# changelog

author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Add make sources target for koji build
  - Add make srpm target for copr build
  - Support port numbers in https urls
  - Return all received cookies in the final getcert step
  - Add sending Server Name Indication on https connections


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.17-1
changelog:
  - Bug fix for PID namespaces and condor_ssh_to_job on EL9
  - Augment condor_upgrade_check to find unit suffixes in ClassAd expressions


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.18-1
changelog:
  - Proper error message and hold when Docker emits multi-line error message
  - The htcondor CLI now works on Windows


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.19-1
changelog:
  - Numerous updates in memory tracking with cgroups
    - Fix bug in reporting peak memory
    - Made cgroup v1 and v2 memory tracking consistent with each other
    - Fix bug where cgroup v1 usage included disk cache pages
    - Fix bug where cgroup v1 jobs killed by OOM were not held
    - Polls cgroups for memory usage more often
    - Can configure to always hold jobs killed by OOM
  - Make condor_adstash work with OpenSearch Python Client v2.x
  - Avoid OAUTH credmon errors by only signaling it when necessary
  - Restore case insensitivity to 'condor_status -subsystem'
  - Fix rare condor_schedd crash when a $$() macro could not be expanded


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.21-1
changelog:
  - Fix memory leak caused by periodic evaluation of bad ClassAd expressions
  - Fixes for bugs affecting grid jobs


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.25-1
changelog:
  - Fix problems where parallel universe jobs could crash the condor_schedd
  - Prevent condor_starter crash when evicting job during input file transfer
  - condor_watch_q now properly displays job id ranges by using numeric sort


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.26-1
changelog:
  - Fix ingestion of ads into Elasticsearch under very rare circumstances
  - DAGMan better handles being unable to write to a full filesystem
  - 'kill_sig' submit commands are now ignored on the Windows platform


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.27-1
changelog:
  - Fix bug where condor_ssh_to_job failed when EP scratch path is too long
  - Fix incorrect time reported by htcondor status for long running jobs
  - Fix bug where .job.ad, .machine.ad files were missing when LVM is in use


author: Dave Dykstra <dwd@cern.ch>> - 2.12.7-2
changelog:
  - Apply pretrans transaction check to all subpackages that need to
    have their version stay in sync


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-1.1
changelog:
  - Update to squid-5.9, with announcement at
      http://lists.squid-cache.org/pipermail/squid-announce/2023-May/000147.html and
      release notes at http://www.squid-cache.org/Versions/v5/squid-5.9-RELEASENOTES.html.
      squid-5.9 contains small fixes including improvement of debug logging related to the
      reply_body_max_size parameter.
   - Consistent with squid5, disallow the combination of multiple workers, ufs cache,
      and memory_cache_shared even if collapsed_forwarding is off.
   - Limit the  maximum number of file descriptors to 65536 even if the OS would allow
      a higher number.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-1.2
changelog:
  - With the addtion of an EL9 repository, this release includes an EL9 RPM that was
      compiled on EL9 and that fully supports Web Proxy Auto Discovery. The EL7/EL8
      RPM in this release is unchanged from 5.9-1.1, except for version number.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-2.1
changelog:
  - Apply security patches from Squid 6 to address security concerns since 
      a version of Squid 6 suitable for frontier-squid is not available yet.
   - The following security vulnerabilities have been addressed with patches:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46724
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46847
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46848
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49285
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50269
      https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
   - The following two vulnerabilities are addressed by disabling Gopher and TRACE
      requests, respectively, in the squid.conf.proto file:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46728
      https://megamansec.github.io/Squid-Security-Audit/trace-uaf.html
   - To support SELinux, require /sbin/restorecon and apply it to the log directory,
      in addition to the cache directory.
   - Update to shoal-1.0.2 to fix setting of external_ip.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.1
changelog:
  - Upgrade to 5.9-3 tarball with the following release notes:
    - Add *.eessi.science to MAJOR_CVMFS in squid/files/postinstall/squid.conf.proto.
   - Move frontier-squid.sh from /etc/init.d to /usr/libexec/squid. Remove chkconfig
      because it is no longer needed. Move all steps of preparation of the
      frontier-squid-utils prototype files to this file to simplify future
      maintenance.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.2
changelog:
  - Fix building of RPM to properly choose Python36 or Python39.
       Also, restrict building to x86_64 architecture.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.10-1.1
changelog:
  - Update to squid-5.10, with release notes at
      https://github.com/squid-cache/squid/commits/v5.
      The security patches included in frontier-squid-5.9-2 have been incorporated
      into the baseline Squid code in this release.
      It also contains fixes for minor bugs and these security issues:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25617
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23638
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37894
      https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html
      https://megamansec.github.io/Squid-Security-Audit/ftp-fatal.html
      https://megamansec.github.io/Squid-Security-Audit/ipv6-assert.html
      https://megamansec.github.io/Squid-Security-Audit/stream-assert.html
   - For SELinux, provide proper labeling for /usr/libexec/squid/frontier-squid
      script to prevent log rotation failures.


