixes a segfault in the kerberos provider
- Fixes a segfault in the NSS responder if a data provider crashes
- Correctly use sdap_netgroup_search_base
- Resolves: rhbz#1636397 - SSSD not fetching all sudo rules from AD
- Change the default ccache location to DIR:/run/user/${UID}/krb5cc
and patch man page accordingly
- Resolves: rhbz#851304
- Resolves: rhbz#1615590 - Do not rely on "python" for el8
- Install systemd unit file instead of sysv init script
- New upstream release 1.9.0 beta7
- obsoletes patches #1-#3
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
- Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
- Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
- Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
- Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
- Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade
- Rebuild for libldb 1.1.19
- Version 0.2.1
- New stable upstream version 1.2.1
- Resolves: rhbz#595529 - spec file should eschew %define in favor of
- %global
- Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
- to fail while restart.
- Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
- keyring
- Resolves: rhbz#599724 - sssd is broken on Rawhide
- Resolves: rhbz#1729055 - sssd does not pass correct rules to sudo
- New upstream release 1.5.6
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
- Fixed a serious memory leak in the memberOf plugin
- Fixed a regression with the negative cache that caused it to be essentially
- nonfunctional
- Fixed an issue where the user's full name would sometimes be removed from
- the cache
- Fixed an issue with password changes in the kerberos provider not working
- with kpasswd
- Fix regression on 64-bit platforms
- Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
suggests using * for backend sss
- New upstream release 1.6.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
- Fixes a serious issue with LDAP connections when the communication is
dropped (e.g. VPN disconnection, waking from sleep)
- SSSD is now less strict when dealing with users/groups with multiple names
when a definitive primary name cannot be determined
- The LDAP provider will no longer attempt to canonicalize by default when
using SASL. An option to re-enable this has been provided.
- Fixes for non-standard LDAP attribute names (e.g. those used by Active
Directory)
- Three HBAC regressions have been fixed.
- Fix for an infinite loop in the deref code
- New upstream release 1.10 beta2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
- BuildRequire libcmocka-devel in order to run all upstream tests during build
- BuildRequire libnl3 instead of libnl1
- No longer BuildRequire initscripts, we no longer use /sbin/service
- Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
older krb5-libs version
- This is to bump version to allow rebuild against rebased libldb.
- New upstream release 1.11.5.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5.1
- Backport patches from upstream 1.12.5 prerelease - contains many fixes
- New upstream release 1.9.0
- New upstream release 1.7.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
- Support for case-insensitive domains
- Support for multiple search bases in the LDAP provider
- Support for the native FreeIPA netgroup implementation
- Reliability improvements to the process monitor
- New DEBUG facility with more consistent log levels
- New tool to change debug log levels without restarting SSSD
- SSSD will now disconnect from LDAP server when idle
- FreeIPA HBAC rules can choose to ignore srchost options for significant
performance gains
- Assorted performance improvements in the LDAP provider
- Resolves: rhbz#1466503 - Snippets are not used when sssd.conf does not exist
- New upstream release 1.13.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.4
- New upstream release 1.5.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
- Fixes for support of FreeIPA v2
- Fixes for failover if DNS entries change
- Improved sss_obfuscate tool with better interactive mode
- Fix several crash bugs
- Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
- Delete users from the local cache if initgroups calls return 'no such user'
- (previously only worked for getpwnam/getpwuid)
- Use new Transifex.net translations
- Better support for automatic TGT renewal (now survives restart)
- Netgroup fixes
- New upstream release 1.8.0 beta 3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
- Fixed a regression in group enumeration since 1.7.0
- Fixed several memory-corruption bugs
- Finalized the ABI for the autofs support
- Fixed a regression in the proxy provider
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
- Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
- Resolves: rhbz#1803134 - Improve "unlock" time when user session already active
- Resolves: rhbz#1328108 - Protocol error with FreeIPA on CentOS 6
- Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
- doesn't require it
- Rebuild against libldb 1.10
- Build with _hardened_build macro
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- New upstream release 1.1.1
- Fixed the IPA provider (which was segfaulting at start)
- Fixed a bug in the SSSDConfig API causing some options to revert to
- their defaults
- This impacted the Authconfig UI
- Ensure that SASL binds to LDAP auto-retry when interrupted by a signal
- Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
- Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter
- Rebuild against new libtevent
- latest upstream release.
- also add a patch that fixes debugging output (potential segfault)
- Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
groups during getgrnam and getgrgid
- Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
in call to 'print'
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features
- Rebuild against PCRE 8.30
- CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Rebuild SSSD against ding-libs 0.3.0beta1
- Fix endianness bug in service map protocol
- Fix pre and post script requirements
- sssd-tools should require sssd-common, not sssd
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
- Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
- Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
- Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
- Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
- Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #
raise(): /usr/libexec/sssd/sssd_autofs killed by 6
- Fix segfault in TGT renewal
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
- Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
- Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
- Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
- Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
- Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]
- Only create the SELinux login file if there are SELinux mappings on
the IPA server
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
- Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)
- Add plugin for cifs-utils
- Resolves: rhbz#998544
- Fix memberOf install path
- Related: rhbz#1638006 - Files: The files provider always enumerates
which causes duplicate when running getent passwd
- New upstream release 1.14.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.1
- New upstream release 1.14 alpha
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0alpha
- Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
setnetgrent_result_timeout
- Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
or machine swaps
- Resolves: failure in glibc tests
https://sourceware.org/bugzilla/show_bug.cgi?id=22530
- Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
auth_provider ldap, login fails if the LDAP server
is not allowing anonymous binds
- Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
corrected with AD
- Resolves: upstream#3586 - Give a more detailed debug and system-log message
if krb5_init_context() failed
- Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
in /etc/systemd/system
- Backport few upstream features from 1.16.1
- Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
new ones (kcm)
- Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
- Resolves: rhbz#1646168 - sssctl access-report always prints an error message
- Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
configuration without having to restart the whole
sssd
- Resolves: rhbz#1640576 - sssctl reports incorrect information about local
user's cache entry expiration time
- Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
- Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys
- the cmocka toolkit exists only on selected arches
- Fixes a serious memory hierarchy bug causing unpredictable behavior in the
LDAP provider.
- New upstream release 1.11.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0
- Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
/usr/libexec/sssd/proxy_child killed by 6
- Fix building of sssd-nfs-idmap with libnfsidmap.so.1
- New upstream release 1.10
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0
- Backport more sbus2 fixes
- Related: rhbz#1623878 - crash related to sbus_router_destructor()
- Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
certificate EKU and perform an action based
on value when generating SSH key from a certificate
(additional patch)
- Solve a shutdown race-condition that sometimes left processes running
- Resolves: rhbz#606887 - SSSD stops on upgrade
- Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
with no specific host/hostgroup set
- Resolves: upstream#3621 - FleetCommander integration must not require
capability DAC_OVERRIDE
- Remove %files reference to sss_debuglevel copied from wrong upstreeam
spec file.
- Resolves: rhbz#1713368 - Add sssd-dbus package as a dependency of sssd-tools
- Resolves: RHEL-33957 - ad: refresh root domain when read directly
- Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
- Make sure to properly convert to systemd if upgrading from newer
- updates for Fedora 14
- Fix build issues: Update expided certificate in unit tests
- New upstream release 0.7.0
- New upstream release 1.14.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0
- Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
sssd_ifp killed by SIGSEGV
- New upstream version 1.2.91 (1.3.0rc1)
- Improved LDAP failover
- Synchronous sysdb API (provides performance enhancements)
- Better online reconnection detection
- New LDAP access provider allows for filtering user access by LDAP attribute
- Reduced default timeout for detecting offline status with LDAP
- GSSAPI ticket lifetime made configurable
- Better offline->online transition support in Kerberos
- Release new upstream version 1.1.91
- Enhancements when using SSSD with FreeIPA v2
- Support for deferred kinit
- Support for DNS SRV records for failover
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
- Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
- Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
- Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
- Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
- Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
- Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
- Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
- Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
- Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
- Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
- Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf
- Resolves: rhbz#1646113 - Missing concise documentation about valid options
for sssd-files-provider
- Fix typo in libwbclient-devel %preun
- Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
- Also sync. kcm multihost tests with master
- Switch unicode library from libunistring to Glib
- Drop unnecessary explicit Requires on keyutils
- Guarantee that versioned Requires include the correct architecture
connection timeout
- Resolves: rhbz#1139962 - Fedora 21, FreeIPA 4.0.2: sssd does not find user
private group from server
- New upstream release 1.5.5
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
- Fixes for several crash bugs
- LDAP group lookups will no longer abort if there is a zero-length member
- attribute
- Add automatic fallback to 'cn' if the 'gecos' attribute does not exist
- New upstream bugfix release 0.99.1
- Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
- Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
- Several segfault bugfixes
- Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
retrieve AD users through IPA Trust
- New upstream release 1.5.10
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
- Fixed a regression introduced in 1.5.9 that could result in blocking calls
- to LDAP
- Rebuilt for libnfsidmap.so.1
- Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
specified up to the seconds
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
if ID provider is authenticated with GSSAPI
- New upstream release 1.9.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Release SSSD 1.1.0 final
- Fix two potential segfaults
- Fix memory leak in monitor
- Better error message for unusable confdb
- New upstream release 1.6.4
- Rolls up previous patches applied to the 1.6.3 tarball
- Fixes a rare issue causing crashes in the failover logic
- Fixes an issue where SSSD would return the wrong PAM error code for users
that it does not recognize.
- Related: rhbz#1635595 - Cant login with smartcard with multiple certs
- New upstream release 1.9.0 beta 1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
- Add native support for autofs to the IPA provider
- Support for ID-mapping when connecting to Active Directory
- Support for handling very large (> 1500 users) groups in Active Directory
- Support for sub-domains (will be used for dealing with trust relationships)
- Add a new fast in-memory cache to speed up lookups of cached data on
repeated requests
- Backport important patches from upstream 1.13 prerelease
- Relax libldb BuildRequires to be greater-or-equal
- Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
- Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
- Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
- Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
inotify events, and no updates are triggered
- Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
on GDM login with smart-card
- Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
- Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
- Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
- Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
if LDAP entries do not contain AD forest root information
- Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
in SSSD-AD direct integration.
- Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
- Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
- Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma
- add missing configure check that broke stopping the daemon
- also fix default config to add a missing required option
- New upstream release 1.9.0 beta 6
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
- A new option, override_shell was added. If this option is set, all users
managed by SSSD will have their shell set to its value.
- Fixes for the support for setting default SELinux user context from FreeIPA.
- Fixed a regression introduced in beta 5 that broke LDAP SASL binds
- The SSSD supports the concept of a Primary Server and a Back Up Server in
failover
- A new command-line tool sss_seed is available to help prime the cache with
a user record when deploying a new machine
- SSSD is now able to discover and save the domain-realm mappings
between an IPA server and a trusted Active Directory server.
