# changelog

author: Troy Dawson <dawson@fnal.gov> 5.3-0.1.rolling
changelog:
  - Moved everything to 5.3
  - Added vendors Update 3 release notes, unaltered
  - Added SL 5.2 release notes


author: Troy Dawson <dawson@fnal.gov> 5.2-0.1.rolling
changelog:
  - Moved everything to 5.2
  - Added vendors Update 2 release notes, unaltered
  - Added SL 5.1 release notes


author: Troy Dawson <dawson@fnal.gov> - 2.2.11-5.slf4
changelog:
  - Added Prereq: coreutils
  - Changed %post to make sure /usr/lib/security is there before making the link


author: Troy Dawson <dawson@fnal.gov> - 2.2.11-2.slf4
changelog:
  - Troy actually packaged it right, and everyone was happy
  - Added post section to make the pam_krb5 directory link


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2.8-1
changelog:
  - don't try to validate creds in a password-changing situation, because the
    attempt will always fail unless the matching key is in the keytab, which
    should never be the case for the password-changing service (#187303, rbasch)
  - if v4 has been disabled completely, go ahead and try to set 2b tokens
    because we're going to end up having to do that anyway (#182378)


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2.7-1
changelog:
  - add v4 credential conversion for "use_shmem" and "external" cases (though
    it should be redundant with "use_shmem") (#182239)


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2.6-1
changelog:
  - add a "krb4_use_as_req" option so that obtaining v4 creds kinit-style can
    be disabled completely (Hugo Meiland)


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2.5-1
changelog:
  - don't log debug messages that we're skipping session setup/teardown unless
    debugging is enabled (#179037)
  - try to build the module with -Bsymbolic if we can figure out how to do that


author: Nalin Dahyabhai <nalin@redhat.com> 1.57-1
changelog:
  - force -fPIC
  - add --with-moduledir, --with-krb5-libs, --with-krbafs-libs to configure
  - add per-user stashes and return values


author: Nalin Dahyabhai <nalin@redhat.com> 1.49-1
changelog:
  - set PAM_USER using the user's parsed name, converted back to a local name
  - add account management service (checks for key expiration and krb5_kuserok())
  - handle account expiration errors


author: Nalin Dahyabhai <nalin@redhat.com> 1.46-1
changelog:
  - link with libresolv to get res_search, tip from Justin McNutt, who
    built it statically
  - explicitly link with libdes425
  - handle cases where getpwnam_r fails but still sets the result pointer
  - if use_authtok is given and there is no authtok, error out


author: Nalin Dahyabhai <nalin@redhat.com> 1.43-1
changelog:
  - add minimum UID support (#52358)
  - don't link pam_krb5 with libkrbafs
  - make all options in krb5.conf available as PAM config arguments


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - note that we had to prepend the current directory to a given path in
    dlopen.c when we had to (noted by Onime Clement)


author: Nalin Dahyabhai <nalin@redhat.com> 1.42-1
changelog:
  - return PAM_NEW_AUTHTOK_REQD when attempts to get initial credentials
    fail with KRB5KDC_ERR_KEY_EXP (noted by Onime Clement)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add info about accessing the CVS repository to the README
  - parser cleanups (thanks to Dane Skow for a more complicated sample)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't set forwardable and assorted other flags when getting password-
    changing service ticket (noted, and fix supplied, by Onime Clement)
  - try __posix_getpwnam_r on Solaris before we try getpwnam_r, which may
    or may not be expecting the same number/type of arguments (noted by
    Onime Clement)
  - use krb5_aname_to_localname to convert the principal to a login name
    and set PAM_USER to the result when authenticating
  - some autoconf fixes for failure cases


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't call initialize_krb5_error_table() or initialize_ovk_error_table()
    if they're not found at compile-time (reported for RHL 6.x by Chris Riley)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - note that [pam] is still checked in addition to [appdefaults]
  - note that AFS and Kerberos IV support requires working Kerberos IV
    configuration files (i.e., kinit -4 needs to work) (doc changes
    suggested by Martin Schulz)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add max_timeout, timeout_shift, initial_timeout, and addressless options
    (patches from Simon Wilkinson)
  - fix the README to document the [appdefaults] section instead of [pam]
  - change example host and cell names in the README to use example domains


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't delete tokens unless we're also removing ticket files (report and
    patch from Sean Dilda)
  - report initialization errors better


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - treat semicolons as a comment character, like hash marks (bug reported by
    Greg Francis at Gonzaga University)
  - use the [:blank:] equivalence class to simplify the configuration file parser
  - don't mess with the real environment
  - implement mostly-complete aging support


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't fail to fixup the krb5 ccache if something goes wrong obtaining
    v4 credentials or creating a krb4 ticket file (#33262)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fixup the man page
  - log return code from k_setpag() when debugging
  - create credentials and get tokens when setcred is called for REINITIALIZE


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't twiddle ownerships until after we get AFS tokens
  - use the current time instead of the issue time when storing v4 creds, since
    we don't know the issuing host's byte order
  - depend on a PAM development header again instead of pam-devel


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a separate config file parser for compatibility with settings that
    predate the appdefault API
  - use a version script under Linux to avoid polluting the global namespace
  - don't have a default for afs_cells
  - need to close the file when we succeed in fixing permissions (noted by
    jlkatz@eos.ncsu.edu)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - use the appdefault API to read krb5.conf if available
  - create v4 tickets in such a way as to allow 1.2.2 to not think there's
    something fishy going on


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - only try to delete ccache files once
  - ignore extra data in v4 TGTs, but log that we got some
  - require "validate" to be true to try validating, and fail if validation fails


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix prompting when the module's first in the stack and the user does not have
    a corresponding principal in the local realm
  - properly implement TGT validation
  - change a few non-error status messages into debugging messages
  - sync the README and the various man pages up