author: Marco Mambelli <marcom@fnal.gov> - 3.10.7-3
changelog:
  - Glideinwms v3.10.7
  - 3.10.7-1 was on Fri Jun 21 2024
  - Removed bash mangling in 3.10.7-3
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_7/history.html
  - Release candidates 3.10.7-01.rc1 to 3.10.7-03.rc3


author: Marco Mambelli <marcom@fnal.gov> - 3.10.8
changelog:
  - Glideinwms v3.10.8
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_8/history.html
  - Release candidates 3.10.8-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.9
changelog:
  - Glideinwms v3.10.9
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_9/history.html
  - Release candidates 3.10.9-01.rc1 to 3.10.9-03.rc3


author: Marco Mambelli <marcom@fnal.gov> - 3.10.10
changelog:
  - Glideinwms v3.10.10
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_10/history.html
  - Release candidates 3.10.10-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.11
changelog:
  - Glideinwms v3.10.11
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_11/history.html
  - Release candidates 3.10.11-01.rc1 to 3.10.11-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.12
changelog:
  - Glideinwms v3.10.12
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_12/history.html
  - Release candidates 3.10.12-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.13
changelog:
  - Glideinwms v3.10.13
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_13/history.html
  - Release candidates 3.10.13-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.14
changelog:
  - Glideinwms v3.10.14
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_14/history.html
  - Release candidates 3.10.14-01.rc1 to 3.10.14-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.15
changelog:
  - Glideinwms v3.10.15
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_15/history.html
  - Release candidates 3.10.15-01.rc1 to 3.10.15-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.16
changelog:
  - Glideinwms v3.10.16
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_16/history.html
  - Release candidates 3.10.16-01.rc1 to 3.10.16-02.rc2


author: Brian Lin <blin@cs.wisc.edu.> - 2.8.4-1
changelog:
  - HTCondor AP and CE probes now drop privileges to the 'condor' user
    if run as 'root' (SOFTWARE-5531)
  - Improve logging and failure modes when encountering unwriteable
    directories (SOFTWARE-5531)


author: Matt Westphall <westphall@wisc.edu.> - 2.8.5-1
changelog:
  - Log gratia probe failures to aid debugging (SOFTWARE-6037)
  - Fix NameError in post-install script (SOFTWARE-5558)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.0-1
changelog:
  - Release hosted-ce-tools 1.0 (SOFTWARE-5130)
  - Convert scripts to python3 (SOFTWARE-5131)
  - Timeout rsync in update-remote-wn-client (SOFTWARE-4670)
  - Dereference hardlinks when extracting tarball (SOFTWARE-5254)


author: Tim Theisen <tim@cs.wisc.edu> - 6.0.1-1
changelog:
  - Add grid CA and host certificate/key locations to default SSL search paths
  - Verifies that HTCondor-CE can access the local HTCondor's SPOOL directory
  - Can use condor_ce_trace without SciToken to test batch system integration
  - condor_ce_upgrade_check checks compatibility with next HTCondor version
  - Adds deprecation warnings for old job router configuration syntax