- Packaging changes to fix ldconfig usage in subpackages (#843995)
- Rebuild against libldb 1.1.9
- New upstream release 1.9.4
- Rebuild against libldb 1.1.4
- package git snapshot
- Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
access on the sock_file system_bus_socket
- Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
fails to download desktop profile data
- Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
- Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
after applying ID Views for them in IPA server
- Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
mapping is applied
- Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
differs from the default
- Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
- Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
- Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
- Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
- Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
- Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
- Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
- Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
- Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
- Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
- Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
- Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization
- Apply a number of patches from upstream to fix issues found post-beta,
in particular:
-- segfault with a high DEBUG level
-- Fix IPA password migration (upstream #1873)
-- Fix fail over when retrying SRV resolution (upstream #1886)
- Rebuild for libldb 1.1.18
- Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
pam libraries
- Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
prompts (e.g. Password + Token)
- Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
by remote host" if locale not available
- Resolves: rhbz#1733372 - permission denied on logs when running sssd as
non-root user
- Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
information
- Fix Obsoletes: to account for dist tag
- Convert post and pre scripts to run on the sssd-common subpackage
- Remove old conversion from SYSV
- Fix regression in endianness patch
- New upstream release 1.4.0
- Added support for netgroups to the LDAP provider
- Performance improvements made to group processing of RFC2307 LDAP servers
- Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
- Build-system improvements to support Gentoo
- Split out several libraries into the ding-libs tarball
- Manpage reviewed and updated
- Fix regressions and bugs in sssd upstream 1.12.2
- https://fedorahosted.org/sssd/ticket/{id}
- Regressions: #2471, #2475, #2483, #2487, #2529, #2535
- Bugs: #2287, #2445
- New upstream release 1.8.0
- Support for the service map in NSS
- Support for setting default SELinux user context from FreeIPA
- Support for retrieving SSH user and host keys from LDAP (Experimental)
- Support for caching autofs LDAP requests (Experimental)
- Support for caching SUDO rules (Experimental)
- Include the IPA AutoFS provider
- Fixed several memory-corruption bugs
- Fixed a regression in group enumeration since 1.7.0
- Fixed a regression in the proxy provider
- Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
- Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
logged at each login
- Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
/usr/sbin/sssd was killed by signal 11 (SIGSEGV)
- Resolves: rhbz#743133 - Performance regression with Kerberos authentication
against AD
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features
- Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc
- New upstream release 1.10 beta1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta1
- New upstream release 1.12.5
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.5
- Backport few upstream patches/fixes
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
- Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
- Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
- Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
- Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
- Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
- Resolves: rhbz#2098617 - Harden kerberos ticket validation
- Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
- Resolves: rhbz#1164156 - libsss_simpleifp should pull sssd-dbus
- Resolves: rhbz#1179379 - gzip: stdin: file size changed while
zipping when rotating logfile
- Include the 1.9.2 tarball
- Resolves: rhbz#1578014 - sssd does not work under non-root user
- Note: Actually the patches were in the 2.0.0-37, this one just adds this
changelog because it was missing.
- Use mcpath insted of mcachepath macro to be consistent with
upsteam spec file
- Add missing %license macro
- New upstream release
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
- Fix two minor manpage bugs
- Include the IPA AutoFS provider
- Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
and libtevent to avoid an issue in GPO processing
- Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
- against LDAP
- Resolves: upstream#3618 - selinux_child segfaults in a docker container
- Check the validity of naming context
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- New upstream release 1.15.3
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_3.html
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Resolves: rhbz#1726945 - negative cache does not use values from
'filter_users' config option for known domains
- Related: rhbz#1637131 - pam_unix unable to match fully qualified username
provided by sssd during smartcard auth using gdm
- New upstream release 1.5.1
- Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Vast performance improvements when enumerate = true
- All PAM actions will now perform a forced initgroups lookup instead of just
- a user information lookup
- This guarantees that all group information is available to other
- providers, such as the simple provider.
- For backwards-compatibility, DNS lookups will also fall back to trying the
- SSSD domain name as a DNS discovery domain.
- Support for more password expiration policies in LDAP
- 389 Directory Server
- FreeIPA
- ActiveDirectory
- Support for ldap_tls_{cert,key,cipher_suite} config options
-Assorted bugfixes
- Resolves: #967012 - [abrt] sssd-1.9.5-1.fc18: sss_mmap_cache_gr_invalidate_gid:
Process /usr/libexec/sssd/sssd_nss was killed by
signal 11 (SIGSEGV)
- Resolves: #996214 - sssd proxy_child segfault
- Resolves: rhbz#1687281
Rebase sssd in RHEL-8.1 to the latest upstream release
- Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
- Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
- Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working
- Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
- cached password with predicatable filename
- Backport important patches from upstream 1.13 prerelease
- Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
attribute for group name
- Resolves: upstream #2335 - Investigate using the krb5 responder
for driving the PAM conversation with OTPs
- Enable cmocka tests for secondary architectures
- Split internal helper libraries into a shared object
- Significantly reduce disk-space usage
- Resolves: rhbz#1687281
Rebase sssd in RHEL-8.1 to the latest upstream release
-Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
UnknownProperty: Unknown property
- Re-add manpage translations
- Resolves: rhbz#632615 - the krb5 locator plugin isn't packaged for multilib
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Patch SSSDConfig API to address
- https://bugzilla.redhat.com/show_bug.cgi?id=549482
- Fix slow login with ipa and SELinux
- Resolves: upstream #2624 - Only set the selinux context if the context
differs from the local one
for match rules sss-certmap
- Resolves: RHEL-39085 - [RfE] SSSD Failover Enhancements
- Rebuild for new libldb
- Don't duplicate libsss_autofs.so in two packages
- Set explicit package contents instead of globbing
- New upstream release 1.5.3
- Support for libldb >= 1.0.0
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
- Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user
- Change selinux policy requirement to Conflicts: with the old version,
rather than Requires: the supported version.
- New upstream release 0.5.0
- Backport extended NSS API from upstream master branch
- Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
with smart card
- New upstream release 1.9.0 rc1
- Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
- Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
- Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
- Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
- Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
- Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
- Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
- Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
- Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
- Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
- Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
- Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
- Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
- Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
- Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
- Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
- Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
- Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
- Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
- Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
- Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
- Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
- Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
- Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'
- Rebuild against libldb 1.12
- New upstream release 0.6.0
- Fix build with new automake versions
- Add a patch to fix krb5 ccache creation issue with krb5 1.11
- Resolves: rhbz#1431153 - sssd: libsss_proxy.so needs to be linked with -ldl
- Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
the IP address of the machine updated in IPA upon
sssd.service startup
- Rebuilt for Python3.5 rebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Add a patch to fix krb5 unit tests
- New upstream release 0.99.0
- New upstream release 1.14 beta
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0beta
- Apply a couple of patches from upstream git that resolve crashes when
ID mapping object was not initialized properly but needed later
- Make LDB dependency a strict equivalency
- New upstream release 1.12.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.1
- Backport patches with Python3 support from upstream
- Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
commands in man pages since local provider
is deprecated
- Include upstream patch to build with krb5-1.11
- Include couple of patches from upstream 1.11 branch
- Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
Rebuild against Samba rebase.
- Enable hardened build for RHEL7
- Update to 1.16.2 release
- Cleanup unused global definitions
- Remove python2 references from the spec file
- Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x
- Resolves: rhbz#1625842 id_provider= local causes SSSD to abort startup
- Resolves: rhbz#697057 - kpasswd fails when using sssd and
- kadmin server != kdc server
- Upgrades from SysV should now maintain enabled/disabled status
- Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
should not cause files domain entries to be
qualified, this can break sudo access
- Related: rhbz#1611011 - Support for "require smartcard for login option"
- Additional upstream fixes
- Fix double free in monitor
- Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
sssd killed by SIGABRT
- Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
systemd-user service in the account phase in RHEL-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
- Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
- Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
- Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
- Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
- Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
- Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
- Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
- Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
- Resolves: rhbz#2087745 - 2FA prompting setting ineffective
- Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language
- Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
- Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
- Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend
- Backport important patches from upstream 1.14.2 prerelease
- Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
boot
- Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14
- Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
omitted and auth_provider is krb5
- Change default kerberos credential cache location to /run/user/
- Fix failover from Global Catalog to LDAP in case GC is not available
- New upstream release 1.5.8
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
- Support for the LDAP paging control
- Support for multiple DNS servers for name resolution
- Fixes for several group membership bugs
- Fixes for rare crash bugs
- Own several directories create during make install (#839782)
- Move the sss_cache tool to the main package
- New upstream release 1.15.2
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_2.html
- Move sssd_pac to the sssd-krb5 subpackage
- Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
in ding-libs
- Fix SSH integration with fully-qualified domains
- Add the ability to dynamically discover the NetBIOS name
- Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
Rebuild against rebased Samba libs
- Resolves: rhbz#1820574 - [sssd] RHEL 8.3 Tier 0 Localization
- New upstream release 1.5.0
- Fixed issues with LDAP search filters that needed to be escaped
- Add Kerberos FAST support on platforms that support it
- Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
- Added a Kerberos access provider to honor .k5login
- Addressed several thread-safety issues in the sss_client code
- Improved support for delayed online Kerberos auth
- Significantly reduced time between connecting to the network/VPN and
- acquiring a TGT
- Added feature for automatic Kerberos ticket renewal
- Provides the kerberos ticket for long-lived processes or cron jobs
- even when the user logs out
- Added several new features to the LDAP access provider
- Support for 'shadow' access control
- Support for authorizedService access control
- Ability to mix-and-match LDAP access control features
- Added an option for a separate password-change LDAP server for those
- platforms where LDAP referrals are not supported
- Added support for manpage translations
- New upstream release 1.15.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_1.html
- New upstream release 1.12.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3
- Fix spelling errors in description (fedpkg lint)
- Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
- Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
- Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL
- Rebuild sssd against libldb 1.0.2 so the memberof module loads again.
- Related: rhbz#677425
- Log startup errors to the syslog
- Allow cache cleanup to be disabled in sssd.conf
- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
- Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
- Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
- Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
- Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
- Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
- Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)
- require the latest libldb
- Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
users
- Rebuild for libldb 1.1.3
- Rebuild due to rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
- New upstream release 1.9.0 beta 4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
- Add a new AD provider to improve integration with Active Directory 2008 R2
or later servers
- SUDO integration was completely rewritten. The new implementation works
with multiple domains and uses an improved refresh mechanism to download
only the necessary rules
- The IPA authentication provider now supports subdomains
- Fixed regression for setups that were setting default_tkt_enctypes
manually by reverting a previous workaround.
- Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
- Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
- Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
- Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior
error messages with line numbers
- bugfix release 0.3.2
- includes previous release patches
- change permissions of the /etc/sssd/sssd.conf to 0600
- Resolves: rhbz#1615460 - Rebase SSSD to the latest released version
- New upstream release 1.6.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
- Add host access control support for LDAP (similar to pam_host_attr)
- Finer-grained control on principals used with Kerberos (such as for FAST or
- validation)
- Added a new tool sss_cache to allow selective expiring of cached entries
- Added support for LDAP DEREF and ASQ controls
- Added access control features for Novell Directory Server
- FreeIPA dynamic DNS update now checks first to see if an update is needed
- Complete rewrite of the HBAC library
- New libraries: libipa_hbac and libipa_hbac-python
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Fix licenses in sources and on RPMs
- New upstream release 1.10 alpha1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0alpha1
- Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
for D-bus, resulting in a crash
- Rebuild with libldb-1.2.0
- Fix systemd conversion. Upgrades from SysV to systemd weren't properly
- enabling the systemd service.