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add Seth Vidal's no_user_check flag
  - document no_user_check and skip_first_pass options in the man pages
  - rebuild against Kerberos 5 1.2 (release 15)


author: Pat Riehecky <riehecky@fnal.gov> 3-1.3.1
changelog:
  - better checks for upgrades of various things
  - clearer doc on what triggers are running off of which events and why
  - fixed the NetworkManager scripts to only modify controlled interfaces


author: Pat Riehecky <riehecky@fnal.gov> 3-1.3
changelog:
  - yet another update to the resolv.conf preservation
  - fixed the NetworkManager scripts so that they correctly clean up upon removal


author: Pat Riehecky <riehecky@fnal.gov> 3-1.2
changelog:
  - nscd process searches now seach by process ownership.
  - resolv.conf settings are more accuratly preserved.


author: Pat Riehecky <riehecky@fnal.gov> 3-1.1
changelog:
  - Yet another check on nscd, this really shouldn't start it unless you want it
  - Standardized the trigger interface a bit further
  - Updated grep checks, thanks Steve Timm


author: Pat Riehecky <riehecky@fnal.gov> 3-1
changelog:
  - moved most of the config work to a trigger on 'bind'
    this way the config is validated on each update.  This should
    keep things working longer through updates
  - made nscd restart silent (oops)


author: Pat Riehecky <riehecky@fnal.gov> 3-0.3
changelog:
  - clean up stray /etc/named.conf link
  - added nscd restart
  - made smarter about when it starts bind and when it doesn't


author: Pat Riehecky <riehecky@fnal.gov> 3-0.2
changelog:
  - try and hardlink /etc/named.rfc1912.zones before soft link
  - moved the blocks which actually start the named server to the 'fresh install only' space
  - made the /etc/resolv.conf edit smarter so that it doesn't do anything if named isn't running


author: Pat Riehecky <riehecky@fnal.gov> 3-0.1
changelog:
  - fixed a minor chmod problem
  - switched search from /etc/sysconfig/network-scripts/ifcfg-eth* to /etc/sysconfig/network-scripts/ifcfg-*|grep -v ifcfg-lo to account for strangly named cards


author: Pat Riehecky <riehecky@fnal.gov> 3-0.0
changelog:
  - Almost totally re-written
  - Moved NetworkManager to trigger
  - Moved dhclient to trigger
  - Added dnsmasq trigger
    this rpm enables bind, but if you want instead dnsmasq it should be configured
  - Now requires selinux packages, selinux enforcement is however optional
    more info in README.selinux
  - Using links to help make it obvious which file bind is reading
  - Modified config to use views to help reduce possible non localhost use in bind
  - Switched from a dynamic config to a static one for deploy and copy to 'doc'
    it is configured after the style of SLF5 caching-nameserver but with
    the approach from SLF6 bind.  It ballences security and readibility.
  - Obsolete caching-nameserver for 5.x its not in 6.x and integration was messy
  - Set sane looking defaults rather than ad-hoc creation of forwarder list
     + 131.225.0.254
     + 8.8.8.8


author: Jason Harrington <jason@fnal.gov> 2.0-2
changelog:
  - Fixed bugs dealing with NetworkManager comments in /etc/resolv.conf
  - Added default DNS forwarder when no nameserver list found
  - Added eth0-specific domain-name-server prepend for use with NetworkManager
  - Added post-uninstall bits to undo dhclient tweaks


author: Pat Riehecky <riehecky@fnal.gov> 1.2-1.SL
changelog:
  - added PRERUN and POSTRUN from SL6
  - added /etc/yum.d/yum.cron.updateexec for configuring PRERUN and POSTRUN


author: Troy Dawson <dawson@fnal.gov> 1-1.SLF
changelog:
  - Made changes from yum-autoupdate-1-1-SL
  - Added the addons repository,  Brought the code over from SLF4


author: Pat Riehecky <riehecky@fnal.gov> 4.2.6-5
changelog:
  - switched to 'bash' for triggers and post to avoid errors
  - updated requires list to get things more in order


author: Pat Riehecky <riehecky@fnal.gov> 4.2.6-4
changelog:
  - switched to a define based ntp server list
  - updated ntp server list
  - made version independent, now works on SLF5 and SLF6
  - added comments to help explain the configuration options


author: Connie Sieh <csieh@fnal.gov> 4.2.6-3
changelog:
  - Modified ntpd-fermi code from "RH-Firewall-1-INPUT" to "INPUT" as TUV
    Does not use "RH-Firewall-1-INPUT" anymore.


author: Tyler Parsons <tparsons@fnal.gov> 4.2.6-2
changelog:
  - added secondary and tertiary time servers to ntp.conf (131.225.17.150 and 131.225.8.120)
  - changed references to servers from (131.225.8.200 and 131.225.17.200) to (131.225.17.150 and 131.225.8.120)


author: Troy Dawson <dawson@fnal.gov> 4.2.6-1
changelog:
  - added ntpdate to the requirements
  - Changed the step-tickers section to trigger on ntpdate
  - Removed the change that added -A to /etc/sysconfig/ntpd


author: Pat Riehecky <riehecky@fnal.gov> 2.1-2
changelog:
  - fixed typo where on reinstall of the rpm, the sed statement didn't match and therefore nothing happened


author: Jan-Frode Myklebuust <janfrode@tanso.net> - 0.97.2-3
changelog:
  - Handle xz archives in rpmbuilds < RHEL6.
  - include updated clamd-wrapper which get the PidFile setting from the
    service configuration file.


author: Jan-Frode Myklebuust <janfrode@tanso.net> - 0.97.2-2
changelog:
  - updated to 0.97.2
  - Build-require xz
  - CVE-2011-2721 Off-by-one error by scanning message hashes (#725694)


author: Jan-Frode Myklebust <janfrode@tanso.net> - 0.97-12
changelog:
  - Move deletion of /var/lib/clamav/mirrors.dat to db package.
  - Don't enable NotifyClamd in freshclam config and cronjob, as not
    everybody is running clamd. Running clamd's will anyway notice
    when db is updated.


author: Jan-Frode Myklebust <janfrode@tanso.net> - 0.97-11
changelog:
  - Delete /var/lib/clamav/mirrors.dat, it will be recreated on first run.
  - clamav-milter config cleanups.


author: Jan-Frode Myklebust <janfrode@tanso.net> - 0.97-10
changelog:
  - Make sure /var/lib/clamav/mirrors.dat has owner fixed on upgrade.
  - Don't start clamd or milter service by default.