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.6-1
changelog:
  - Fix CE job route transform for job environment
  - Fix CERequirements when the default_CERequirements is not set
  - Add condor_ce_test_token tool to generate short lived SciToken for tests
  - Remove GSI from security method list to eliminate annoying warnings


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.18-0.rc2
changelog:
  - Does not pass WholeNode request expressions to non-HTCondor batch systems
  - Fix certificate subject parsing in condor_ce_host_network_check


author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Update httokensh to by default set the minimum vault token time to live to
    6 days, and to make sure that the background refresh never gets a new vault
    token.
  - Changed the preferred name of httokendecode to htdecodetoken, keeping
    links in the opposite direction.
  - Add man pages for httokensh, htdestroytoken, and htdecodetoken.


author: Dave Dykstra <dwd@fnal.gov> 2.0-1
changelog:
  - Replace use of m2crypto and pyOpenSSL with urllib3
  - Replace use of pykerberos with gssapi
  - Use standard Requires for Python modules instead of PyInstaller
  - Add --vaultcertname option to specify an alternative certificate name.
    That used to be an additional optional meaning of the --vaultalias option,
    but urllib3 requires only one name to match.
  - Add setuptools build infrastructure
  - Refactor htgettoken script into module with entry point.
    This enables invoking htgettoken as `htgettoken.main()` from Python.
  - Use wheels to build/install Python package, which simplified the entry
    points and improves (slightly) the metadata
  - Fix the httokensh background process's check for its parent process.
    That is only a backup in case only the parent process is hard-killed,
    because normally the parent process kills the background process when
    the parent exits.
  - Use newer `sts` secrets API for token exchanges.
  - Fix the `-o`/`--outfile` option to work with relative paths. 
  - Change the `--nobearertoken` option to always get and save a vault token.


author: Dave Dykstra <dwd@fnal.gov> 2.0-2
changelog:
  - Fix broken httokendecode symlink.
  - Use python wheels to build/install on el9.  It didn't work on el8 so
    the use of wheels was removed at the last minute before the 2.0-1
    release (without removing it from the changelog like it should have).


author: Dave Dykstra <dwd@fnal.gov> 2.1-1
changelog:
  - Fix htdecodetoken to work with token files that do not end in a newline.
  - Support args in htgettoken.main() Python entry point.


author: Dave Dykstra <dwd@fnal.gov> 2.2-1
changelog:
  - Add BuildRequires python3-devel to generate correct Python metadata.
  - Remove explicit Requires for python dependencies, rely on Python metadata.
  - Always build with wheels.
  - Remove Python root logger configuration.


author: Dave Dykstra <dwd@fnal.gov> 2.4-1
changelog:
  - Add the new -s and -f options to the htdecodetoken usage summary.
  - Add a -v option to htdecodetoken to show the token source.


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Add 'ratelimits' keyword to put a limit on the number of requests per
    client per interval.
  - Allow '@' to be included in the ssh plugin's keys.
  - Fix bug that prevented reconfiguration when a policy name changed.
  - Update vault-plugin-auth-jwt to 0.18.0.
  - Update vault-plugin-auth-ssh to 0.3.1.
  - Require vault to be >= 1.15.


author: Dave Dykstra <dwd@fnal.gov> 1.17-1
changelog:
  - Add a patch of PR #90 to vault-plugin-secrets-oauthapp which adds caching
    of tokens exchanged via the /sts path and adds a minimum_seconds option to
    the API.
  - Give vault tokens the capabilities of deleting secrets and revoking
    themselves.
  - Update required vault to 1.17.
  - Update vault-plugin-auth-jwt to 0.21.0.
  - Update vault-plugin-auth-ssh to 0.3.2 which includes the patch for '@' 
    that was previously applied.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Restore patch #41 on vault-plugin-secrets-oauthapp which was accidentally
    dropped.
  - Update to latest commit on vault-plugin-auth-jwt because one of the
    other patches now depends on it in order to apply cleanly.


