# changelog

author: Jeff Moyer <jmoyer@redhat.com> - 71.1-4.el8
changelog:
  - Pull in fixes from upstream v72 and v73 (Jeff Moyer)
    - Fix enable-namespace all reporting errors incorrectly
    - Add support for inject-smart on papr scm
  - Related: bz#2090190 bz#1986185 bz#2040074


author: Anita Zhang <the.anitazha@gmail.com> - 71.1-4.1
changelog:
  - Patch 71.1 with diff between ea014c0..3ff031d from elake/ndctl fork for hs+fb
  - Sync changes from rhel/ndctl.spec (autogenerated by the GitHub Makefile)


author: Bryan Gurney <bgurney@redhat.com> - 71.1-7
changelog:
  - Pull in fixes from upstream v72 and v73 (Jeff Moyer)
  - Fix enable-namespace all reporting errors incorrectly
  - Add support for inject-smart on papr scm
  - Related: rhbz#2040075
  - Related: rhbz#1873851
  - Related: rhbz#1880578
  - Related: rhbz#1922538
  - Related: rhbz#2087707


author: Jeff Moyer <jmoyer@redhat.com> - 71.1-8
changelog:
  - Backport changes up to v74, excluding the config file changes. (Jeff Moyer)
    This includes support for the CXL commands, and adds the following
    packages: cxl-cli, cxl-devel, cxl-libs
  - Resolves: rhbz#2132167


author: Tao Liu <ltao@redhat.com> - 2.0.27-7
changelog:
  - Explain the auto_reset_crashkernel option in more details
  - Use the same /etc/resolve.conf in kdump initrd if it's managed manually


author: Tao Liu <ltao@redhat.com> - 2.0.27-10
changelog:
  - mkdumprd: Fix makedumpfile parameter check.
  - Install the driver of physical device for a SR-IOV virtual device
  - Try to install PHY and MDIO bus drivers explicitly


author: Tao Liu <ltao@redhat.com> - 2.0.27-13
changelog:
  - kdump-lib: Drop 'file' dependency in is_uki
  - kdumpctl.8: Add description to reset-crashkernel --reboot
  - kdumpctl: Fix misleading message and erratic reboot in reset_crashkernel
  - kdumpctl: Drop default kexec '-d' option


author: Tao Liu <ltao@redhat.com> - 2.0.29-6
changelog:
  - 99-kdump.conf: Omit rdma module
  - Fallback to get NIC driver by /sys/class/net/NIC/device/driver/module
  - Note user-specified crashkernel value will be overwritten by default value


author: Tao Liu <ltao@redhat.com> - 2.0.29-7
changelog:
  - 99-kdump.conf: Omit clevis related dracut modules
  - kdump-lib.sh: rounded up the total_mem to 128M in get_system_size
  - kdump-lib.sh: Adjust default crashkernel reservation for x86_64 and s390x
  - doc/kdump.conf: correctly align the options


author: Tao Liu <ltao@redhat.com> - 2.0.29-8
changelog:
  - kdumpctl: check and generate /etc/vconsole.conf
  - kdump-lib.sh: Reserve crashkernel by default for systems with 1G-2G memory


author: Tao Liu <ltao@redhat.com> - 2.0.29-12
changelog:
  - Allow "sudo kdumpctl" for LUKS dump target
  - Restore SELinux label of crypttab file
  - Allow kdump.service to access LUKS volume keys
  - Wait for LUKS configfs API to be ready
  - Change LUKS volume key prefix to kdump-cryptsetup:vk-
  - Remove unused LUKS volume keys from keyring
  - Limit LUKS support to x86_64
  - Add kdumpctl setup-crypttab subcommand
  - Return LUKS devices in the form of UUIDs directly
  - Fix SC2181 issues in kdump-udev-throttler
  - LUKS: make /usr writable
  - Address CPU/memory hot plugging for kdump LUKS support
  - shfmt kdump-udev-throttler
  - Use cryptsetup --link-vk-to-keyring to save volume keys
  - Support dumping to a LUKS-encrypted target
  - Add a helper function to get uuid by MAJ:MIN


author: Pingfan Liu <piliu@redhat.com> - 2.0.29-14
changelog:
  - powerpc: Set nr_cpus=16 for kdump kernel
  - powerpc: consider CPU count while calculating crashkernel value
  - Use all available CPUs to collect dump