- Fix a serious memory leak in the memberOf plugin
- Fix an issue where the user's full name would sometimes be removed
- from the cache
- Backport simplification of ccache management from 1.11.1
- Resolves: rhbz#1010553 - sssd setting KRB5CCNAME=(null) on login
- Resolves: rhbz#1382750 - Conflicting default timeout values
- Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"
- Resolves: rhbz#1175511 - sssd-libwbclient conflicts with Samba's and causes
crash in wbinfo
- in addition to the patch libwbclient.so is
filtered out of the Provides list of the package
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
- Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
- Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
- Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
- Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
- Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
- Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
- Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
- Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
- Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
- Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
- Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
- Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
- Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
- Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
- Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
- Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
- Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
- Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
- Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
- Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
- Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
- Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
- Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
- Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
- Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive
- Resolves: rhbz#1448094 - sssd-kcm cannot handle big tickets
- New upstream release 1.11 beta 2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0beta2
- Fix few segfaults
- Resolves: upstream #2811 - PAM responder crashed if user was not set
- Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step
- Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
keyring
- Also apply a patch to fix gating tests issue
- Cherry-pick patches from upstream that enable the files provider
- Enable the files domain
- Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
which is superseded by the files domain autoconfiguration
- Related: rhbz#1357418 - SSSD fast cache for local users
- Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
kdestroy caused by KCM returning a wrong error
code during the delete operation
- Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
username in getpwnam()
- Resolves: rhbz#758425 - LDAP failover not working if server refuses
connections
- Improved handling of users and groups with multi-valued name attributes
(aliases)
- Performance enhancements
Initgroups on RFC2307bis/FreeIPA
HBAC rule processing
- Improved process-hang detection and restarting
- Enabled the midpoint cache refresh by default (fewer cache misses on
commonly-used entries)
- Cleaned up the example configuration
- New tool to change debug level on the fly
- New upstream release 1.12 beta1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0beta1
- fixed items found during review
- added initscript
- Resolves: 1658813 - PKINIT with KCM does not work
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features - fix netgroups and sudo as well
- Fix building pac responder with the krb5-1.14
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization
- Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
- Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
- Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]
- release out of the official 0.3.2 tarball
- Rebuild against new libldb
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
- Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
- Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
- Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
- Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
- Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
- Resolves: RHEL-10721 - very bad performance when requesting service tickets
- Resolves: RHEL-19011 - Invalid handling groups from child domain
- Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]
- Don't discard HBAC rule processing result if SELinux is on
Resolves: rhbz#846792 (CVE-2012-3462)
- New stable upstream version 1.2.0
- Support ServiceGroups for FreeIPA v2 HBAC rules
- Fix long-standing issue with auth_provider = proxy
- Better logging for TLS issues in LDAP
- New upstream release 1.13.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.0
- New upstream release 1.14.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.2
- Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
- Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
- Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11
- Fix ipa-migration bug
- Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
migration mode
- Rebuild against new ding-libs
- Version 0.3.1
- includes previous release patches
- Remove the ability to create public ccachedir (#1015089)
- Fix bug in generation of systemd unit file
- Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
- Fixed "requires/provides" rpmdiff warning
- Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
- Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
- Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
- Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
- Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization
- Move sssd_pac to the sssd-ipa and sssd-ad subpackages
- Trim out RHEL5-specific macros since we don't build on RHEL 5
- Trim out macros for Fedora older than F18
- Update libldb requirement to 1.1.16
- Trim RPM changelog down to the last year
- New upstream release
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
- Support for the service map in NSS
- Support for setting default SELinux user context from FreeIPA
- Support for retrieving SSH user and host keys from LDAP (Experimental)
- Support for caching autofs LDAP requests (Experimental)
- Support for caching SUDO rules (Experimental)
- Fix uninitialized value bug causing crashes throughout the code
- Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup
- Add OSCP checks for p11_child
- Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
users
- Resolves: rhbz#1494002 - sssd_nss crashed in cache_req_search_domains_next
- python-sssdconfig: Fix parssing sssd.conf without config_file_version
- Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed
- Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
done here in order to unblock gating changes before rebase.
- Related: rhbz#1682305
- Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
realm join
- Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
default for AD Provider
- Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
parent directory when logging in
- New upstream stable release 1.0.0
- Switch hardcoded python3 shebangs into the %{__python3} macro
- Version 0.3.0
- Provides file based configuration and lots of improvements
- Resolves: rhbz#1369130 - nss_sss should not link against libpthread
- Resolves: rhbz#1392916 - sssd failes to start after update
- Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
on the directory /etc/sssd
- Rebuild against libldb 1.11
- Fix segfault in sssd_pam when cache_credentials was enabled
- Update the sample configuration
- Fix upgrade issues caused by data provider service removal
- Add support for python3 bindings
- Add requirement to python3 or python3 bindings
- Resolves: rhbz#1014594 - sssd: Support Python 3
- New upstream release 1.9.0 beta 5
- Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
- Many fixes for the support for setting default SELinux user context from
FreeIPA, most notably fixed the specificity evaluation
- Fixed an incorrect default in the krb5_canonicalize option of the AD
provider which was preventing password change operation
- The shadowLastChange attribute value is now correctly updated with the
number of days since the Epoch, not seconds
- Resolves: rhbz#1657980 - sssd_nss memory leak
- Also relax libldb Requires
- Remove --enable-ldb-version-check
- New upstream release 1.10.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.1
- Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
PKCS#11 URI
- New upstream release 1.9.0 beta 2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
- Add support for the Kerberos DIR cache for storing multiple TGTs
automatically
- Major performance enhancement when storing large groups in the cache
- Major performance enhancement when performing initgroups() against Active
Directory
- SSSDConfig data file default locations can now be set during configure for
easier packaging
- New upstream release 1.16.0
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_0.html
- Rebuilt for glibc bug#747377
- Rebuild for Python 3.6
- Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
- Fix release version for upgrades
- New upstream release 1.13.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Add last minute bug fixes, found in testing the package
- Resolves: rhbz#1623878 - crash related to sbus_router_destructor()
- Rebuild against new libldb
- Resolves: rhbz#1652719 - [SECURITY] sssd returns '/' for emtpy home directories
- Fix issue with IPA + SELinux in containers
- Resolves: upstream https://fedorahosted.org/sssd/ticket/3297
- Add support for libldb 1.0.0
- Try to fix build adding automake as an explicit BuildRequire
- Add also a couple of last minute patches from upstream
- Fix systemd executions/requirements
- New upstream release 1.11.4
- Remove upstreamed patch
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.4
- Small cleanup and fixes in the spec file
- BuildRequire recent libini_config to ensure consistent behaviour
- added sss_client
- New upstream release 1.13.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.3
- New upstream release 1.13 alpha
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.0alpha
- Fix potential crash with external groups in trusted IPA-AD setup
- Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
without a password. (Patch by Stephen Gallagher)
- Resolves: rhbz#1736265 - Smart Card auth of local user: endless
loop if wrong PIN was provided
- Resolves: rhbz#2149241 - [sssd] SSSD enters failed state after heavy load in the system
- Resolves: rhbz#1642372 - SSSD Python getgrouplist API was removed but required for IPA
- Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
- Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
- Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
- Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1
- Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files (additional patch)
- Ensure that SSSD builds against libldb-1.0.0 on F15 and later
- Remove .la for memberOf
- Fix CVE-2010-0014
- Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
- Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
- Resolves: rhbz#1893159 - Default debug level should report all errors / failures
- Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication
- Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently
- New upstream release 1.12.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0
- Resolves: rhbz#1718193 - p11_child should have an option to skip
C_WaitForSlotEvent if the PKCS#11 module
does not implement it properly
- Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied
- New upstream release 1.8.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
- Several fixes to case-insensitive domain functions
- Fix for GSSAPI binds when the keytab contains unrelated principals
- Fixed several segfaults
- Workarounds added for LDAP servers with unreadable RootDSE
- SSH knownhostproxy will no longer enter an infinite loop preventing login
- The provided SYSV init script now starts SSSD earlier at startup and stops
it later during shutdown
- Assorted minor fixes for issues discovered by static analysis tools
- Resolve groups from AD correctly
- Restore Requires: cyrus-sasl-gssapi as it is not auto-detected during
- rpmbuild
- Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
not FIPS140 compliant
- Fixes link error on platforms that do not do implicit linking
- Fixes double-free segfault in PAM
- Fixes double-free error in async resolver
- Fixes support for TCP-based DNS lookups in async resolver
- Fixes memory alignment issues on ARM processors
- Manpage fixes
- Resolves: upstream#3529 - sssd-kcm Fix restart during/after upgrade
- Resolves: upstream#3621 - backport bug found by static analyzers
- Fix building on rawhide. Remove -Wl,-z,defs from LDFLAGS
- Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
no members
- New upstream release 1.5.11
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
- Fix a serious regression that prevented SSSD from working with ldaps:// URIs
- IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
- address being saved to the AAAA record
- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
- Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
- Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
- Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
- Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
- Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed
- Resolves: rhbz#1628122 - Printing incorrect information about domain
with sssctl utility
- Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
fails with the KCM ccache
- New upstream release 1.16.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_1.html
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Resolves: rhbz#1673443 - sssd man pages: The default value of
"ldap_user_home_directory" is not mentioned
with AD server configuration
- New upstream release 1.9.1
- Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
- Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
- Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)
- Fix multicast checks in the SSSD
- Resolves: rhbz#1007475 - The multicast check is wrong in the sudo source
code getting the host info
- New upstream release 1.11.3
- Remove upstreamed patches
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.3
- Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
- Resolves: rhbz#1915395 - Memory leak in the simple access provider
- Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
- Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)
- Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
started due to a misconfiguration
- Release candidate for SSSD 1.1
- Add simple access provider
- Create subpackages for libcollection, libini_config, libdhash and librefarray
- Support IPv6
- Support LDAP referrals
- Fix cache issues
- Better feedback from PAM when offline
- Add workaround patch for RHBZ #1366403
- Do not write out dots in the domain-realm mapping file (#905650)
- Fix the Kerberos password expiration warning (#912223)
- Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
- Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
- Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]
- Version 0.2.0
- Add SSSDConfig API
- Update polish translation for 0.6.0
- Fix long timeout on ldap operation
- Make dp requests more robust
- New upstream release 1.12.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.2
- Fix several regressions since 1.5.x
- Ensure that the RPM creates the /var/lib/sss/mc directory
- Add support for Netscape password warning expiration control
- Rebuild against libldb 1.1.6
- Related: rhbz#1637513 - sssd crashes when refreshing expired sudo rules
- Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
the trailing colon
- Fix changelog dates to make F19 rpmbuild happy
-Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
subdomain service name being used
- Fix libwbclient alternatives
- Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
- Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
- Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
- Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
- Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
- Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
- Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
- Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
- Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
- Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
- Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
- Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
- Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
- Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
- Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
- Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
- Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
- Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate
- Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
- Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
- Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently
- New upstream release 1.5.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
- Fixes for Active Directory when not all users and groups have POSIX attributes
- Fixes for handling users and groups that have name aliases (aliases are ignored)
- Fix group memberships after initgroups in the IPA provider
- New upstream release 1.11.5
- Remove upstreamed patch
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5
- Fix regressions with ipa and SELinux
- Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
context on client is staff_u
- Do not crash on resolving a group SID in IPA server mode
- Apply a number of patches from upstream to fix issues found 1.12.3
- Resolves: rhbz#1176373 - dyndns_iface does not accept multiple
interfaces, or isn't documented to be able to
- Resolves: rhbz#988068 - getpwnam_r fails for non-existing users when sssd is
not running
- Resolves: upstream #2557 authentication failure with user from AD
- Fix tests on big-endian
- Fix previous changelog entry
- New upstream release 1.9.0 beta 3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
- Add a new PAC responder for dealing with cross-realm Kerberos trusts
- Terminate idle connections to the NSS and PAM responders
- Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
/usr/libexec/sssd/sssd_be killed by 11 crash
func _dbus_list_unlink
- Fix %postun
- New upstream release 1.8.1
- Resolve issue where we could enter an infinite loop trying to connect to an
auth server
- Fix serious issue with complex (3+ levels) nested groups
- Fix netgroup support for case-insensitivity and aliases
- Fix serious issue with lookup bundling resulting in requests never
completing
- IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
in addition to pam_authenticate
- Fix several regressions in the proxy provider
- Resolves: rhbz#743133 - Performance regression with Kerberos authentication
against AD
- Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work
- Fix a couple of segfaults that may happen on reload
- Fix OTP bug
- Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
entered separately
- Fix missing file permissions for sssd-clients
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Recreate Kerberos ccache directory if it's missing
- Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
directory /run/user/UID/ccdir does not exist
- New upstream release 1.9.3
- Resolves: rhbz#626205 - Unable to unlock screen
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
- Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization
- Initial release (based on version 0.1.0 upstream code)
- New upstream release 1.11.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.1
- New upstream release 1.12 beta2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0beta2
- libwbclient-sssd: update interface to version 0.13
- Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
1.x, this can result in time outs
- Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
searching in local cache database access on
the sock_file system_bus_socket
- Bump up release number to avoid library sub-packages version issues with
previous releases.