author: Dave Dykstra <dwd@fnal.gov> 1.19-1
changelog:
  - Replace vault with openbao-2.2.0 and remove vault-plugin-secrets-jwt
    (since the builtin version works with openbao).
  - Replace vault-plugin-secrets-oauthapp with openbao-plugin-secrets-oauthapp
    3.2.0 but still install it as vault-plugins-secrets-oauthapp for upgrade
    compatibility.
  - Update vault-plugin-auth-ssh to 0.3.4.


author: Dave Dykstra <dwd@fnal.gov> 2.0.0-1
changelog:
  - Remove the external auth/oidc plugin registration to switch to the
    builtin plugin.
  - Change to semantic versioning starting at 2.0.0.  Compared to 1.18,
    the removal of the external vault-plugin-secrets-jwt plugin causes
    some incompatibility and requires a careful upgrade path in HA
    installations (that is, upgrade all vault/openbao first).


author: Dave Dykstra <dwd@fnal.gov> 2.1.0-1
changelog:
  - Update to require openbao 2.3.2, which has been updated in preparation
    for moving it to EPEL by changing the service to run under the openbao
    user and group id instead of vault.


author: Carl Edquist <edquist@cs.wisc.edu> - 1.20.1-2.4.osg
changelog:
  - **** OSG CHANGELOG ****
      * Fri Dec 30 2022 Carl Edquist <edquist@cs.wisc.edu> - 1.20.1-2.4.osg
      - Bump and rebuild for new gpg key (SOFTWARE-5422)

      * Thu Jan 21 2021 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.20.1-2.3.osg
      - Add 2652-web-input-validation.patch and 2652a-python2.patch to fix XSS vulnerability
          - https://pagure.io/koji/pull-request/2652

      * Fri May 01 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.20.1-2.1.osg
      - Update to 1.20.1-2 from Fedora
      - Drop Fix-1.15-1.16-schema-upgrade-script.patch (upstream)

      * Fri May 01 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.19.1-4.1.osg
      - Update to 1.19.1-4 from Fedora
      - Drop kojid_setup_dns.patch (no longer applies; can do the same thing with editing /etc/mock/site-defaults.cfg instead of a patch)

      * Thu Apr 30 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.18.1-1.1.osg
      - Update to 1.18.1-1 from Fedora
      - Drop 1524-1-set-module_hotfixes-1.patch (upstream)
      - Drop Restore-Python-2.6-compatibility-to-kojid.patch (no longer applies; not needed for EL7, EL8)

      * Thu Apr 23 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.17.0-10.3.osg
      - Apply patches from Koji 1.18.0 to avoid "missing module metadata" error for EL8 builds
          - https://pagure.io/koji/pull-request/1524 (1st commit)

      * Sat Apr 04 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.17.0-10.2.osg
      - Fix kojid to use Python 2.6-compatible gzip (gzip.GzipFile did not support the 'with' statement)
        (Restore-Python-2.6-compatibility-to-kojid.patch)

      * Fri Mar 27 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.17.0-10.osg
      - Update to 1.17.0-10 from Fedora
      - Drop CVE-2019-17109.patch (upstream)

      * Tue Mar 24 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.16.2-1.3.osg
      - Backport CVE-2019-17109 patch from 1.16.3; this replaces the 1635-os_path_join.patch
      - Fix 1.15->1.16 schema upgrade script
        (Fix-1.15-1.16-schema-upgrade-script.patch)
      - Replace kojira-accept-sleeptime-option.patch with kojira-add-sleeptime-to-conf.patch
        (partially upstreamed)

      * Mon Mar 23 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.16.2-1.1.osg
      - Update to 1.16.2-1 from Fedora/EPEL

        Drop OSG patches that no longer apply:
        - Don-t-warn-on-compatrequests.patch
        - Don-t-warn-on-use_old_ssl-OSG-still-relies-on-it.patch
        - koji_passwd_cache.patch
        - koji_passwd_retry.patch
        - koji_proxy_cert.patch

      * Fri Dec 06 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.15.3-1.2.osg
      - Update based on Fedora's 1.15.1-3 spec file and upstream's 1.15.3 tarball.