author: Lichen Liu <lichliu@redhat.com> - 2.0.29-15
changelog:
  - sysconfig: use initramfs_options to reduce memory usage
  - kdump-lib-initramfs: rewrite kdump_get_conf_val
  - kdump-lib-initramfs: Fix performance regression in kdump_get_conf_val


author: Tao Liu <ltao@redhat.com> - 2.0.29-2
changelog:
  - Re-introduce vmcore creation notification to kdump
  - Revert "Introduce vmcore creation notification to kdump"
  - Add kdump dracut config
  - kdump-lib-initramfs: Improve mount point retrieval logic


author: Tao Liu <ltao@redhat.com> - 2.0.29-3
changelog:
  - fadump: fix passing additional parameters for capture kernel
  - fadump: pass additional parameters for capture kernel


author: Michel Lind <salimma@centosproject.org> - 6.9.0-2
changelog:
  - Mark libbpf support as dependent on missing header file
  - some feature checks not shown unless VF=1 is passed


author: Michel Lind <salimma@centosproject.org> - 6.15.0-1.1
changelog:
  - Update to 6.15.0
  - Temporarily exclude ARM builds and build only for hs+fb since the ARM
    build process from standalone tarballs is broken


author: Cole Robinson <crobinso@redhat.com> - 10.6.0-2
changelog:
  - Fix `virsh domifaddr --source=arp` on kernel 6.10 (bz #2302245)
  - Add new systemtap-sdt-dtrace to build deps


author: Daniel P. Berrangé <berrange@redhat.com> - 10.4.0-1
changelog:
  - Update to version 10.4.0
  - Change virtual network backend from iptables to nftables
  - Introduce SSH VSOCK proxy


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-22
changelog:
  - Avoid spirous message on connecting to the machine with ssh-rsa keys
    Related: rhbz#2115246
  - Set minimal value of RSA key length via configuration option
    Related: rhbz#2066882


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-28
changelog:
  - Do not try to use SHA1 for host key ownership proof when we don't support it server-side
    Resolves: rhbz#2088750


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-30
changelog:
  - Some non-terminating processes were listening on ports.
    Resolves: rhbz#2177768
  - On sshd startup, we check whether signing using the SHA1 for signing is
    available and don't use it when it isn't.
  - On ssh private key conversion we explicitly use SHA2 for testing RSA keys.
  - In sshd, when SHA1 signatures are unavailable, we fallback (fall forward :) )
    to SHA2 on host keys proof confirmation.
  - On a client side we permit SHA2-based proofs from server when requested SHA1
    proof (or didn't specify the hash algorithm that implies SHA1 on the client
    side). It is aligned with already present exception for RSA certificates.
  - We fallback to SHA2 if SHA1 signatures is not available on the client side
    (file sshconnect2.c).
  - We skip dss-related tests (they don't work without SHA1).
    Resolves: rhbz#2070163
  - FIPS compliance efforts for dh, ecdh and signing
    Resolves: rhbz#2091694


author: Norbert Pocs <npocs@redhat.com> - 8.7p1-31
changelog:
  - Fix minor issues with openssh-8.7p1-evp-fips-compl-dh.patch:
  - Check return values
  - Use EVP API to get the size of DH
  - Add some log debug lines
  - Related: rhbz#2091694


author: Norbert Pocs <npocs@redhat.com> - 8.7p1-32
changelog:
  - Fix pkcs11 issue with the recent changes
  - Delete unnecessary log messages from previous compl-dh patch
  - Add ssh_config man page explanation on rhbz#2068423
  - Resolves: rhbz#2207793, rhbz#2209096


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-35
changelog:
  - Relax OpenSSH checks for OpenSSL version
    Resolves: RHEL-4734
  - Limit artificial delays in sshd while login using AD user
    Resolves: RHEL-2469
  - Move users/groups creation logic to sysusers.d fragments
    Resolves: RHEL-5222