- Ensure that the configuration upgrade script always writes the config
file with 0600 permissions
- Eliminate an infinite loop in group enumerations
- Backport upstream patches required by FreeIPA 4.2.1
- Fix accidental disabling of the DIR cache support
- Resolves: upstream#3684 - A group is not updated if its member is removed
with the cleanup task, but the group does not
change
- Resolves: upstream#3558 - sudo: report error when two rules share cn
- Tone down shutdown messages for socket activated responders
- IPA: Qualify the externalUser sudo attribute
- Resolves: upstream#3550 - refresh_expired_interval does not work with
netgrous in 1.15
- Resolves: upstream#3402 - Support alternative sources for the files provider
- Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
- Resolves: upstream#3679 - Make nss netgroup requests more robust
- Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
configured
- Resolves: upstream#3469 - extend sss-certmap man page regarding priority
processing
- Improve docs/debug message about GC detection
- Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
list out of bound?
- Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
set.
- Document which principal does the AD provider use
- Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
defined, but contains no SIDs
- Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
- Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
Provider returned an error
[org.freedesktop.sssd.Error.DataProvider.Fatal]
- New upstream release 1.11.2
- Remove upstreamed patches
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2
- New upstream release 1.15.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.15.0
- New upstream release 1.5.9
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
- Support for overriding home directory, shell and primary GID locally
- Properly honor TTL values from SRV record lookups
- Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
- servers)
- Properly escape IPv6 addresses in the failover code
- Do not crash if inotify fails (e.g. resource exhaustion)
- Don't add multiple TGT renewal callbacks (too many log messages)
- Fix typo in Requires that prevented an upgrade (#973916)
- Use a hardcoded version in Conflicts, not less-than-current
- New upstream release 1.8.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
- Numerous manpage and translation updates
- LDAP: Handle situations where the RootDSE isn't available anonymously
- LDAP: Fix regression for users using non-standard LDAP attributes for user
information
- Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
- Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
- Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)
- Handle OTP response from FreeIPA server gracefully
- Resolves: rhbz#1283798 - sssd failover does not work on connecting to
non-responsive ldaps:// server
- Handle new error code for IPA password migration
- Resolves: rhbz#677768 - name service caches names, so id command shows
- recently deleted users
- Backport several patches from upstream.
- Fix a potential crash against old (pre-4.0) IPA servers
- Resolves: upstream#3573 - sssd won't show netgroups with blank domain
- Resolves: upstream#3660 - confdb_expand_app_domains() always fails
- Resolves: upstream#3658 - Application domain is not interpreted correctly
- Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
json_loads()
- Resolves: upstream#3386 - KCM: Payload buffer is too small
- Resolves: upstream#3666 - Fix usage of str.decode() in our tests
- A few KCM misc fixes
- New upstream release 1.13.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.1
sssd-tools-2.9.4-5.el8_10.2.x86_64.rpm | - Decrease priority of sssd-libwbclient 20 -> 5
- It should be lower than priority of samba veriosn of libwbclient.
- https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18
- Add explicit requirement on selinux-policy version to address new SBUS
symlinks.
- Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
certificate EKU and perform an action based
on value when generating SSH key from a certificate
- Resolves: rhbz#752495 - Crash when apply settings
- Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
repository
- This just required a raise in release number
and changelog for the record.
- Only BuildRequire libcmocka on Fedora
- Resolves: rhbz#1256849 - SUDO: Support the IPA schema
- Use alternatives for libwbclient
- New upstream release 1.12.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.4
- Resolves: rhbz#1754996 - [sssd] Tier 0 Localization
- Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
- Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
file from package sssd-common-1.15.1-1.fc25.x86_64
- Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4
- Unify return type of list_active_domains for python{2,3}
- Fix incorrect tarball URL
- Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
of gen_new to avoid a subsequent switch call
failure
- Fix upgrade issues from old (pre-0.5.0) releases of SSSD
- Resolves: rhbz#1672780 - gdm login not prompting for username when smart
card maps to multiple users
- Resolves: rhbz#683267 - sssd 1.5.1-9 breaks AD authentication
- Fix broken ARM build
- Add missing DP_OPTION_TERMINATOR in AD provider options
- Backport upstream patches for 1.15.3 pre-release
- required for building freeipa-4.5.x in rawhide
- Resolves: rhbz#606887 - sssd stops on upgrade
- Fix nested group member filter sanitization for RFC2307bis
- Put translated tool manpages into the sssd-tools subpackage
- Fix regression with krb5_map_user
- Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
- Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
default if nonexistent domain is mentioned
- New upstream release 1.6.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
- Fixes a major cache performance issue introduced in 1.6.2
- Fixes a potential infinite-loop with certain LDAP layouts
- Related: rhbz#1638150 - session not recording for local user when groups defined
- Also add silence a Coverity warning, which is related to rhbz#1637131
- New upstream release 1.4.1
- Add support for netgroups to the proxy provider
- Fixes a minor bug with UIDs/GIDs >= 2^31
- Fixes a segfault in the kerberos provider
- Fixes a segfault in the NSS responder if a data provider crashes
- Correctly use sdap_netgroup_search_base
- Resolves: rhbz#1636397 - SSSD not fetching all sudo rules from AD
- Change the default ccache location to DIR:/run/user/${UID}/krb5cc
and patch man page accordingly
- Resolves: rhbz#851304
- Resolves: rhbz#1615590 - Do not rely on "python" for el8
- Install systemd unit file instead of sysv init script
- New upstream release 1.9.0 beta7
- obsoletes patches #1-#3
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
- Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
- Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
- Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
- Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
- Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade
- Rebuild for libldb 1.1.19
- Version 0.2.1
- New stable upstream version 1.2.1
- Resolves: rhbz#595529 - spec file should eschew %define in favor of
- %global
- Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
- to fail while restart.
- Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
- keyring
- Resolves: rhbz#599724 - sssd is broken on Rawhide
- Resolves: rhbz#1729055 - sssd does not pass correct rules to sudo
- New upstream release 1.5.6
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
- Fixed a serious memory leak in the memberOf plugin
- Fixed a regression with the negative cache that caused it to be essentially
- nonfunctional
- Fixed an issue where the user's full name would sometimes be removed from
- the cache
- Fixed an issue with password changes in the kerberos provider not working
- with kpasswd
- Fix regression on 64-bit platforms
- Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
suggests using * for backend sss
- New upstream release 1.6.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
- Fixes a serious issue with LDAP connections when the communication is
dropped (e.g. VPN disconnection, waking from sleep)
- SSSD is now less strict when dealing with users/groups with multiple names
when a definitive primary name cannot be determined
- The LDAP provider will no longer attempt to canonicalize by default when
using SASL. An option to re-enable this has been provided.
- Fixes for non-standard LDAP attribute names (e.g. those used by Active
Directory)
- Three HBAC regressions have been fixed.
- Fix for an infinite loop in the deref code
- New upstream release 1.10 beta2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
- BuildRequire libcmocka-devel in order to run all upstream tests during build
- BuildRequire libnl3 instead of libnl1
- No longer BuildRequire initscripts, we no longer use /sbin/service
- Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
older krb5-libs version
- This is to bump version to allow rebuild against rebased libldb.
- New upstream release 1.11.5.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5.1
- Backport patches from upstream 1.12.5 prerelease - contains many fixes
- New upstream release 1.9.0
- New upstream release 1.7.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
- Support for case-insensitive domains
- Support for multiple search bases in the LDAP provider
- Support for the native FreeIPA netgroup implementation
- Reliability improvements to the process monitor
- New DEBUG facility with more consistent log levels
- New tool to change debug log levels without restarting SSSD
- SSSD will now disconnect from LDAP server when idle
- FreeIPA HBAC rules can choose to ignore srchost options for significant
performance gains
- Assorted performance improvements in the LDAP provider
- Resolves: rhbz#1466503 - Snippets are not used when sssd.conf does not exist
- New upstream release 1.13.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.4
- New upstream release 1.5.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
- Fixes for support of FreeIPA v2
- Fixes for failover if DNS entries change
- Improved sss_obfuscate tool with better interactive mode
- Fix several crash bugs
- Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
- Delete users from the local cache if initgroups calls return 'no such user'
- (previously only worked for getpwnam/getpwuid)
- Use new Transifex.net translations
- Better support for automatic TGT renewal (now survives restart)
- Netgroup fixes
- New upstream release 1.8.0 beta 3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
- Fixed a regression in group enumeration since 1.7.0
- Fixed several memory-corruption bugs
- Finalized the ABI for the autofs support
- Fixed a regression in the proxy provider
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
- Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
- Resolves: rhbz#1803134 - Improve "unlock" time when user session already active
- Resolves: rhbz#1328108 - Protocol error with FreeIPA on CentOS 6
- Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
- doesn't require it
- Rebuild against libldb 1.10
- Build with _hardened_build macro
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- New upstream release 1.1.1
- Fixed the IPA provider (which was segfaulting at start)
- Fixed a bug in the SSSDConfig API causing some options to revert to
- their defaults
- This impacted the Authconfig UI
- Ensure that SASL binds to LDAP auto-retry when interrupted by a signal
- Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
- Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter
- Rebuild against new libtevent
- latest upstream release.
- also add a patch that fixes debugging output (potential segfault)
- Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
groups during getgrnam and getgrgid
- Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
in call to 'print'
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features
- Rebuild against PCRE 8.30
- CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Rebuild SSSD against ding-libs 0.3.0beta1
- Fix endianness bug in service map protocol
- Fix pre and post script requirements
- sssd-tools should require sssd-common, not sssd
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
- Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
- Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
- Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
- Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
- Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #
raise(): /usr/libexec/sssd/sssd_autofs killed by 6
- Fix segfault in TGT renewal
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
- Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
- Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
- Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
- Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
- Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]
- Only create the SELinux login file if there are SELinux mappings on
the IPA server
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
- Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)
- Add plugin for cifs-utils
- Resolves: rhbz#998544
- Fix memberOf install path
- Related: rhbz#1638006 - Files: The files provider always enumerates
which causes duplicate when running getent passwd
- New upstream release 1.14.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.1
- New upstream release 1.14 alpha
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0alpha
- Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
setnetgrent_result_timeout
- Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
or machine swaps
- Resolves: failure in glibc tests
https://sourceware.org/bugzilla/show_bug.cgi?id=22530
- Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
auth_provider ldap, login fails if the LDAP server
is not allowing anonymous binds
- Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
corrected with AD
- Resolves: upstream#3586 - Give a more detailed debug and system-log message
if krb5_init_context() failed
- Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
in /etc/systemd/system
- Backport few upstream features from 1.16.1
- Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
new ones (kcm)
- Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
- Resolves: rhbz#1646168 - sssctl access-report always prints an error message
- Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
configuration without having to restart the whole
sssd
- Resolves: rhbz#1640576 - sssctl reports incorrect information about local
user's cache entry expiration time
- Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
- Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys
- the cmocka toolkit exists only on selected arches
- Fixes a serious memory hierarchy bug causing unpredictable behavior in the
LDAP provider.