      * Fri Nov 22 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.14.3-1.2.osg
      - Update based on Fedora's 1.14.0-4 spec file and upstream's 1.14.3 tarball.

      * Fri Nov 22 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.13.2-1.1.osg
      - Update based on Fedora's spec file and upstream's 1.13.2 tarball.

      * Fri Nov 22 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.12.2-1.1.osg
      - Add missing python-multilib and python-psycopg2 dependencies

      * Fri Nov 15 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.12.2-1.osg
      - Update to 1.12.2

      * Wed Oct 09 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.1-1.2.osg
      - Add patch for https://pagure.io/koji/pull-request/1635
        (1635-os_path_join.patch)

      * Thu Mar 14 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.1-1.1.osg
      - Drop python-libcomps requirement

      * Thu Feb 21 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.1-1.osg
      - Update to 1.11.1 (SOFTWARE-3595)
      - Build from developer tarball

      * Tue Oct 30 2018 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.0-1.7
      - Add kojira-accept-sleeptime-option.patch

      * Fri Dec 22 2017 Mátyás Selmeci <matyas@cs.wisc.edu> - (no build)
      - Drop el5-isms (SOFTWARE-3050)
      - Drop createrepo_sha1.patch -- was only required for el5

      * Wed Aug 23 2017 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.0-1.6
      - Fix `koji add-group-pkg` to set the correct type (SOFTWARE-2870)
        (Fix-type-in-add-group-pkg.patch)

      * Thu Jan 19 2017 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.0-1.5
      - Require python-requests-2.6.0 (fixes "call 8 (rawUpload) failed: syntax error: line 1, column 49" error in kojid)

      * Thu Jan 12 2017 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.0-1.4
      - Add db-upgrade-1.10-to-1.11.patch to fix a failing constraint in DB upgrade
        script from 1.10 to 1.11

      * Wed Jan 11 2017 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.0-1.2
      - Add kojiweb_getfile_nontext_fix.patch to fix an error with 'getfile' kojiweb
        URLs

      * Tue Jan 03 2017 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.0-1.1
      - Merge OSG changes

      * Tue Oct 04 2016 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.10.1-10.1
      - Merge OSG changes
          - Drop koji_no_sslv3.patch
          - Drop pkgorigins_filename.patch
          - Update other OSG patches

      * Fri Jan 30 2015 Mátyás Selmeci <matyas@cs.wisc.edu> 1.6.0-10
      - Patch kojid to request sha1 when running createrepo, for el5 compatibility
        (SOFTWARE-1442)

      * Thu Jan 29 2015 Carl Edquist <edquist@cs.wisc.edu> - 1.6.0-9
      - Bring in upstream fix to parse repomd.xml for pkgorigins filename,
        required for el6 koji upgrade (SOFTWARE-1442)
        (pkgorigins_filename.patch)

      * Thu Oct 16 2014 Carl Edquist <edquist@cs.wisc.edu> - 1.6.0-8
      - Add patch to allow using TLSv1 instead of SSLv3 (SOFTWARE-1637)
        (koji_no_sslv3.patch)

      * Wed May 22 2013 Matyas Selmeci <matyas@cs.wisc.edu> - 1.6.0-7
      - Add use_host_resolv to opts in koji cli so koji --mock-config makes configs with DNS set up
        (kojicli_setup_dns.patch)

      * Wed Oct 31 2012 Matyas Selmeci <matyas@cs.wisc.edu> - 1.6.0-6
      - Add Brian Bockelman's patch to allow using proxy certs
        (koji_proxy_cert.patch)

      * Wed Jun 13 2012 Matyas Selmeci <matyas@cs.wisc.edu> - 1.6.0-5
      - Allow user to retry entering SSL key password
        (koji_passwd_retry.patch)

      * Fri Oct 28 2011 Matyas Selmeci <matyas@cs.wisc.edu> - 1.6.0-4
      - add patch to check for spec file only after running source_cmd in a build from an scm
        (kojid_scmbuild_check_spec_after_running_sourcecmd.patch)