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-36
changelog:
  - Fix Terrapin attack
    Resolves: CVE-2023-48795
  - Relax OpenSSH build-time checks for OpenSSL version
    Related: RHEL-4734
  - Forbid shell metasymbols in username/hostname
    Resolves: CVE-2023-51385


author: Raymond Colebaugh <raymondcolebaugh@gmail.com> - 8.7p1-38.8 + 0.10.4-5.7
changelog:
  - Merge "Add LOG_SESSION_ID for everyone" patch into fb87_log_session_id.patch,
    update fb87_pass_principals_to_child.patch to account for this change


author: Zoltan Fridrich <zfridric@redhat.com> - 8.7p1-40
changelog:
  - Correctly audit hostname and IP address
    Resolves: RHEL-22316
  - Make default key sizes configurable in sshd-keygen
    Resolves: RHEL-26454


author: Michel Lind <salimma@centosproject.org> - 8.7p1-43.1 + 0.10.4-5.7
changelog:
  - Merge new changes from upstream
  - Drop old EL8 workarounds
  - Make sure source RPM always contains all sources and patches


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-44
changelog:
  - Add extra help information on ssh early failure
    Resolves: RHEL-33809
  - Provide details on crypto error instead of "error in libcrypto"
    Resolves: RHEL-52293
  - Allow duplicate Subsystem directive
    Resolves: RHEL-47112


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-45
changelog:
  - Fix missing error codes set and invalid error code checks in OpenSSH. It
    prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
    is on (CVE-2025-26465).
    Resolves: RHEL-78700


author: Roberto Campesato <render@metalabs.org> - 9.1.0-1.1
changelog:
  - Merge latest changes from Fedora
  - Added fb-only patch based on experimental AMD changes for SEV/SNP
    to make PCI passthrough work with SNP


author: Cole Robinson <crobinso@redhat.com> - 8.2.0-7
changelog:
  - Enable PIE for qemu-user-static builds
  - Replace PVH build fix patch with version that should work on centos


author: Roberto Campesato <render@metalabs.org> - 8.2.2-1.1
changelog:
  - Merge latest changes from Fedora
  - Re-enabled libblkio (RHBZ#2232766 closed)
  - Added fb-only patches
    . relaxing CA cert bundle validatation
    . setting default cpu_model for linux-user x86_64 and aarch64
    . btrfs v2 ioctls


author: Roberto Campesato <render@metalabs.org> - 2:9.2.0-2.1
changelog:
  - Merge latest changes from Fedora
  - Remove fb-only patch already included upstream
  - Include fix for multifd migration regression https://gitlab.com/qemu-project/qemu/-/issues/2720


author: Michel Lind <salimma@centosproject.org> - 0.6.7-4
changelog:
  - Update unified SEL logging to only log correctable errors
  - Limit unified SEL logging changes to hs+fb builds for now


author: Michel Lind <salimma@centosproject.org> - 0.8.1-1
changelog:
  - Update to 0.8.1
  - Update SEL logging patch to PR 180
  - Incorporate changes from Fedora's rasdaemon-0.8.0-5.fc41


author: Anita Zhang <the.anitazha@gmail.com> - 249.4-2.12
changelog:
  - Backport PR #20695: Sync if_arp.h with Linux 5.14
  - FB-only backport PR #22426: MemoryZSwapMax= to configure memory.zswap.max


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 250.3-3
changelog:
  - Add pam_namespace to systemd-user pam config (rhbz#2053098)
  - Drop 20-grubby.install plugin for kernel-install (rhbz#2033646)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 250.3-4
changelog:
  - Drop scriptlet for handling nobody user upgrades from Fedora <28
  - Specify owner of /var/log/journal as root in the rpm listing (#2018913)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 250.3-5
changelog:
  - Move part of %post scriptlet for resolved to %posttrans (#2018913)
  - Specify owner of utmp/wtmp/btmp/lastlog as root in the rpm listing


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 249-2.13
changelog:
  - Move to dist-git layout used by Fedora (no more SOURCES/ and SPECS/)
  - Switch to .gitignore from commit 46a40810 from the Fedora RPM repo
  - Add back removed files from commit 46a40810 from the Fedora RPM repo


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 250.3-6.1
changelog:
  - New release for v250
  - Sync latest changes from Fedora rawhide
  - Use source archives from https://pagure.io/centos-sig-hyperscale/systemd
    instead of github. All Hyperscale patches have moved to pagure
  - Added llvm-toolset to BuildRequires (for llvm-strip) to make build succeed
  - Enable p11kit and pwquality options in the systemd build


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 250.3-6.3
changelog:
  - Move systemd-network-generator and networkd man pages to networkd package to
    avoid conflicts with systemd-extras from EPEL


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 250.3-6.4
changelog:
  - Make sure our packages override the corresponding backports from EPEL.
  - Modify the networkd fix from the previous release so that it can be merged
    into the c9s branch.