- New upstream release 1.11.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0
- Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
/usr/libexec/sssd/proxy_child killed by 6
- Fix building of sssd-nfs-idmap with libnfsidmap.so.1
- New upstream release 1.10
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0
- Backport more sbus2 fixes
- Related: rhbz#1623878 - crash related to sbus_router_destructor()
- Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
certificate EKU and perform an action based
on value when generating SSH key from a certificate
(additional patch)
- Solve a shutdown race-condition that sometimes left processes running
- Resolves: rhbz#606887 - SSSD stops on upgrade
- Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
with no specific host/hostgroup set
- Resolves: upstream#3621 - FleetCommander integration must not require
capability DAC_OVERRIDE
- Remove %files reference to sss_debuglevel copied from wrong upstreeam
spec file.
- Resolves: rhbz#1713368 - Add sssd-dbus package as a dependency of sssd-tools
- Resolves: RHEL-33957 - ad: refresh root domain when read directly
- Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
- Make sure to properly convert to systemd if upgrading from newer
- updates for Fedora 14
- Fix build issues: Update expided certificate in unit tests
- New upstream release 0.7.0
- New upstream release 1.14.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0
- Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
sssd_ifp killed by SIGSEGV
- New upstream version 1.2.91 (1.3.0rc1)
- Improved LDAP failover
- Synchronous sysdb API (provides performance enhancements)
- Better online reconnection detection
- New LDAP access provider allows for filtering user access by LDAP attribute
- Reduced default timeout for detecting offline status with LDAP
- GSSAPI ticket lifetime made configurable
- Better offline->online transition support in Kerberos
- Release new upstream version 1.1.91
- Enhancements when using SSSD with FreeIPA v2
- Support for deferred kinit
- Support for DNS SRV records for failover
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
- Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
- Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
- Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
- Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
- Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
- Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
- Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
- Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
- Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
- Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
- Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf
- Resolves: rhbz#1646113 - Missing concise documentation about valid options
for sssd-files-provider
- Fix typo in libwbclient-devel %preun
- Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
- Also sync. kcm multihost tests with master
- Switch unicode library from libunistring to Glib
- Drop unnecessary explicit Requires on keyutils
- Guarantee that versioned Requires include the correct architecture
connection timeout
- Resolves: rhbz#1139962 - Fedora 21, FreeIPA 4.0.2: sssd does not find user
private group from server
- New upstream release 1.5.5
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
- Fixes for several crash bugs
- LDAP group lookups will no longer abort if there is a zero-length member
- attribute
- Add automatic fallback to 'cn' if the 'gecos' attribute does not exist
- New upstream bugfix release 0.99.1
- Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
- Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
- Several segfault bugfixes
- Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
retrieve AD users through IPA Trust
- New upstream release 1.5.10
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
- Fixed a regression introduced in 1.5.9 that could result in blocking calls
- to LDAP
- Rebuilt for libnfsidmap.so.1
- Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
specified up to the seconds
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
if ID provider is authenticated with GSSAPI
- New upstream release 1.9.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Release SSSD 1.1.0 final
- Fix two potential segfaults
- Fix memory leak in monitor
- Better error message for unusable confdb
- New upstream release 1.6.4
- Rolls up previous patches applied to the 1.6.3 tarball
- Fixes a rare issue causing crashes in the failover logic
- Fixes an issue where SSSD would return the wrong PAM error code for users
that it does not recognize.
- Related: rhbz#1635595 - Cant login with smartcard with multiple certs
- New upstream release 1.9.0 beta 1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
- Add native support for autofs to the IPA provider
- Support for ID-mapping when connecting to Active Directory
- Support for handling very large (> 1500 users) groups in Active Directory
- Support for sub-domains (will be used for dealing with trust relationships)
- Add a new fast in-memory cache to speed up lookups of cached data on
repeated requests
- Backport important patches from upstream 1.13 prerelease
- Relax libldb BuildRequires to be greater-or-equal
- Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
- Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
- Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
- Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
inotify events, and no updates are triggered
- Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
on GDM login with smart-card
- Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
- Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
- Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
- Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
if LDAP entries do not contain AD forest root information
- Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
in SSSD-AD direct integration.
- Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
- Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
- Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma
- add missing configure check that broke stopping the daemon
- also fix default config to add a missing required option
- New upstream release 1.9.0 beta 6
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
- A new option, override_shell was added. If this option is set, all users
managed by SSSD will have their shell set to its value.
- Fixes for the support for setting default SELinux user context from FreeIPA.
- Fixed a regression introduced in beta 5 that broke LDAP SASL binds
- The SSSD supports the concept of a Primary Server and a Back Up Server in
failover
- A new command-line tool sss_seed is available to help prime the cache with
a user record when deploying a new machine
- SSSD is now able to discover and save the domain-realm mappings
between an IPA server and a trusted Active Directory server.
- Packaging changes to fix ldconfig usage in subpackages (#843995)
- Rebuild against libldb 1.1.9
- New upstream release 1.9.4
- Rebuild against libldb 1.1.4
- package git snapshot
- Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
access on the sock_file system_bus_socket
- Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
fails to download desktop profile data
- Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
- Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
after applying ID Views for them in IPA server
- Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
mapping is applied
- Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
differs from the default
- Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
- Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
- Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
- Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
- Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
- Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
- Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
- Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
- Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
- Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
- Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
- Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization
- Apply a number of patches from upstream to fix issues found post-beta,
in particular:
-- segfault with a high DEBUG level
-- Fix IPA password migration (upstream #1873)
-- Fix fail over when retrying SRV resolution (upstream #1886)
- Rebuild for libldb 1.1.18
- Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
pam libraries
- Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
prompts (e.g. Password + Token)
- Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
by remote host" if locale not available
- Resolves: rhbz#1733372 - permission denied on logs when running sssd as
non-root user
- Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
information
- Fix Obsoletes: to account for dist tag
- Convert post and pre scripts to run on the sssd-common subpackage
- Remove old conversion from SYSV
- Fix regression in endianness patch
- New upstream release 1.4.0
- Added support for netgroups to the LDAP provider
- Performance improvements made to group processing of RFC2307 LDAP servers
- Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
- Build-system improvements to support Gentoo
- Split out several libraries into the ding-libs tarball
- Manpage reviewed and updated
- Fix regressions and bugs in sssd upstream 1.12.2
- https://fedorahosted.org/sssd/ticket/{id}
- Regressions: #2471, #2475, #2483, #2487, #2529, #2535
- Bugs: #2287, #2445
- New upstream release 1.8.0
- Support for the service map in NSS
- Support for setting default SELinux user context from FreeIPA
- Support for retrieving SSH user and host keys from LDAP (Experimental)
- Support for caching autofs LDAP requests (Experimental)
- Support for caching SUDO rules (Experimental)
- Include the IPA AutoFS provider
- Fixed several memory-corruption bugs
- Fixed a regression in group enumeration since 1.7.0
- Fixed a regression in the proxy provider
- Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
- Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
logged at each login
- Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
/usr/sbin/sssd was killed by signal 11 (SIGSEGV)
- Resolves: rhbz#743133 - Performance regression with Kerberos authentication
against AD
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features
- Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc
- New upstream release 1.10 beta1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta1
- New upstream release 1.12.5
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.5
- Backport few upstream patches/fixes
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
- Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
- Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
- Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
- Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
- Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
- Resolves: rhbz#2098617 - Harden kerberos ticket validation
- Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
- Resolves: rhbz#1164156 - libsss_simpleifp should pull sssd-dbus
- Resolves: rhbz#1179379 - gzip: stdin: file size changed while
zipping when rotating logfile
- Include the 1.9.2 tarball
- Resolves: rhbz#1578014 - sssd does not work under non-root user
- Note: Actually the patches were in the 2.0.0-37, this one just adds this
changelog because it was missing.
- Use mcpath insted of mcachepath macro to be consistent with
upsteam spec file
- Add missing %license macro
- New upstream release
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
- Fix two minor manpage bugs
- Include the IPA AutoFS provider
- Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
and libtevent to avoid an issue in GPO processing
- Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
- against LDAP
- Resolves: upstream#3618 - selinux_child segfaults in a docker container
- Check the validity of naming context
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- New upstream release 1.15.3
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_3.html
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Resolves: rhbz#1726945 - negative cache does not use values from
'filter_users' config option for known domains
- Related: rhbz#1637131 - pam_unix unable to match fully qualified username
provided by sssd during smartcard auth using gdm
- New upstream release 1.5.1
- Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
- Vast performance improvements when enumerate = true
- All PAM actions will now perform a forced initgroups lookup instead of just
- a user information lookup
- This guarantees that all group information is available to other
- providers, such as the simple provider.
- For backwards-compatibility, DNS lookups will also fall back to trying the
- SSSD domain name as a DNS discovery domain.
- Support for more password expiration policies in LDAP
- 389 Directory Server
- FreeIPA
- ActiveDirectory
- Support for ldap_tls_{cert,key,cipher_suite} config options
-Assorted bugfixes
- Resolves: #967012 - [abrt] sssd-1.9.5-1.fc18: sss_mmap_cache_gr_invalidate_gid:
Process /usr/libexec/sssd/sssd_nss was killed by
signal 11 (SIGSEGV)
- Resolves: #996214 - sssd proxy_child segfault
- Resolves: rhbz#1687281
Rebase sssd in RHEL-8.1 to the latest upstream release
- Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
- Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
- Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working
- Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
- cached password with predicatable filename
- Backport important patches from upstream 1.13 prerelease
- Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
attribute for group name
- Resolves: upstream #2335 - Investigate using the krb5 responder
for driving the PAM conversation with OTPs
- Enable cmocka tests for secondary architectures
- Split internal helper libraries into a shared object
- Significantly reduce disk-space usage
- Resolves: rhbz#1687281
Rebase sssd in RHEL-8.1 to the latest upstream release
-Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
UnknownProperty: Unknown property
- Re-add manpage translations
- Resolves: rhbz#632615 - the krb5 locator plugin isn't packaged for multilib
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Patch SSSDConfig API to address
- https://bugzilla.redhat.com/show_bug.cgi?id=549482
- Fix slow login with ipa and SELinux
- Resolves: upstream #2624 - Only set the selinux context if the context
differs from the local one
for match rules sss-certmap
- Resolves: RHEL-39085 - [RfE] SSSD Failover Enhancements
- Rebuild for new libldb
- Don't duplicate libsss_autofs.so in two packages
- Set explicit package contents instead of globbing
- New upstream release 1.5.3
- Support for libldb >= 1.0.0
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
- Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user
- Change selinux policy requirement to Conflicts: with the old version,
rather than Requires: the supported version.
- New upstream release 0.5.0
- Backport extended NSS API from upstream master branch
- Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
with smart card
- New upstream release 1.9.0 rc1
- Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
- Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
- Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
- Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
- Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
- Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
- Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
- Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
- Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
- Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
- Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
- Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
- Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
- Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
- Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
- Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing
- Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
- Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
- Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
- Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
- Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
- Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
- Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
- Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
- Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
- Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'
- Rebuild against libldb 1.12
- New upstream release 0.6.0
- Fix build with new automake versions
- Add a patch to fix krb5 ccache creation issue with krb5 1.11
- Resolves: rhbz#1431153 - sssd: libsss_proxy.so needs to be linked with -ldl
- Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
the IP address of the machine updated in IPA upon
sssd.service startup
- Rebuilt for Python3.5 rebuild
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
- Add a patch to fix krb5 unit tests
- New upstream release 0.99.0
- New upstream release 1.14 beta
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0beta
- Apply a couple of patches from upstream git that resolve crashes when
ID mapping object was not initialized properly but needed later
- Make LDB dependency a strict equivalency
- New upstream release 1.12.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.1
- Backport patches with Python3 support from upstream
- Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
commands in man pages since local provider
is deprecated
- Include upstream patch to build with krb5-1.11
- Include couple of patches from upstream 1.11 branch
- Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
Rebuild against Samba rebase.