      * Tue Oct 11 2011 Matyas Selmeci <matyas@cs.wisc.edu> - 1.6.0-3
      - add setup_dns to rootopts in kojid
        (kojid_setup_dns.patch)

      * Mon Aug 08 2011 Brian Bockelman <bbockelm@cse.unl.edu> - 1.6.0-2
      - Cache passwords to decrypt SSL key in memory.
        (koji_passwd_cache.patch)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.21.1-1.1.osg
changelog:
  - Update to 1.21.1 and merge OSG changes
  - Drop kojicli_setup_dns.patch (don't need that feature anymore)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.33.0-1.1.osg
changelog:
  - Update to 1.33.0 and merge OSG changes
  - Tentatively drop Fix-type-in-add-group-pkg.patch (doesn't apply, not sure it's needed)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.2.0-1
changelog:
  - Turn osg-configure-rsv into a dummy package (SOFTWARE-4511)
  - Add "queue" to OSG_ResourceCatalog for Pilot sections (SOFTWARE-5881)


author: Mats Rynge <rynge@isi.edu> 1.7-1
changelog:
  - Moved to the new ospool.osg-htc.org central managers in high
    availability setup
  - Removed pre-9.0 HTCondor config - this is no longer
    supported by the OSPool (IDTOKENS only)
  - Change the VO override to the lowercase "osg" (SOFTWARE-4905)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.8-1
changelog:
  - Include the package version in the schedd classad (SOFTWARE-5105)
  - Disable .sif images on 3.x kernels (OSPOOL-18)
  - Improve OS_VERSION handling
  - Drop Map* ProbeConfig overrides (SOFTWARE-5042)


author: Brian Lin <blin@cs.wisc.edu> - 3.6.0
changelog:
  - Add configuration file for osg-incommon-cert-request (SOFTWARE-5668)
  - Update default CSR key length to 4096, add CLI option (SOFTWARE-5651)


author: Brian Lin <blin@cs.wisc.edu> - 3.6.1
changelog:
  - Fix bug with default CA config file option (SOFTWARE-5668)
  - Update default InCommon IGTF CA IDs to point to CA 3


author: Dave Dykstra <dwd@fnal.gov> - 3.7.0
changelog:
  - Convert osg-incommon-cert-request to use urllib3 instead of M2crypto
    for its https connection, to make it work properly on EL9.


author: Dave Dykstra <dwd@fnal.gov> - 3.7.2
changelog:
  - Fix bug in invocation of urllib3.request() in restclient's get_request();
    it was passing headers as the 4th parameter instead of identifying it
    by name.  Broke retrieval of cert with osg-incommon-cert-request in
    some cases.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 23-6
changelog:
  - Use osg-htc.org (SOFTWARE-5986)
  - Use "distrepo" repos for minefield (SOFTWARE-5986)
  - Drop osg-next repo files (SOFTWARE-5986)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.7.0-1
changelog:
  - Convert osg-system-profiler-viewer to Python 3
  - Add XRootD cconfig dumps (SOFTWARE-4933)
  - Print crypto policy if available (SOFTWARE-5330)
  - Fix email address in help message


author: Brian Lin <blin@cs.wisc.edu> - 0.8.1-1
changelog:
  - Add the --pw-store option to the invocation of oidc-add and add a default
    scope of blank if no scopes are configured.  These are needed for the
    CILogon issuer (SOFTWARE-4983).


author: Carl Edquist <edquist@cs.wisc.edu> - 0.8.2-1
changelog:
  - Increase renewal frequency to ensure continual validity (SOFTWARE-5137)
  - Fix password file handling for restricted permissions in setup script (#17)
  - Use newer --pw-file option for oidc-add (SOFTWARE-5050)
  - Bump version requirement for oidc-agent package (SOFTWARE-5050)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 23-5
changelog:
  - Log DNs of incoming certificates (SOFTWARE-5370); raise required XRootD version to 1:5.6.0 for the feature