author: Dag Wieers <dag@wieers.com> - 0.90.2-2
changelog:
  - Added clamav-milter support for EL2.1 now that it comes with a newer sendmail. (Tom G. Christensen)


author: Dag Wieers <dag@wieers.com> - 0.90.1-3
changelog:
  - Cleaned up default options to clamav-milter. (Adam T. Bowen)
  - Removed -b/--bounce as it is no longer recognized. (Gerald Teschl)


author: Dag Wieers <dag@wieers.com> - 0.80-2
changelog:
  - Added %dir /var/clamav/log. (Adam Bowns)
  - Changed logrotate script to use clamd.log. (Stuart Schneider)
  - Added curl dependency. (Petr Kristof)
  - Synchronized some options from Petr. (Petr Kristof)
  - Fixed another clamav.conf reference. (Michael Best)


author: Dag Wieers <dag@wieers.com> - 0.80-1
changelog:
  - Updated package description. (Arvin Troels)
  - Incorporated fixes from Jima. (Jima)
  - Config clamav.conf renamed to clamd.conf.
  - Removed obsolete patch.
  - Added macros for building without milter.
  - Updated to release 0.80.


author: Dag Wieers <dag@wieers.com> - 0.70-2
changelog:
  - Fixed the installation check for conf files. (Richard Soderberg, Udo Ruecker)
  - Changed the init-order of the sysv scripts. (Will McCutcheon)
  - Changes to the default configuration files.


author: Matthias Saou/Che
changelog:
  - Added "--without milter" build option. (Matthias Saou)
  - Fixed freshclam cron (Matthias Saou)
  - Built the new package. (Che)


author: Lars Marowsky-Bree <lmb@suse.de>
changelog:
  - version 2.99.1-1
  - Update source tarball to revision: d8710f41b9cb
  - Includes many fixes to init scripts.
  - Add sbd for shared-storage fencing.


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 2.1.3-18
  - Added two small patches for Bug LF-1833: Do not overwrite op_status depending on op_rc


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 2.1.3-1
  - Update source tarball to revision: 9cdeae333990
  - Statistics:
      Changesets:      153
      Diff:            141 files changed, 12279 insertions(+), 3103 deletions(-)
  - This is the first release now that the CRM has becme its own project called
    Pacemaker and no longer included with Heartbeat.
  - Without the CRM present, the following components are also no longer able to
    be included with Heartbeat (as they require CRM libraries) and are instead
    provided as part of pacemaker or the new pacemaker-pygui project.
     cim
     snmp
     mgmtd
     pygui
     tsa_subagent
  - RPM-based distributions also have a new package layout
     heartbeat-resources ::= resource agents
     heartbeat-common    ::= components that are useful regardless of which stack is being used
     heartbeat           ::= components that are specific to the Heartbeat stack
  - Changes since obs-2.1.2-24
  + apache RA: remove children in case the top process didn't
  + apcsmart: make message more descriptive
  + build (LF 1803): add -fgnu89-inline to CFLAGS if gcc version is >=4.1.3 and <4.3
  + by request from Andrew - Modified the external/ssh plugin to have a livedangerously flag
  + ccm (LF 1806): restart all instead of exiting (low impact)
  + Changed a test from causing a reboot to not triggering a reboot - because it doesn't seem to any more
  + Changed HIGHLY to STRONGLY in how strongly we recommend STONITH
  + Corrected a warning found on FC8 in the cl_reboot code
  + debian: Add dependancy on libpam-runtime (>= 0.76-14)
  + Debian: add libxml2-utils as a dependancy, because we need xmllint for the BSC
  + Debian: add the new ibmrsa-telnet stonith plugin
  + debian: clean python bytecode
  + debian: clean up stale heartbeat-2 files
  + debian: don't install bytecompiled python modules
  + debian: patches need to be distributed
  + debian: remove chown patch
  + debian: Update standards version from 3.7.2 to 3.7.3
  + debian: update the name of the series file to reflect the new release
  + docs/packaging: reshuffle hb_report documentation and include the html version
  + dopd: don't cl_free variables on local stack
  + dopd: don't hardcode path of drbdadm; it has to be in the PATH, though.
  + dopd: fix potential segfault due to leakage of invalid/freed pointer
  + dopd: make it work with multiple concurrent outdate requests
  + external ipmi plugin caused error messages when getting metadata on machine w/o ipmitool installed.  This somewhat messed up BasicSanityCheck.
  + Filesystem: Make mount point required for the GUI (Hideo Yamauchi)
  + Fix memory leak in external plugin handling
  + fixes for fedora: system(3) function return value cannot be ignored. Also added a missing RPM build dependency.
  + hb_report: add quotes around args to test -f
  + hb_report: don't surprise user by reading the files from the current directory
  + hb_report: include hostcache
  + hb_report: replace arch with uname -m
  + hg: from last changes to recover from media errors, fixed a stupid typo with a reversed boolean condition.
  + hg: LF bug 1794: ComponentFail tests failing
  + hg: Makefile for external stonith commands was missing new stonith plugin in the extra_dist section
  + High: Heartbeat: Include an option to start the CRM in respawn mode
  + init: add should-start/stop $remote_fs to init script
  + init: should-start/stop $remote_fs to init script
  + ipc (LF 1339): enable message compression
  + IPv6addr: Check for netinet/icmp6.h instead of  linux/icmpv6.h
  + IPv6addr: Check for netinet/icmp6.h instead of linux/icmpv6.h
  + iscsi RA: wait for udev to create the links
  + Junko IKEDA reported a problem building on Red Hat with tog-pegasus installed - this fixes that problem - the code half-setup things if pegasus was present but --enable-cim-provider wasn't enabled
  + ldirectord: add forking mode
  + ldirectord: SimpleTCP service check
  + ldirectord: SimpleTCP service check documentation
  + ldirectord: Various updates to OCF compatible RA
  + lf bug 1678: stonith command core dumps with -h option
  + LF bug 1690: there should be a tool to audit (validate) node names in constraints among other things...
  + LF Bug 1732: Error handling is bad for comm media
  + LF bug 1732: restructuring code towards being able to restart (reopen) communication media when they die
  + LF bug 1795 - timeout control for crm_mon --one-shot
  + LF bugzilla 1667:  ppc64 RPMs contain 32-bit binaries
  + LRM (LF 1821): resource timing information
  + lrm reg tests: handle OCF_ROOT, warn about xmllint missing
  + LRM regtest: update filters to match the lrmadmin output
  + lrmadmin: include time.h
  + Monitor timeouts need to increment fail counts
  + OCF-resources: SphinxSearchDaemon is not installed
  + OpenBSD bugs: 1731 1761 1743 1659
  + packaging: include iscsi
  + pgsql RA: handle the missing pg software properly (thanks to Serge)
  + pgsql RA: move check for root down to enable meta-data for regular users (thanks Serge)
  + pgsql RA: postmaster confusion
  + Put the _source_ (.in) file under source control.  Groan...
  + RA Filesystem: add lustre to the list of fs which don't need fsck
  + RA iscsi: dropped complex code in favour of udev and several small cleanups
  + RA iscsi: fix meta-data xml
  + RA iscsi: get rid of one annoying message ("no active sessions")
  + RA iscsi: new iscsi resource agent
  + RA iscsi: support iscsi sles compat mode
  + RA iscsi: two echo statements removed
  + RA mysql: don't look for mysql users in the OS database (thanks to Christian Rishoj)
  + RA SAPDatabase/SAPInstance: report proper exit codes in case required software is not installed
  + RA SphinxSearchDaemon: a new RA thanks to Christian Rishoj
  + recovermgrd: changed the code to look at the return code from fwrite, to make Fedora 8 compiler compile recovermgrd warning-free.
  + Removed bzip2-devel as a build dependency for all but Fedora and RH
  + RPM and specfile changes to fix part of and help diagnose part of Junko IKEDA's problem with tog-pegasus
  + RPM spec file: Added ciblint to installed programs
  + RPM specfile change:  made is_fedora macro turn off is_rhel macro
  + shell scripts: various cases of overquoting in the for statement (thanks to Takekazu Okamoto)
  + stonith ibmrsa-telnet: new stonith plugin
  + stonith ipmi: new external stonith plugin
  + utillib.sh: update finding the binary which coredumped
  + Xen RA: new improved (thanks to Sebastian Reitenbach)
  + [patch] init: add should-start/stop $remote_fs to init script