- Enable hardened build for RHEL7
- Update to 1.16.2 release
- Cleanup unused global definitions
- Remove python2 references from the spec file
- Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x
- Resolves: rhbz#1625842 id_provider= local causes SSSD to abort startup
- Resolves: rhbz#697057 - kpasswd fails when using sssd and
- kadmin server != kdc server
- Upgrades from SysV should now maintain enabled/disabled status
- Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
should not cause files domain entries to be
qualified, this can break sudo access
- Related: rhbz#1611011 - Support for "require smartcard for login option"
- Additional upstream fixes
- Fix double free in monitor
- Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
sssd killed by SIGABRT
- Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
systemd-user service in the account phase in RHEL-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
- Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
- Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
- Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
- Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
- Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
- Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
- Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
- Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
- Resolves: rhbz#2087745 - 2FA prompting setting ineffective
- Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language
- Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
- Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
- Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend
- Backport important patches from upstream 1.14.2 prerelease
- Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
boot
- Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14
- Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
omitted and auth_provider is krb5
- Change default kerberos credential cache location to /run/user/
- Fix failover from Global Catalog to LDAP in case GC is not available
- New upstream release 1.5.8
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
- Support for the LDAP paging control
- Support for multiple DNS servers for name resolution
- Fixes for several group membership bugs
- Fixes for rare crash bugs
- Own several directories create during make install (#839782)
- Move the sss_cache tool to the main package
- New upstream release 1.15.2
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_2.html
- Move sssd_pac to the sssd-krb5 subpackage
- Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
in ding-libs
- Fix SSH integration with fully-qualified domains
- Add the ability to dynamically discover the NetBIOS name
- Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
Rebuild against rebased Samba libs
- Resolves: rhbz#1820574 - [sssd] RHEL 8.3 Tier 0 Localization
- New upstream release 1.5.0
- Fixed issues with LDAP search filters that needed to be escaped
- Add Kerberos FAST support on platforms that support it
- Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
- Added a Kerberos access provider to honor .k5login
- Addressed several thread-safety issues in the sss_client code
- Improved support for delayed online Kerberos auth
- Significantly reduced time between connecting to the network/VPN and
- acquiring a TGT
- Added feature for automatic Kerberos ticket renewal
- Provides the kerberos ticket for long-lived processes or cron jobs
- even when the user logs out
- Added several new features to the LDAP access provider
- Support for 'shadow' access control
- Support for authorizedService access control
- Ability to mix-and-match LDAP access control features
- Added an option for a separate password-change LDAP server for those
- platforms where LDAP referrals are not supported
- Added support for manpage translations
- New upstream release 1.15.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_1.html
- New upstream release 1.12.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3
- Fix spelling errors in description (fedpkg lint)
- Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
- Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
- Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL
- Rebuild sssd against libldb 1.0.2 so the memberof module loads again.
- Related: rhbz#677425
- Log startup errors to the syslog
- Allow cache cleanup to be disabled in sssd.conf
- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
- Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
- Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
- Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
- Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
- Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
- Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)
- require the latest libldb
- Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
users
- Rebuild for libldb 1.1.3
- Rebuild due to rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
- New upstream release 1.9.0 beta 4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
- Add a new AD provider to improve integration with Active Directory 2008 R2
or later servers
- SUDO integration was completely rewritten. The new implementation works
with multiple domains and uses an improved refresh mechanism to download
only the necessary rules
- The IPA authentication provider now supports subdomains
- Fixed regression for setups that were setting default_tkt_enctypes
manually by reverting a previous workaround.
- Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
- Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
- Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
- Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior
error messages with line numbers
- bugfix release 0.3.2
- includes previous release patches
- change permissions of the /etc/sssd/sssd.conf to 0600
- Resolves: rhbz#1615460 - Rebase SSSD to the latest released version
- New upstream release 1.6.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
- Add host access control support for LDAP (similar to pam_host_attr)
- Finer-grained control on principals used with Kerberos (such as for FAST or
- validation)
- Added a new tool sss_cache to allow selective expiring of cached entries
- Added support for LDAP DEREF and ASQ controls
- Added access control features for Novell Directory Server
- FreeIPA dynamic DNS update now checks first to see if an update is needed
- Complete rewrite of the HBAC library
- New libraries: libipa_hbac and libipa_hbac-python
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
- Fix licenses in sources and on RPMs
- New upstream release 1.10 alpha1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0alpha1
- Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
for D-bus, resulting in a crash
- Rebuild with libldb-1.2.0
- Fix systemd conversion. Upgrades from SysV to systemd weren't properly
- enabling the systemd service.
- Fix a serious memory leak in the memberOf plugin
- Fix an issue where the user's full name would sometimes be removed
- from the cache
- Backport simplification of ccache management from 1.11.1
- Resolves: rhbz#1010553 - sssd setting KRB5CCNAME=(null) on login
- Resolves: rhbz#1382750 - Conflicting default timeout values
- Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"
- Resolves: rhbz#1175511 - sssd-libwbclient conflicts with Samba's and causes
crash in wbinfo
- in addition to the patch libwbclient.so is
filtered out of the Provides list of the package
- Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
- Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
- Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
- Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
- Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
- Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
- Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
- Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
- Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
- Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
- Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
- Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
- Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
- Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
- Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
- Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
- Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
- Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
- Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
- Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
- Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
- Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
- Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
- Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
- Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
- Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
- Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive
- Resolves: rhbz#1448094 - sssd-kcm cannot handle big tickets
- New upstream release 1.11 beta 2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0beta2
- Fix few segfaults
- Resolves: upstream #2811 - PAM responder crashed if user was not set
- Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step
- Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
keyring
- Also apply a patch to fix gating tests issue
- Cherry-pick patches from upstream that enable the files provider
- Enable the files domain
- Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
which is superseded by the files domain autoconfiguration
- Related: rhbz#1357418 - SSSD fast cache for local users
- Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
kdestroy caused by KCM returning a wrong error
code during the delete operation
- Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
username in getpwnam()
- Resolves: rhbz#758425 - LDAP failover not working if server refuses
connections
- Improved handling of users and groups with multi-valued name attributes
(aliases)
- Performance enhancements
Initgroups on RFC2307bis/FreeIPA
HBAC rule processing
- Improved process-hang detection and restarting
- Enabled the midpoint cache refresh by default (fewer cache misses on
commonly-used entries)
- Cleaned up the example configuration
- New tool to change debug level on the fly
- New upstream release 1.12 beta1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0beta1
- fixed items found during review
- added initscript
- Resolves: 1658813 - PKINIT with KCM does not work
- Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
new LDAP features - fix netgroups and sudo as well
- Fix building pac responder with the krb5-1.14
- Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
- Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization
- Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
- Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
- Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]
- release out of the official 0.3.2 tarball
- Rebuild against new libldb
- Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
- Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
- Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
- Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
- Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
- Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
- Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
- Resolves: RHEL-10721 - very bad performance when requesting service tickets
- Resolves: RHEL-19011 - Invalid handling groups from child domain
- Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]
- Don't discard HBAC rule processing result if SELinux is on
Resolves: rhbz#846792 (CVE-2012-3462)
- New stable upstream version 1.2.0
- Support ServiceGroups for FreeIPA v2 HBAC rules
- Fix long-standing issue with auth_provider = proxy
- Better logging for TLS issues in LDAP
- New upstream release 1.13.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.0
- New upstream release 1.14.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.2
- Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
- Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
- Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11
- Fix ipa-migration bug
- Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
migration mode
- Rebuild against new ding-libs
- Version 0.3.1
- includes previous release patches
- Remove the ability to create public ccachedir (#1015089)
- Fix bug in generation of systemd unit file
- Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
- Fixed "requires/provides" rpmdiff warning
- Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
- Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
- Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
- Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
- Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization
- Move sssd_pac to the sssd-ipa and sssd-ad subpackages
- Trim out RHEL5-specific macros since we don't build on RHEL 5
- Trim out macros for Fedora older than F18
- Update libldb requirement to 1.1.16
- Trim RPM changelog down to the last year
- New upstream release
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
- Support for the service map in NSS
- Support for setting default SELinux user context from FreeIPA
- Support for retrieving SSH user and host keys from LDAP (Experimental)
- Support for caching autofs LDAP requests (Experimental)
- Support for caching SUDO rules (Experimental)
- Fix uninitialized value bug causing crashes throughout the code
- Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup
- Add OSCP checks for p11_child
- Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
users
- Resolves: rhbz#1494002 - sssd_nss crashed in cache_req_search_domains_next
- python-sssdconfig: Fix parssing sssd.conf without config_file_version
- Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed
- Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
done here in order to unblock gating changes before rebase.