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.8.2-1.1
changelog:
  - Update to XRootD 5.8.2 (SOFTWARE-6151)
      - Patches added:
          - 0008-XRootD-s-xml-response-for-PROPFIND-will-now-include~aacf631.patch
      - Patches kept:
          - 0001-Allow-hostname-used-by-XRootD-to-be-overridden-by-en~7c119b0.patch
          - 0002-XrdTls-Allow-disabling-of-X.509-client-auth~18e1c81.patch
          - 0003-XrdSciTokens-Handle-multiple-authorization-token-set~ec1eb0c.patch -> 0003-XrdSciTokens-Handle-multiple-authorization-token-set~b82ddc3.patch
          - 0004-XrdHttp-Undo-HTTP-PUT-response-code-change~956b9fa.patch
          - 0005-XrdHttp-Fix-HTTP-protocol-errors-on-failure~4fb2221.patch
          - 0007-Re-engineer-concurrency-limits-for-throttles~0ef6dbc.patch -> 0006-Re-engineer-concurrency-limits-for-throttles~39fea57.patch
          - 0009-Modify-XrdThrottle-to-be-an-OSS-plugin~580a3f1.patch -> 0007-Modify-XrdThrottle-to-be-an-OSS-plugin~921fef5.patch
      - Patches dropped:
          - 0006-XrdPosix-Map-operation-timeouts-to-ETIME~9480232.patch
          - 0008-Tweak-throttle-manager-after-large-scale-testing~273c58e.patch
          - 0010-CMake-changes-for-XrdThrottle-overhaul~fe965e8.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.8.3-1.1
changelog:
  - Update to XRootD 5.8.3 (SOFTWARE-6164)
      - Patches added:
          - 0009-Avoid-reference-beyond-end-of-table~80b938c.patch
          - 0010-XrdPfc-Ensure-a-reference-to-the-file-is-kept-when-s~aa225e2.patch
      - Patches kept:
          - 0001-Allow-hostname-used-by-XRootD-to-be-overridden-by-en~7c119b0.patch
          - 0002-XrdTls-Allow-disabling-of-X.509-client-auth~18e1c81.patch
          - 0003-XrdSciTokens-Handle-multiple-authorization-token-set~b82ddc3.patch
          - 0004-XrdHttp-Undo-HTTP-PUT-response-code-change~956b9fa.patch -> 0004-XrdHttp-Undo-HTTP-PUT-response-code-change~43ed40b.patch
          - 0006-Re-engineer-concurrency-limits-for-throttles~39fea57.patch
          - 0007-Modify-XrdThrottle-to-be-an-OSS-plugin~921fef5.patch
          - 0008-XRootD-s-xml-response-for-PROPFIND-will-now-include~aacf631.patch
      - Patches dropped:
          - 0005-XrdHttp-Fix-HTTP-protocol-errors-on-failure~4fb2221.patch
          - 0009-Fix-life-time-of-a-variable-used-for-signaling-that~286b8ca.patch
          - 0010-Correct-concurrency-and-state-tracking-around-Redriv~86d48f1.patch
          - 0011-Fix-race-conditions-around-use-of-ecMsg~803dc26.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.8.4-1.1
changelog:
  - Update to XRootD 5.8.4 (SOFTWARE-6187)
      - Patches added:
      - Patches kept:
          - 0001-Allow-hostname-used-by-XRootD-to-be-overridden-by-en~7c119b0.patch -> 0001-1-Allow-hostname-used-by-XRootD-to-be-overridden-by~7c119b0.patch
          - 0002-XrdTls-Allow-disabling-of-X.509-client-auth~18e1c81.patch -> 0002-4-XrdTls-Allow-disabling-of-X.509-client-auth~18e1c81.patch
          - 0003-XrdSciTokens-Handle-multiple-authorization-token-set~b82ddc3.patch -> 0003-6-XrdSciTokens-Handle-multiple-authorization-token-s~b82ddc3.patch
          - 0004-XrdHttp-Undo-HTTP-PUT-response-code-change~43ed40b.patch -> 0004-14-XrdHttp-Undo-HTTP-PUT-response-code-change~43ed40b.patch
          - 0006-Re-engineer-concurrency-limits-for-throttles~39fea57.patch -> 0005-23-Re-engineer-concurrency-limits-for-throttles~39fea57.patch
          - 0007-Modify-XrdThrottle-to-be-an-OSS-plugin~921fef5.patch -> 0006-23-Modify-XrdThrottle-to-be-an-OSS-plugin~921fef5.patch
          - 0008-XRootD-s-xml-response-for-PROPFIND-will-now-include~aacf631.patch -> 0007-25-XRootD-s-xml-response-for-PROPFIND-will-now-inclu~aacf631.patch
          - 0011-Enable-write-through-mode-for-cache~330eac1.patch -> 0008-32-Enable-write-through-mode-for-cache~330eac1.patch
      - Patches dropped:
          - 0009-Avoid-reference-beyond-end-of-table~80b938c.patch
          - 0010-XrdPfc-Ensure-a-reference-to-the-file-is-kept-when-s~aa225e2.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.8.4-1.3
changelog:
  - Add patches (SOFTWARE-6202):
      - 0009-34-Add-S3-as-a-permitted-proxy-protocol~b36d9b7.patch
      - 0010-36-Do-a-clean-TLS-shutdown-for-HTTPS~cdc53fe.patch
      - 0011-35-Make-HTTP-s-maximum-open-delay-configurable~3496b32.patch