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 2.1.2-24
  - Update the source tarball to revision ef1be5978d97
  - Statistics:
      Changesets:       104
      Diff:             296 files changed, 3464 insertions(+), 3275 deletions(-)
  - Test hardware:
    + 4-node vmware cluster (sles10-sp1/256Mb/vmware stonith) on a single host (opensuse10.3/2Gb/2.66Ghz Quad Core2)
    + 7-node EMC Centera cluster (sles10/512Mb/2Ghz Xeon/ssh stonith)
  - All testing was performed with STONITH enabled
  - Pending bugs encountered during testing:
    1750 - logd: ipc_bufpool_update: magic number in head does not match
  - Changes since 2.1.2-15
  + High: CIB: Fix the behavior of update_attr() and delete_attr() when the command is ambiguous
  + High: CRM: In ccm_have_quorum(), an OC_EV_MS_PRIMARY_RESTORED event means we _do_ have quorum
  + High: PE: Bug 1765 - Prevent master-master colocation constraints from preventing slaves from starting
  + High: PE: Introduce a new API call for determining the location of complex resources
  + High: PE: Set next_role recursivly so that group promotion will work
  + High: PE: increment_clone() did not overflow correctly 9->10, 99->100, etc
  + High: crmd: Prevent shutdown hangs caused by pending ops that can't be cancelled - because the no longer exist in the lrm
  + High: heartbeat: Fix getnodes() compilation with gcc 4.3
  + High: Novell 293922: Don't use non-blocking writers, but instead don't block
  + High: Novell 293922: Heartbeat network processes would block on full buffers.
  + Medium: core: Do not disconnect blocking write processes, but discard traffic.
  + Medium: PE: All other things being equal, prefer to keep non-failed instances alive
  + Medium: PE: Create a syntactic shortcut for the common use-case of "{resource} prefers {node} with {score}"
  + Medium: PE: Dont make changes to location constraints, when applying to groups, persistent
  + Medium: TE: Allow the CRM to limit the number of resource actions the TE can execute in parallel.
  + Medium: TE: Pending operations shouldn't be processed
  + Medium: attrd: Bug 1776 - Attrd doesn't exit or reconnect when the CIB is respawned
  + Medium: crm: Dont generate core files for non-fatal assert (ie. the CRM_CHECK macro).
  + Medium: crmd: Don't remap LRM_OP_PENDING when building full lrm updates
  + Medium: crmd: Prevent shutdowns initiated immediately after a node is removed from the cluster with hb_delnode from stalling.
  + Medium: LF bugzilla 1757: apache resource agent grep methodology can't handle newlines - even if you change the pattern
  + Low: Admin: Do a full simulation when we have the live CIB - since we'll always have a status section
  + Low: Admin: crm_standby - Don't complain about missing values, print the default value instead
  + Low: PE: Actions for stonith agents should never default to requiring fencing or quorum
  + Low: PE: ptest - Handle malformed inputs more gracefully
  + Low: Rename example ha_logd.cf file to the proper name.
  + Low: cib: Increase the retry interval when connecting to the ccm to 3s
  + Low: crmd: Provide a more informative error when DCs detect other DCs during a join
  + Low: heartbeat: Use the correct define when choosing to enable valgrind - Keisuke MORI
  + Low: LF bug 1705 - cl_respawn core dumps when given -h or --help
  + Low: changed configure.in to force 64-bit objects when on gcc-based ppc64 platform
  + Low: configure.in - autoconf spells ppc64 funny...
  - Unclassified user impact
  + LF 1766: Heartbeat installs man pages in the wrong directories by default...
  + LF Bug 1662: Put in some RHEL changes provided by Keisuke MORI
  + LF bug 1393 - Cannot rename /var/lib/heartbeat/hostcache.tmp to /var/lib/heartbeat/hostcache (scope, risk and severity: all minor)
  + ccm (LF 1546): ensure that the membership instance number never decrements (thanks to Guochun Shi)
  + ccm: speed up ccm considerably in case a node is alone in the membership (thanks to MATSUDA, Daiki)
  + Debian: Build: Add dependacy on gawk as it is required by the OCF IPaddr resource
  + Debian: Build: rename ha_logd.cf to logd.cf in debian/heartbeat.files
  + hb_report (LF 1763): multiple fixes
  + hb_report: add more packagers support (thanks to Sebastian Reitenbach)
  + hb_report: fix handling of debug option
  + hb_report: fix the previous fix (sorry)
  + hb_report: include package verification
  + hb_report: reduce the number of ssh invocations by 1
  + hb_report: update documentation on extracting CTS tests
  + hb_report: use getopts instead of getopt(1) for the sake of portability
  + hbagent: fix memory leaks on dropping global resources (thanks to Keisuke MORI)
  + hbagent: removed the const qualifier from parameter
  + hbagent: reset gMembershipTable on dropping global resources
  + hbclient: fix memory leaks on signon/signoff (thanks to Keisuke MORI)
  + heartbeat: Increase MAXMSGHIST; reduce debugging output.
  + ldirectord: allow per-virtual checkinterval configuration
  + lvs-users: Patch for ldirectord when using mysql service
  + mgmtd (LF 1719): fix the pam file for suse
  + mysql RA (LF 1760): defaults for OpenBSD (thanks to Sebastian Reitenbach)
  + RA Xinetd (LF 1742): multiple fixes
  + RA tomcat: allow consecutive starts
  + stonithd: (LF 1727): fix dropping privileges
  + stonithd: a copy/paste typo
  + stonithd: check for storage size when copying the host list
  + stonithd: drop root privileges earlier
  + stonithd: shuffle dropping privileges around again