- Related: rhbz#1682305
- Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
realm join
- Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
default for AD Provider
- Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
parent directory when logging in
- New upstream stable release 1.0.0
- Switch hardcoded python3 shebangs into the %{__python3} macro
- Version 0.3.0
- Provides file based configuration and lots of improvements
- Resolves: rhbz#1369130 - nss_sss should not link against libpthread
- Resolves: rhbz#1392916 - sssd failes to start after update
- Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
on the directory /etc/sssd
- Rebuild against libldb 1.11
- Fix segfault in sssd_pam when cache_credentials was enabled
- Update the sample configuration
- Fix upgrade issues caused by data provider service removal
- Add support for python3 bindings
- Add requirement to python3 or python3 bindings
- Resolves: rhbz#1014594 - sssd: Support Python 3
- New upstream release 1.9.0 beta 5
- Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
- Many fixes for the support for setting default SELinux user context from
FreeIPA, most notably fixed the specificity evaluation
- Fixed an incorrect default in the krb5_canonicalize option of the AD
provider which was preventing password change operation
- The shadowLastChange attribute value is now correctly updated with the
number of days since the Epoch, not seconds
- Resolves: rhbz#1657980 - sssd_nss memory leak
- Also relax libldb Requires
- Remove --enable-ldb-version-check
- New upstream release 1.10.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.1
- Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
PKCS#11 URI
- New upstream release 1.9.0 beta 2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
- Add support for the Kerberos DIR cache for storing multiple TGTs
automatically
- Major performance enhancement when storing large groups in the cache
- Major performance enhancement when performing initgroups() against Active
Directory
- SSSDConfig data file default locations can now be set during configure for
easier packaging
- New upstream release 1.16.0
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_0.html
- Rebuilt for glibc bug#747377
- Rebuild for Python 3.6
- Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
- Fix release version for upgrades
- New upstream release 1.13.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- Add last minute bug fixes, found in testing the package
- Resolves: rhbz#1623878 - crash related to sbus_router_destructor()
- Rebuild against new libldb
- Resolves: rhbz#1652719 - [SECURITY] sssd returns '/' for emtpy home directories
- Fix issue with IPA + SELinux in containers
- Resolves: upstream https://fedorahosted.org/sssd/ticket/3297
- Add support for libldb 1.0.0
- Try to fix build adding automake as an explicit BuildRequire
- Add also a couple of last minute patches from upstream
- Fix systemd executions/requirements
- New upstream release 1.11.4
- Remove upstreamed patch
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.4
- Small cleanup and fixes in the spec file
- BuildRequire recent libini_config to ensure consistent behaviour
- added sss_client
- New upstream release 1.13.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.3
- New upstream release 1.13 alpha
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.0alpha
- Fix potential crash with external groups in trusted IPA-AD setup
- Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
without a password. (Patch by Stephen Gallagher)
- Resolves: rhbz#1736265 - Smart Card auth of local user: endless
loop if wrong PIN was provided
- Resolves: rhbz#2149241 - [sssd] SSSD enters failed state after heavy load in the system
- Resolves: rhbz#1642372 - SSSD Python getgrouplist API was removed but required for IPA
- Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
- Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
- Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
- Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1
- Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files (additional patch)
- Ensure that SSSD builds against libldb-1.0.0 on F15 and later
- Remove .la for memberOf
- Fix CVE-2010-0014
- Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
- Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
- Resolves: rhbz#1893159 - Default debug level should report all errors / failures
- Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication
- Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently
- New upstream release 1.12.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0
- Resolves: rhbz#1718193 - p11_child should have an option to skip
C_WaitForSlotEvent if the PKCS#11 module
does not implement it properly
- Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied
- New upstream release 1.8.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
- Several fixes to case-insensitive domain functions
- Fix for GSSAPI binds when the keytab contains unrelated principals
- Fixed several segfaults
- Workarounds added for LDAP servers with unreadable RootDSE
- SSH knownhostproxy will no longer enter an infinite loop preventing login
- The provided SYSV init script now starts SSSD earlier at startup and stops
it later during shutdown
- Assorted minor fixes for issues discovered by static analysis tools
- Resolve groups from AD correctly
- Restore Requires: cyrus-sasl-gssapi as it is not auto-detected during
- rpmbuild
- Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
not FIPS140 compliant
- Fixes link error on platforms that do not do implicit linking
- Fixes double-free segfault in PAM
- Fixes double-free error in async resolver
- Fixes support for TCP-based DNS lookups in async resolver
- Fixes memory alignment issues on ARM processors
- Manpage fixes
- Resolves: upstream#3529 - sssd-kcm Fix restart during/after upgrade
- Resolves: upstream#3621 - backport bug found by static analyzers
- Fix building on rawhide. Remove -Wl,-z,defs from LDFLAGS
- Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
no members
- New upstream release 1.5.11
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
- Fix a serious regression that prevented SSSD from working with ldaps:// URIs
- IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
- address being saved to the AAAA record
- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
- Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
- Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
- Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
- Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
- Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed
- Resolves: rhbz#1628122 - Printing incorrect information about domain
with sssctl utility
- Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
fails with the KCM ccache
- New upstream release 1.16.1
- https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_1.html
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Resolves: rhbz#1673443 - sssd man pages: The default value of
"ldap_user_home_directory" is not mentioned
with AD server configuration
- New upstream release 1.9.1
- Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
- Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
- Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)
- Fix multicast checks in the SSSD
- Resolves: rhbz#1007475 - The multicast check is wrong in the sudo source
code getting the host info
- New upstream release 1.11.3
- Remove upstreamed patches
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.3
- Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
- Resolves: rhbz#1915395 - Memory leak in the simple access provider
- Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
- Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)
- Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
started due to a misconfiguration
- Release candidate for SSSD 1.1
- Add simple access provider
- Create subpackages for libcollection, libini_config, libdhash and librefarray
- Support IPv6
- Support LDAP referrals
- Fix cache issues
- Better feedback from PAM when offline
- Add workaround patch for RHBZ #1366403
- Do not write out dots in the domain-realm mapping file (#905650)
- Fix the Kerberos password expiration warning (#912223)
- Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
- Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
- Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]
- Version 0.2.0
- Add SSSDConfig API
- Update polish translation for 0.6.0
- Fix long timeout on ldap operation
- Make dp requests more robust
- New upstream release 1.12.2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.2
- Fix several regressions since 1.5.x
- Ensure that the RPM creates the /var/lib/sss/mc directory
- Add support for Netscape password warning expiration control
- Rebuild against libldb 1.1.6
- Related: rhbz#1637513 - sssd crashes when refreshing expired sudo rules
- Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
the trailing colon
- Fix changelog dates to make F19 rpmbuild happy
-Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
subdomain service name being used
- Fix libwbclient alternatives
- Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
- Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
- Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
- Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
- Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
- Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
- Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
- Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
- Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
- Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
- Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
- Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
- Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
- Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
- Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
- Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
- Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
- Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate
- Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
- Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
- Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently
- New upstream release 1.5.4
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
- Fixes for Active Directory when not all users and groups have POSIX attributes
- Fixes for handling users and groups that have name aliases (aliases are ignored)
- Fix group memberships after initgroups in the IPA provider
- New upstream release 1.11.5
- Remove upstreamed patch
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5
- Fix regressions with ipa and SELinux
- Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
context on client is staff_u
- Do not crash on resolving a group SID in IPA server mode
- Apply a number of patches from upstream to fix issues found 1.12.3
- Resolves: rhbz#1176373 - dyndns_iface does not accept multiple
interfaces, or isn't documented to be able to
- Resolves: rhbz#988068 - getpwnam_r fails for non-existing users when sssd is
not running
- Resolves: upstream #2557 authentication failure with user from AD
- Fix tests on big-endian
- Fix previous changelog entry
- New upstream release 1.9.0 beta 3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
- Add a new PAC responder for dealing with cross-realm Kerberos trusts
- Terminate idle connections to the NSS and PAM responders
- Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
/usr/libexec/sssd/sssd_be killed by 11 crash
func _dbus_list_unlink
- Fix %postun
- New upstream release 1.8.1
- Resolve issue where we could enter an infinite loop trying to connect to an
auth server
- Fix serious issue with complex (3+ levels) nested groups
- Fix netgroup support for case-insensitivity and aliases
- Fix serious issue with lookup bundling resulting in requests never
completing
- IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
in addition to pam_authenticate
- Fix several regressions in the proxy provider
- Resolves: rhbz#743133 - Performance regression with Kerberos authentication
against AD
- Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work
- Fix a couple of segfaults that may happen on reload
- Fix OTP bug
- Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
entered separately
- Fix missing file permissions for sssd-clients
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Recreate Kerberos ccache directory if it's missing
- Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
directory /run/user/UID/ccdir does not exist
- New upstream release 1.9.3
- Resolves: rhbz#626205 - Unable to unlock screen
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
- Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization
- Initial release (based on version 0.1.0 upstream code)
- New upstream release 1.11.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.1
- New upstream release 1.12 beta2
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.0beta2
- libwbclient-sssd: update interface to version 0.13
- Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
1.x, this can result in time outs
- Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
searching in local cache database access on
the sock_file system_bus_socket
- Bump up release number to avoid library sub-packages version issues with
previous releases.
- Ensure that the configuration upgrade script always writes the config
file with 0600 permissions
- Eliminate an infinite loop in group enumerations
- Backport upstream patches required by FreeIPA 4.2.1
- Fix accidental disabling of the DIR cache support
- Resolves: upstream#3684 - A group is not updated if its member is removed
with the cleanup task, but the group does not
change
- Resolves: upstream#3558 - sudo: report error when two rules share cn
- Tone down shutdown messages for socket activated responders
- IPA: Qualify the externalUser sudo attribute
- Resolves: upstream#3550 - refresh_expired_interval does not work with
netgrous in 1.15
- Resolves: upstream#3402 - Support alternative sources for the files provider
- Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
- Resolves: upstream#3679 - Make nss netgroup requests more robust
- Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
configured
- Resolves: upstream#3469 - extend sss-certmap man page regarding priority
processing
- Improve docs/debug message about GC detection
- Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
list out of bound?
- Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
set.
- Document which principal does the AD provider use
- Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
defined, but contains no SIDs
- Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
- Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
Provider returned an error
[org.freedesktop.sssd.Error.DataProvider.Fatal]
- New upstream release 1.11.2
- Remove upstreamed patches
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2
- New upstream release 1.15.0
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.15.0
- New upstream release 1.5.9
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
- Support for overriding home directory, shell and primary GID locally
- Properly honor TTL values from SRV record lookups
- Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
- servers)
- Properly escape IPv6 addresses in the failover code
- Do not crash if inotify fails (e.g. resource exhaustion)
- Don't add multiple TGT renewal callbacks (too many log messages)
- Fix typo in Requires that prevented an upgrade (#973916)
- Use a hardcoded version in Conflicts, not less-than-current
- New upstream release 1.8.3
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
- Numerous manpage and translation updates
- LDAP: Handle situations where the RootDSE isn't available anonymously
- LDAP: Fix regression for users using non-standard LDAP attributes for user
information
- Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
- Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
- Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)
- Handle OTP response from FreeIPA server gracefully
- Resolves: rhbz#1283798 - sssd failover does not work on connecting to
non-responsive ldaps:// server
- Handle new error code for IPA password migration
- Resolves: rhbz#677768 - name service caches names, so id command shows
- recently deleted users
- Backport several patches from upstream.
- Fix a potential crash against old (pre-4.0) IPA servers
- Resolves: upstream#3573 - sssd won't show netgroups with blank domain
- Resolves: upstream#3660 - confdb_expand_app_domains() always fails
- Resolves: upstream#3658 - Application domain is not interpreted correctly
- Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
json_loads()
- Resolves: upstream#3386 - KCM: Payload buffer is too small
- Resolves: upstream#3666 - Fix usage of str.decode() in our tests
- A few KCM misc fixes
- New upstream release 1.13.1
- https://fedorahosted.org/sssd/wiki/Releases/Notes-1.13.1
webrtc-audio-processing-0.3-10.el8.x86_64.rpm | - Add gcc/gcc-c++ build requires
- Add aarch64 to NEON exception
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Initial Fedora spec.
- set ExclusiveArch x86 and ARM for now
- Update License
- webrtc-fix-typedefs-on-other-arches.patch: fix ftbfs on non-x86/arm due to
a build #error in typedefs.h, however, the defines are not used anywhere in
the code. Fixes build on ppc{,64}, s390x, and aarch64.
- 0.3
- Include devel package in CRB
- Resolves: #2036956
- Rebuilt to fix broken binary possibly caused by broken toolchain
- link w/ --no-undefined
- fix x86 sse2 runtime detection
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- pull in upstream fixes, use %autosetup
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- simpler/upstreamable no_undefined.patch (fdo#96244)
- add url to upstream bug report
- webrtc-audio-processing-0.2 (#1335536)
- %files: track ABI/API closer
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- better/upstreamable x86_msse2.patch
- add support big endian
- ExclusiveArch primary archs, FTBFS on big endian arches (#1336466)
- Rebuilt for GCC 5 C++11 ABI change
- Rebuild to address Annobin coverage issues
Resolves: #1704148
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
xcb-util-0.4.0-10.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Mark license with %license.
- initial package
- xcb-util 0.3.5
- 0.3.4; needed for Awesome 3.3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- bump to 0.3.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- hack the sed lines after %configure out and hack chrpath in
- make check is running again
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- 0.3.1
- fix license issue (Jonathan Landis)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- 0.3.3
- removed patches already in git (and 0.3.3)
- xcb-util 0.3.9 (#828286)
- 0.3.6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- xcb-util 0.3.8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- 0.3.2
- remove rpath (x86-64)
- xcb_keysyms: remove xcb_lookup_t
- Revert "keysyms: use xcb_key_lookup_t type for col paramter"
- temporary disabled %check due to RPATH regression
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Explicitly list DSOs so we're notified of version changes.
- patch for exit() in aux library (Peter Harris)
- slight changes in spec file
- Update to 0.4.0.
- Modernize spec file.
- Include COPYING.
- Update requirements.