author: Dave Dykstra <dwd@fnal.gov> 1.17.2-1
changelog:
  - Update to upstream 1.17.2
  - Add a temporary wrapper script on the vault command to avoid an irrelevant
    warning issued by the gosnowflake dependency when DBUS_SESSION_BUS_ADDRESS
    is not set


author: Dave Dykstra <dwd@fnal.gov> 1.17.2-2
changelog:
  - Stop including go in the source tarball, instead assume the build pulls
    in a new enough version of golang.


author: Mátyás Selmeci <mselmeci@wisc.edu> - 138-1
changelog:
  - Add new CERN IAM endpoint for CMS (SOFTWARE-6072)
  - Remove lcg-voms2.cern.ch and voms2.cern.ch LSC files and vomses entries (SOFTWARE-6072)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.27.rc3
changelog:
  - Update to version 2.1.0-rc3
  - Drop patches accepted upstream
  - Add new patches (the PRs have been accepted upstream)


author: Brian Bockelman <bbockelman@morgridge.org> 1.3.0-1
changelog:
  - Split code in half, creating a pure-HTTP(S) plugin which only invokes
    libcurl and a Pelican-only plugin that depends on the HTTP one.
  - Add support for delete operations.
  - Add support for creating directories.
  - Add support for cache-control and Etag queries.
  - Implement a prefetch scheme, removing the need for round trips for
    each operation if you are simply reading the whole file.


author: Brian Bockelman <bbockelman@morgridge.org> 1.4.0-1
changelog:
  - Add experimental support for s3://-style URLs.
  - Delay initialization of thread pools until the first file is opened.
  - Cleanly shutdown helper threads when plugin is unloaded, reducing
    the chance of a segfault when a CLI or unit test is shutting down.
  - Fix a few minor memory leaks and race conditions uncovered by
    AddressSanitizer.


author: Brian Bockelman <bbockelman@morgridge.org> 1.5.2-1
changelog:
  - Add infrastructure for automating GitHub releases from a pushed tag
  - Automatically build as part of a release.


author: Brian Bockelman <bbockelman@morgridge.org> 1.5.5-1
changelog:
  - Fix a bug that could trigger a deadlock when a busy plugin is unable
    to continue an ongoing prefetch request.


author: Brian Bockelman <bbockelman@morgridge.org> 1.5.6-1
changelog:
  - Fix a bug that could cause the client to stop processing new requests
    if a significant number (approximately 16k) of operations have
    expired since process startup.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 2.1.3-1
changelog:
  - Fail plugin initialization if we can't get the OSS (SOFTWARE-5388)
  - If user cannot be mapped to uid, continue as anonymous
  - Change from named daemon to exec