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 250.3-6.6
changelog:
  - Fixed bug in networkd changes to split-files.py that caused the
    /etc/systemd/network to get moved to the networkd package (which we don't
    want because that's where link files for udev are also stored).


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 250.3-6.7
changelog:
  - Backported https://github.com/systemd/systemd/pull/23254 and
    https://github.com/systemd/systemd/pull/23205
  - Move more files to the networkd package


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 251-1
changelog:
  - Latest upstream release, for details see
    https://raw.githubusercontent.com/systemd/systemd/v251/NEWS.
  - Fixes for #2071034, #2084955, #2086166.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 251.1-2
changelog:
  - Supress errors from useradd/groupadd (#2090129)
  - Drop "v" from the version tag, add tilde back
  - The tag for shared-libraries is reintroduced (#1906010)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 251.2-1
changelog:
  - A bunch of man page fixes, a few memory-access correctness fixes,
    remove excessive messages to utmp sessions, suppress messages about
    bpf setup in the user manager (#2084955)


author: Neal Gompa <ngompa@fedoraproject.org> - 251.4-53
changelog:
  - Set compile-time fallback hostname to "localhost"
    https://fedoraproject.org/wiki/Changes/FallbackHostname


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 252.4-598.6
changelog:
  - Bump release for 252.4
  - Sync from rawhide
  - Build with libqrencode
  - Build with libfido2
  - Build with homed/userdb
  - Drop pam config directory override
  - Use python3dist() where applicable
  - Drop llvm-toolset in favor of having systemd use bpftool gen object
  - Add back standalone binary packages


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 252.4-598.11
changelog:
  - Backport fixes for journald crashes and bad behavior when dealing with
    corrupted journals.
  - Fix changelog date


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 252.4-598.12
changelog:
  - Remove selinux bcond in favor of boolean dependency on selinux-policy so that
    systemd-selinux is only installed if selinux-policy is installed
  - Add selinux file contexts for /efi
  - Remove policycoreutils-python-utils dependency from systemd-selinux


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 251.4-1
changelog:
  - Version 251.4 (fixes rhbz#2112551)
  - A bunch of fixes to documentation, crashes in systemd-resolved,
    systemd-networkd, systemd itself, and other smaller fixes.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 251.4-2
changelog:
  - Backport patches and do a full preset on first boot (#2114065,
    https://fedoraproject.org/wiki/Changes/Preset_All_Systemd_Units_on_First_Boot)


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 253.5-1.1
changelog:
  - Add back python3-zstd on c9s now that it's been added to EPEL 9
  - Add back support for c8s builds (without ukify)
  - Add full backport of bpftool version requirement lowering


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 253.5-1.1
changelog:
  - Replace bpftool version requirement patch with sed so it works across systemd
    releases
  - Do selinux build in /tmp/selinux to avoid polluting source directory
  - Make sure we override existing output files when calling bzip2.


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 253.5-1.1
changelog:
  - Gate out systemd-selinux dependency on Facebook specific builds
  - Backport custom %clean implementation from rawhide
  - Backport selinux triggers logging revert from rawhide


author: Anita Zhang <the.anitazha@gmail.com> - 253.7-1.4
changelog:
  - Gate out selinux-policy-base versioning for facebook
  - Move repart fixes to staging repo (#28479, #28812)


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 256.6-4
changelog:
  - Make backports Meta specific
  - Only apply backports when building the Meta specific build
  - Use a custom patch range for the Meta specific backports so we don't
    conflict with the ones from Fedora
  - Backport PrivateUsers=identity as well


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 256.7-2
changelog:
  - Backport various PRs to streamline upgrades
  - Logging improvements to help debug issues
  - Removing a fallback from the private manager bus to the system bus that
    isn't required and complicates debugging issues
  - Simplification of user manager reloads which also helps debugging issues
    by reducing what can go wrong during upgrades