- Use ldconfig scriptlet macros
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- new build deps: gperf, pkgconfig, libxcb, m4, xorg-x11-proto-devel
- not installing *.a files anymore
- configure with --with-pic
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Move NEWS to -devel.
xcb-util-image-0.4.0-9.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Mark license with %license.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Specfile cleanups.
- Include COPYING.
- xcb-util-image 0.3.9
- Rebuilt for new xcb-util soname
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Update to 0.4.0.
- Fix explicit requires.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- New package.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
xcb-util-keysyms-0.4.0-7.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Specfile cleanups suggested in the review.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Update to 0.4.0.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Fix explicit requires.
- Update to 0.3.9.
- New package.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
xcb-util-renderutil-0.3.9-10.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Mark license with %license.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Update to 0.3.9.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- New package.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Include COPYING.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
xcb-util-wm-0.4.1-12.el8.x86_64.rpm | - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- Mark license with %license.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- Specfile cleanups as suggested in the review.
- Remove unneeded BR on pkgconfig.
- Remove unneeded chrpath call.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- Update to 0.4.1 (rhbz#1059674)
- Update to 0.3.9.
- New package.
- Include COPYING.
- Disable silent build.
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
xmlrpc-c-1.51.0-11.el8_10.x86_64.rpm | - Address some Coverity issues in the patch set
- updated to 1.27.3
- use correct pkg-config script for 'xmlrpc-config abyss-server'
output (#355411)
- updated to 1.06.23 (#355411)
- Initial build.
- updated to 1.05
- updated patches
- Backport upstream fix for console spam with debug messages (#1541868)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- updated to 1.06.11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- updated to 1.06.17
- lib: Prevent more integer overflows (CVE-2022-22822 to CVE-2022-22827)
(#2058567, #2058576, #2058582, #2058589, #2058595, #2058602)
- Prevent integer overflow on m_groupSize in doProlog
(CVE-2021-46143) (#2058560)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- made linker scripts more 'ldconfig' friendly
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- updated to 1.14.8
- Switch to %ldconfig_scriptlets
- require the various subpackages explicitly for -devel; the ld linker
scripts broke rpm's autodetection (#567400)
- removed -devel Requires: which are covered by pkgconfig autodeps
- added %{?_isa} annotations
- fix license tag
- updated to 1.06.04
- patched the broken buildsystem
- disabled libwww backend explicitely
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- fixed cmake quoting so that pkgconfig files get correct version number
- fixed handling of 'server-util' and '--cflags' within xmlrpc-c-config
- Add missing validation of encoding (CVE-2022-25235) (#2070481)
- updated to 1.21.00 (rev 1851)
- removed curl-trace patch as applied upstream
- rediffed patches
- updated to 1.27.4
- rediffed cmake patch against current version
- made the xmlrpc-c-config compatible to the upstream version
- added compatibility symlinks for some header files (thx to Robert de
Vries for reporting these two issues)
- updated to 1.14.6
- moved to advanced branched; rediffed/updated existing cmake patch
and fixed other compilation issues (#369841)
- updated to 1.13.8
- removed some patches which were applied upstream
- Update to 1.51.0
- updated to 1.32.1
- added libxml2-devel and openssl-devel Requires: for the -devel
subpackage
- ship doc/* instead of doc
- initial Fedora Extras package (review 175840)
- updated to 1.31.0
- updated to 1.16.6; rediffed patches
- fixed client headers (bug #475887)
- Add xmlrpc_client++.pc
- updated to 1.28.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- updated to 1.14.2
- rediffed patches
- added patch to fix broken usage of 'long long' datatype
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- rebuilt for FC5
- updated to 1.06.18
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Rebuilt for c++ ABI breakage
- Add missing inter-package dependencies
- Rename fedora directory to build
- Apply patches via git to preserve permissions
- BuildRequire openssl by pkgconfig()
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- updated cmake patch
- strip installed libraries
- updated to 1.32.2
- updated to 1.30.5 (IPv6 server fixes)
- fixed error handling when transfering too large files (#741980)
- updated to 1.16.4
- rediffed/updated patches
- splitted some subpackages (c++, client) out of main package as they
introduce additional dependencies (c++, curl)
- updated to 1.27.5
- updated to 1.31.4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Update to 1.49.02
- Prevent integer overflow or wraparound, CVE-2024-4549 (RHEL-57519)
- Rebuilt for GCC 5 C++11 ABI change
- updated to 1.30.6
- updated to 1.06.05
- merged + updated patches
- updated to 1.23.02 (note: this breaks C++ ABI)
- added vasprintf patch
- updated to 1.25.0
- Add patch for conversion from int to usnigned char
- Resolves: rhbz#1308254
- Autorebuild for GCC 4.3
- updated to 1.26.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- updated to 1.32.5
- updated to 1.30.1
- updated to 1.29.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- updated to 1.26.3
- removed default-constructor patch; issue is solved upstream
- updated to 1.06.09
- removed -typo patch since applied upstream
- updated to 1.24.1
- set -Wno-uninitialized CFLAGS; code contains lot of constructs
triggering this warning and the 'int a=a' defeaters have been
removed in this version
- updated to 1.25.1
- Fix Requires.private in xmlrpc_server++.pc
- updated to 1.23.01
- added patch to make curl follow HTTP POST 301 redirects (#618504)
- updated to 1.06.14
- updated to 1.24.4
- rebuild against the new curl
- updated to 1.30.4
- Fix underlinking issue causing FTBFS
- updated to 1.22.01 (svn 1907)
- updated to 1.27.0
- made it build with recent curl
- Address segfault found in CVE-2023-52425 (RHEL-24226)
- updated to rev1841
- rediffed patches
- added patch to fix handling of wrong certificates (Nikola Pajkovsky)
- added support for $XMLRPC_TRACE_CURL env (John Dennis)
- disabled w3c-libwww because it does not exist anymore in FC5 and
seems to be unmaintained upstream
- added missing libxml2-devel
- cleaned up list of %doc files
- fixed gcc4.1 build issues
- removed static libraries when there exists a corresponding dynamic one
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Update to 1.48.0
- Add patch to silence format-security compiler warning
- Resolves: rhbz#1037399
- replaced .so symlinks by linker scripts which add all implicit
dependencies in AS_NEEDED() commands (#564607, #565577)
- updated to 1.06.16
- Restrict XML Entity Expansion Depth in libexpat CVE-2024-8176
- Build with openssl 1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
xmlrpc-c-client-1.51.0-11.el8_10.x86_64.rpm | - Address some Coverity issues in the patch set
- updated to 1.27.3
- use correct pkg-config script for 'xmlrpc-config abyss-server'
output (#355411)
- updated to 1.06.23 (#355411)
- Initial build.
- updated to 1.05
- updated patches
- Backport upstream fix for console spam with debug messages (#1541868)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
- updated to 1.06.11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
- updated to 1.06.17
- lib: Prevent more integer overflows (CVE-2022-22822 to CVE-2022-22827)
(#2058567, #2058576, #2058582, #2058589, #2058595, #2058602)
- Prevent integer overflow on m_groupSize in doProlog
(CVE-2021-46143) (#2058560)
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
- made linker scripts more 'ldconfig' friendly
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
- updated to 1.14.8
- Switch to %ldconfig_scriptlets
- require the various subpackages explicitly for -devel; the ld linker
scripts broke rpm's autodetection (#567400)
- removed -devel Requires: which are covered by pkgconfig autodeps
- added %{?_isa} annotations
- fix license tag
- updated to 1.06.04
- patched the broken buildsystem
- disabled libwww backend explicitely
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
- fixed cmake quoting so that pkgconfig files get correct version number
- fixed handling of 'server-util' and '--cflags' within xmlrpc-c-config
- Add missing validation of encoding (CVE-2022-25235) (#2070481)
- updated to 1.21.00 (rev 1851)
- removed curl-trace patch as applied upstream
- rediffed patches
- updated to 1.27.4
- rediffed cmake patch against current version
- made the xmlrpc-c-config compatible to the upstream version
- added compatibility symlinks for some header files (thx to Robert de
Vries for reporting these two issues)
- updated to 1.14.6
- moved to advanced branched; rediffed/updated existing cmake patch
and fixed other compilation issues (#369841)
- updated to 1.13.8
- removed some patches which were applied upstream
- Update to 1.51.0
- updated to 1.32.1
- added libxml2-devel and openssl-devel Requires: for the -devel
subpackage
- ship doc/* instead of doc
- initial Fedora Extras package (review 175840)
- updated to 1.31.0
- updated to 1.16.6; rediffed patches
- fixed client headers (bug #475887)
- Add xmlrpc_client++.pc
- updated to 1.28.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
- updated to 1.14.2
- rediffed patches
- added patch to fix broken usage of 'long long' datatype
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
- rebuilt for FC5
- updated to 1.06.18
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
- Rebuilt for c++ ABI breakage
- Add missing inter-package dependencies
- Rename fedora directory to build
- Apply patches via git to preserve permissions
- BuildRequire openssl by pkgconfig()
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
- updated cmake patch
- strip installed libraries
- updated to 1.32.2
- updated to 1.30.5 (IPv6 server fixes)
- fixed error handling when transfering too large files (#741980)
- updated to 1.16.4
- rediffed/updated patches
- splitted some subpackages (c++, client) out of main package as they
introduce additional dependencies (c++, curl)
- updated to 1.27.5
- updated to 1.31.4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
- Update to 1.49.02
- Prevent integer overflow or wraparound, CVE-2024-4549 (RHEL-57519)
- Rebuilt for GCC 5 C++11 ABI change
- updated to 1.30.6
- updated to 1.06.05
- merged + updated patches
- updated to 1.23.02 (note: this breaks C++ ABI)
- added vasprintf patch
- updated to 1.25.0
- Add patch for conversion from int to usnigned char
- Resolves: rhbz#1308254
- Autorebuild for GCC 4.3
- updated to 1.26.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
- updated to 1.32.5
- updated to 1.30.1
- updated to 1.29.0
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
- updated to 1.26.3
- removed default-constructor patch; issue is solved upstream
- updated to 1.06.09
- removed -typo patch since applied upstream
- updated to 1.24.1
- set -Wno-uninitialized CFLAGS; code contains lot of constructs
triggering this warning and the 'int a=a' defeaters have been
removed in this version
- updated to 1.25.1
- Fix Requires.private in xmlrpc_server++.pc
- updated to 1.23.01
- added patch to make curl follow HTTP POST 301 redirects (#618504)
- updated to 1.06.14
- updated to 1.24.4
- rebuild against the new curl
- updated to 1.30.4
- Fix underlinking issue causing FTBFS
- updated to 1.22.01 (svn 1907)
- updated to 1.27.0
- made it build with recent curl
- Address segfault found in CVE-2023-52425 (RHEL-24226)
- updated to rev1841
- rediffed patches
- added patch to fix handling of wrong certificates (Nikola Pajkovsky)
- added support for $XMLRPC_TRACE_CURL env (John Dennis)
- disabled w3c-libwww because it does not exist anymore in FC5 and
seems to be unmaintained upstream
- added missing libxml2-devel
- cleaned up list of %doc files
- fixed gcc4.1 build issues
- removed static libraries when there exists a corresponding dynamic one
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
- Update to 1.48.0
- Add patch to silence format-security compiler warning
- Resolves: rhbz#1037399
- replaced .so symlinks by linker scripts which add all implicit
dependencies in AS_NEEDED() commands (#564607, #565577)
- updated to 1.06.16
- Restrict XML Entity Expansion Depth in libexpat CVE-2024-8176
- Build with openssl 1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

×

Loading...