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 2.1.2-15
  - Update the source tarball to revision c492f19cb583
  - Statistics:
      Changesets:       158
      Diff:             173 files changed, 8712 insertions(+), 4787 deletions(-)
  - Test hardware:
    + 4-node vmware cluster (sles10-sp1/256Mb) on a single host (opensuse10.2/2Gb/2.66Ghz Quad Core2)
    + 6-node EMC Centera cluster (sles10/512Mb/2Ghz Xeon)
    + (lmb)    7-node Xen cluster on a single host
    + (debltc) 6-node ppc64 cluster
  - Pending bugs encountered during testing:
    1562 - heartbeat: hostcache file rename error at startup
    1737 - crmd: Inconsistent join state detected (Hard to reproduce, possible fix included)
    1750 - logd: ipc_bufpool_update: magic number in head does not match
  - Changes since 2.1.2-4
  + High: cib: G_main_del_IPC_Channel() doesn't like being called with a NULL pointer and crashes
  + High: crm: Bug 1749 - Make sure the diff-related digests contain the complete CIB, not just the first line
  + High: crmd: Prevent shutdown hangs by allowing the crmd to forget about pending actions for deleted resources
  + High: PE: Bug 1712 - Ensure manditory ordering constraints can cause complex resources to be shut down
  + High: PE: Clone colocation fixes
  + High: PE: Ensure that resources depending (by order) on a master are not promoted if no master is available
  + High: PE: Fix manditory ordering with m/s resources
  + High: PE: Prevent an infinite pe/te loop when reprobing with resources in master mode
  + High: PE: Prevent use-of-NULL in crm_mon when date_expressions are used by ensuring that data_set->now is always set
  + High: PE: Prevent use-of-NULL when the admin creates a colocaiton constraint with an empty group
  + High: PE: Relax an assumption regarding clones that is not true when they are unmanaged
  + High: PE: Remove an accidental commit that, when called, causes use-of-NULL
  + High: PE: Remove an errant call to exit() than prevented an assert from being triggered
  + High: RA: Novell 329833 - dotted-quad netmask notation broken in findif
  + Medium: cib: Include digests of the cib a diff was made from and verify it when applying
  + Medium: CRM: Re-evaluate appropriate IPC message queue lengths and throtle IPC _clients_ that hit them
  + Medium: crmd: Bug 1737 - Inconsistent join state detected - Possible fix
  + Medium: PE: Bug 1722 - By default, exhibit the old start-failures-are-fatal behaviour regardless of how resource-failure-stickines is set
  + Medium: PE: Enact a saner default for rsc_order.score (s/0/INFINITY)
  + Medium: PE: Fix minor memory leak when stopping orphaned resources
  + Medium: PE: Master internal ordering enhancements. Added stopped->start, stopped->promote.
  + Medium: Tools: Bug 1738 - the crmd ignores some requests from crm_resource because it exited too quickly
  + Low: contrib: dopd - Remove a pointless and annoying dependancy on the crm
  + Low: crmd: Increase the retry interval when stalling the FSA to 2s (used when connecting to the ccm, lrmd, cib)
  + Low: crmd: Update the CIB with the node's version data when it becomes DC
  + Low: crmd: Use the unaltered rc for timed out operation events from the lrmd
  + Low: Debian: heartbeat doesn't depend on libperl-dev (probably confused by '-lperl' in configure.in)
  + Low: heartbeat: Some compilers feel that the fcli variable could be used uninitialized - shut them up
  + Low: PE: Avoid pointless copying of XML items (actions) during graph creation
  + Low: PE: Convert all the resource's boolean flags into a single bit-field
  + Low: PE: Produce a config error when a clone contains more than one resource/group to clone
  + Low: RA: PureFTPd - Support debian's pure-ftpd-wrapper script.  Patch by Raoul Bhatia
  + Low: Stonith: external/rackpdu - Fix the metadata short descriptions
  + Low: ccm: Bug 1723 - fix logging (thanks to MATSUDA, Daiki)
  - Unclassified user impact
  + gui: Add "meta_attributes" support to mgmt
  + gui: Add boolean_op for location rules in mgmt
  + gui: Make several fields of rsc_location editable
  + gui: Prevent clone and master_slave from belonging to group
  + gui: Prevent haclient from falling into an error caused by blank resource metadata
  + gui: Provide "Default" setting for crm configurations
  + gui: Provide complete pengine and crmd configurations with dynamic rendering
  + gui: Rename "Places" to "Locations" to match with the CIB name
  + gui: Resolve target_role problem for sub-resource
  + gui: Specify the default type of added item to correspond to the object that the cursor focused on
  + heartbeat: Remove one unlink() of the temporary hostcache file.
  + LF bug 1502: udpport statement in ha.cf is ignored by heartbeat - trivial fix
  + LF bug 1589: ia64 heartbeat unaligned access messages (SGI965396) - copy fields in structures - minor fix
  + LF bug 1679: hardcoded heartbeat userid and group in init script (minor fix)
  + LF bug 1681: BSC fails to to identify active interface on OpenBSD (minor change)
  + LF bug 1700: HA Signon always reports success - fix has minor scope.
  + LF bug 1702: during emergency restarts, heartbeat doesn't close watchdog correctly.  Fix is minor.
  + LF bug 1712: ha_logd prevented node from shutting down - changed code to use the waitout() primitive - scope fix - trivial-minor
  + LF bug 1731: wrong location of libraries for OpenBSD 64Bit architectures, with patch
  + LF bug 1734 - removed duplicate return statement as per bug report.
  + lrm stonith plugin: fix exit code handling
  + lrmd (LF 1715): increase the max dispatch time for lrmd
  + lrmd (LF 1729): revise return codes
  + Put in a missing include of <memory.h> for the DRBD code.  Change scope: trivial
  + RA: mysql, pgsql - use getent(1) instead of /etc/passwd (thanks to Raoul Bhatia)
  + RA: mysql: According to Geoff Harrison the sql check is broken without this
  + RA: mysql: Allow arbitrary commandline arguments for mysqld (by Raoul Bhatia)
  + RA: Raid1: Allow the homehost setting to be specified.
  + RA: Xinetd: Fix stop/monitor to not fail if service isn't available yet.
  + stonith/ibmrsa: allow ',' in the hostlist
  + STONITH: external/ssh: Disable StrictHostKeyChecking and PasswordAuthentication by default.
  + stonithd (LF 1714,1727): fix a race condition
  + stonithd (LF 1726): a hostlist may be empty
  + stonithd (LF 1727): change attach shmem seg to read only
  + stonithd/lib: replace cookie generation with uuid
  + stonithd: have -a really mean startup alone
  + stonithd: increase the maxdispatchtime
  + stonithd: library code review and cleanup
  + tools: Add hb_report - a reporting utility


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 2.1.2-4
  - Update the source tarball to revision 702e4f418ca8
  - Statistics:
      Changesets:       109
      Diff:             188 files changed, 5926 insertions(+), 2003 deletions(-)
  - Test hardware:
    + 4-node vmware cluster (sles10-sp1/256Mb) on a single host (opensuse10.2/2Gb/2.66Ghz Quad Core2)
    + 6-node EMC Centera cluster (sles10/512Mb/2Ghz Xeon)
  - Pending bugs encountered during testing:
    1377 - llm_get_nodename: index(1719751538) out of range
    1561 - Cluster node c001n03 returning after partition
    1562 - hostcache file rename error at startup
    1700 - HA Signon always reports success
    1711 - Shutdown blocked by call to cl_flush_logs()
    1712 - Shutdown blocked by ha_logd
    1714 - Stonithd core dumps
  - Changes since 2.1.2-2
  + High: Core: Prevent logging buffer overflow - ensure the entity is NULL terminated.  Patch from Simon Graham.
  + High: DTD: Remove stray character that made the DTD invalid
  + High: PE: Ensure mandatory ordering constraints behave correctly
  + High: PE: Implement a smarter algorithm for colocation
  + High: PE: Include preferences of colocated resources when promoting masters
  + High: PE: Make sure only the correct number of cloned groups are started
  + High: PE: Make sure the merge_weights function is called for complex resources
  + High: PE: More accurate method of detecting colocation loops in native_merge_weights
  + High: PE: Optimize the merge_weights functionfor groups
  + High: RA: Remove bashism from Filesystem OCF agent
  + High: RA: Filesystem - Fix path reference.
  + High: RA: o2cb - Fix path broken in recent cleanups
  + High: clplumbing: Use the correct environment variable when deciding to log via ha_logd
  + High: crmd: Tell the LRM to refresh the resource's default parameters
  + High: core: Bug 1697 - really remove proctrack sources (performance/memory leak fix)
  + High: core: An open call with the O_CREAT flag was missing the file mode.
  + Medium: Core: Ensure heartbeat flushes all its logs before exiting
  + Medium: ipc: Up MAXMSG to match MAXUNCOMPRESSED to allow larger clusters.
  + Medium: Logging: Sanitize and centrally define the log facility used by various subsystems
  + Medium: PE: Bug 1705 - Don't segfault when allocating empty groups
  + Medium: PE: Bug 1710 - A resource's failcount was ignored on nodes with no operations for the resource
  + Medium: PE: Enact a saner default for rsc_order.score (s/0/INFINITY)
  + Medium: RA: EvmsSCC - Handle start failures caused by peers starting at the same time (Patch from Jo De Baer)
  + Medium: RA: Treat migrating (status 1) as running to avoid - patch by Per Andreas Buer
  + Medium: Stonith: Remove code-reuse to prevent excessive logging by the LRM
  + Medium: Stonith: ipmilan: fix potential segvfault in options parsing
  + Medium: cib: Improved transparency when in operating in degraded mode
  + Low: Admin: Bug 1691 - crm_resource doesn't complain about empty strings as property values
  + Low: build: configure.in: fix for platforms with libc in /lib/tls
  + Low: CIB: Allow notification to remote clients
  + Low: CRM: DTD - Expand the list of accepted values for boolean fields
  + Low: CRM: DTD - Explicitly specify a default for rsc_colocation.symmetrical
  + Low: DTD: Include helpful comment for rsc_order constraints
  + Low: PE: Downgrade logging when we fallback to default option values
  + Low: PE: More efficient logging of orphan resources
  + Low: PE: Prevent users from trying to use on_fail=fence and stonith-enabled=false
  + Low: PE: Stop the master placement score from affecting the synapse's priority
  + Low: RA: Add a tomcat OCF agent from Yamauchi Hideo
  + Low: RA: ManageVE - Fix status when VE files are not persistent
  + Low: RA: Put in updates to the Informix script as supplied by Lars Forseth
  + Low: RA: apache - drop annoying messages if no configuration files are found
  + Low: Stonith: external/ssh - simplify the reset command and wait the same amount of time as the non-external variant
  + Low: Stonith: Disable ipmilan by default
  + Low: TE: Pause for a moment before trying to reconnect to stonithd
  + Low: Tools: Allow pingd to change identity based on the name of its executable - workaround for Bug #1701
  + Low: logd: Update the default config file to reflect the new default log facility
  + Low: tools: haresources2cib.py: update parameter lists and configuration defaults
  - Unclassified impact
  + lrm: Bug 1458 - include timing information in the op data.
  + lrm: Bug 1684 - a meta-data operation fix introducing short sleep on zero reads
  + lrm: log non-recurring operations
  + lrm: performance - replace linear with binary search for msg type.
  + lrm: performance - remove unnecessary memstat
  + lrm: raexecocf: a fix for bug introduced in 2a787bbd73f6; longer sleep in get_resource_meta
  + RA: Bug 1692 -  monitoring fails for apache OCF resource.  Put in simple fix to apache resource agent monitoring from Sebastian Reitenbach
  + RA: eDir88 - fix to allow meta-data to work in case NDS is not installed
  + RA: pgsql - patch to remove bashism
  + Stonith: Put in an APCmastersnmp.c patch from Peter Kruse which makes the plugin work with new APC master switches
  + Stonith: Bug 1615 - get the list of hosts from an RA asynchronously
  + mgmtd: allow old clients to connect


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 2.1.2-2
  - Update the source tarball to revision 098c0993b1d0
  - Statistics:
      Changesets:	6
      Diff:		11 files changed, 402 insertions(+), 46 deletions(-)
  - Changes since 2.1.2-1
  + High: clplumbing: Use the correct environment variable when deciding to log via ha_logd
  + High: PE: Bug 1682 - Prevent use-of-NULL when clones have no active children
  + High: TE: target_rc should default to 0 (LRM_OP_DONE) to detect monitor actions that fail the first time they are executed
  + Medium: PE: Bug 1685 - Supply the correct defaults for rsc_order constraints
  + Low: Admin: crmadmin - exit with rc=0 when the command completed successfully


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 2.1.2-1
  - Update the source tarball to revision 1ad8497bc55d
  - Statistics:
      Changesets:	340
      Diff:		614 files changed, 39588 insertions(+), 32588 deletions(-)
      ^ A large amount of dead code from Intel was removed
  - A full list of changes can be seen at
       http://hg.linux-ha.org/dev/shortlog/1ad8497bc55d
  - Mercurial users can obtain the full list by executing:
       hg log -M --template "{desc|firstline|strip} CS: {node|short}\n" -r e3c9306b9223:1ad8497bc55d | sort -f
  - Testing notes
  + On my underpowered cluster, the CCM borked a number of times on the Stonithd test
    However since the CCM hasn't been touched in an age, its hard to conclude there are regressions from previous releases.
    If anyone would like to volunteer to maintain the CCM (or the GUI for that matter), it would be much appreciated.
  - Changes since 2.1.2 (Upstream)
  + High: CRM: Update crm/cib feature sets and the set of tags/attributes used for feature set detection
  + High: CIB: Improved CCM interaction
  + High: CRM: filter_action_parameters() - Make a copy of interval/timeout in as they're about to be free'd
  + High: PE: Break graph loops involving stonith
  + High: PE: Only create _one_ pseudo op per name (all_stopped/stonith_up)
  + High: PE: The all_stopped action should only be part of the graph when the stop actions are runnable
  + High: PE: all_stopped should only depend on native resources to avoid recursion
  + High: PE: check_action_definition() - Ensure the meta attributes are also set so that the digest is calculated correctly (and consistently with the crmd)
  + High: PE: Use failcount to handle failed stops and starts (set default_resource_failure_stickiness > 0 for the old blocking behaviour)
  + High: TE: Allow reconnection to stonithd if it is respawned
  + High: TE: Allow the TE to reconnect if stonithd is killed and respawned
  + High: cib: Allow the CIB to reconnect if the CCM is killed and respawned
  + High: cib: Handle master updates that fail DTD validation
  + High: cib: Support the removal of multiple child objects - required for subsequent commit
  + High: crmd: Improvements to shutdown sequence (particularly in response to failures)
  + High: crmd: Sanitize the maintenance of node_state entries
  + High: crmd: Simplify node_state maintenance
  + High: stonithd: Sanitize the login/logout functions and add the ability to reset the callback IPC channel
  + Medium: cib: Ensure fflush() and fsync() are always called when writing XML digests to disk
  + Medium: crm: Ensure fflush() and fsync() are always called when writing XML to disk
  + Medium: crm: Bug 1680 - parse_xml() can fail to detect mismatching close tags
  + Medium: PE: Dont check the parameter digest of orphan operations
  + Medium: TE: Dont modify the failcount for 'pending' action updates (rc=-1)
  + Medium: admin: Set the exit code to non-zero if crmadmin can't connect to the crmd
  + Low: PE: Warn when multiple nodes have the same uname
  + Low: Stonith: New external plugin for handling 'APC Switched Rack PDU AP7952' devices - contributed by Sergey Maznichenko
  + Low: cib: Enhancements to logging of DTD errors
  + Low: cib: Refactor reading and writing of the CIB to disk
  + Low: crmd: Ensure our assumption that all resources have a class and type is true
  + Low: crmd: Simplify the detection of active actions and resources at shutdown
  + Low: Admin: Bug 1603 - Allow CIB digest files to be verified
  + debian: make heartbeat binNMU safe
  + stonith: ipmilan - accept documented auth and priv values
  + GUI: OSDL 1449 / Novell 291749: GUI should not overwrite more specific settings of contained resources.
  + RA: IPaddr2 - Make the check for the modprobe/iptables utilities conditional on the IP being cloned
  + RA: apache - make status quieter
  + RA: Added Informix resource agent
  + RA: eDir88 resource can't be stopped ?
  + RA: patch to fix bashism in a number of agents
  + Tools: OSDL Bug 1666: in BSC, make sure temp rsc dir exists for RAs
  + Tools: ocf-tester - use the default value for OCF_ROOT if it exists
  + Tools: ocf-tester - add capability to test with lrmadmin/lrmd
  - Changes since 2.1.0-2
  + A little cleanup to make the RAs more uniformly not have $OCF_ROOT paths in them
  + Added code to cause logging to be restarted if it dies.
  + Admin: Allow crm_diff to operate on compressed inputs
  + Admin: Bug #1621 - crm_mon should show failed starts of a resource
  + Admin: Bug 1632 - Make sure error messages regarding trailing XML input characters are seen
  + Admin: Bug 1635 - crm_failcount should not complain if the attribute was already deleted
  + Admin: Bug #1622 - crm_attribute: Include --inhibit-policy-engine in the help message
  + Admin: crm_resource - remove an overly simplistic check for when -C can safely be used
  + Admin: crmadmin - include Hg version in --version output
  + Admin: ptest is useful enough to warrent installation to sbindir
  + BSC: 'trap' had been continuing instead of exiting
  + Bug 1612: haresources2cib @substitution@ broken (probably by a global change)
  + Build: No longer generate RAs now that there is a sane way to set directory locations and find binaries
  + CIB: Bug 1602 - Archive invalid/unusable configurations so we can continue
  + CIB: Bug 1633 - Pass the actual error from activateCibXml back to the user
  + CIB: config_changed always needs to be calculated when processing write commands
  + CRM: Bug 1625 - Cannot update an operation's timeout
  + CRM: Clean up processes left over by crm_abort().  Initial patch by DAIKI MATSUDA
  + CRM: Fix compare_version() to actually work correctly on a regular basis (broken since 2.0.2)
  + CRM: Fix matching of objects with an ID when the match-spec has no ID
  + CRM: Make logging setup consistent and do not log the command-line to stderr.
  + CRM: Only detect timeout changes for recurring ops
  + CRM: Remove deBug code that should not have been committed
  + Corrected a typo which only matters on 32-bit machines :-(
  + Corrected so that on *BSD it passes in 2 parameters, instead of 2.
  + DTD: Add helpful comment regarding rsc_colocation objects
  + Fix location of pingd binary
  + Fixed a dangling reference to a former bin directory name.
  + Fixed a fairly-major error in IPaddr - it didn't handle CIDR netmasks correctly.  But ifconfig didn't complain either...
  + Fixed a minor stonithd testing error (not much of a Bug)
  + Fixed a syntax error in Filesystem:  missing then symbol
  + Hopefully fixed a long-time SNMP annoyance.  When the membership layer shuts down (as it does in BSC),
  + LF Bug # 1617 - Miscellaneous RPM and source cleanups
  + LF Bug # 1644 - Pinging loopback in BasicSanityCheck fails with EPERM
  + LF Bug # 960 - rpm: first-time install fails
  + LF Bug 1513 - building RPM from the 2.0.8 tarball fails
  + LF Bug 1527 - inappropriate warnings about core files logged by heartbeat (SGI961667)
  + LF Bug 1534 - compiling/installation error on OpenBSD
  + LF Bug 1576: shutdown hangs under certain shells // LF Bug 1534: compiling/installation error on OpenBSD
  + LF Bug 1654 - HA_SBIN_DIR is not set on ocf scripts
  + LF Bug - compiling/installation error on OpenBSD
  + LF Bug 1522: Strt hb_counter on time_t
  + LF Bug # 1534 - compiling/installation error on OpenBSD
  + LF Bug # 1645 - Minimize arch-dependent differences, maintain compatibility -- More on this Bug...
  + LF Bug # 1650 - heartbeat should put scripts/non arch specific things in /usr/share
  + LF Bug # 1661 - crm_verify aborts checking and reoccurring crm_abort errors in logs
  + LF Bug # 1661 - move symlink creation out of specfile and into Makefile
  + LF Bug 1650: heartbeat should put scripts/non arch specific things in /usr/share
  + LF Bug # 1645: Minimize arch-dependent differences, maintain compatibility
  + LF Bug 1650 - heartbeat should put scripts/non arch specific things in /usr/share
  + LF Bug 1665 - fix references to moved scripts - courtesy of Tuomo Soini
  + LRM plugins: skip dot-files.
  + Made the stonith -h core dump go away - by fixing a variety of small things in STONITH.
  + Minor patch to stonith patch - to keep empty result from being seen as out of memory
  + Misc: Move a few shell functions to the only script that uses them
  + More file location tweaks - mostly GUI-related.
  + OCF: Detect and warn of use of deprecated 'ocf-shellfuncs' and 'ocf-returncodes'.
  + OCF: Fixed the check in have_binary. Handle checks for programs with --arguments
  + OCF: Provide the location of /sbin as used by some agents (HA_SBIN_DIR)
  + OCF: Remove unused variables
  + OSDL Bug 1606: okay for stonith plugins to have no parameters
  + PE: Add regression test for previous commit
  + PE: Aggregate the startup of fencing resources into a stonith_up pseudo-action
  + PE: Bug 1628 - Complain about invalid operation intervals
  + PE: Correct the CRM_CHECK comparision
  + PE: Dont log stopped orphaned resources
  + PE: Fix the handling of remove-after-stop=true - it was causing unnecessary restarts
  + PE: Fix two small memory leaks detected by Valgrind
  + PE: Fix up the tests now that compare_version() functions correctly (as of cs: 7d69ef94a258)
  + PE: Handle two new actions in text2task
  + PE: Include description for the remove-after-stop option
  + PE: Make sure ptest always does a POSIX sort
  + PE: Move the creation of stonith shutdown constraints to native_internal_constraints()
  + PE: NoRoleChange shouldn't always call PromoteRsc for master resources
  + PE: Potential use of NULL
  + PE: Regression: Allow M/S resources to be promoted based solely on rsc_location constraints
  + PE: STONITH Shutdown ordering
  + PE: Streamline STONITH ordering. Make sure 'all_stopped' depends on all STONITH ops.
  + PE: Update one more regression test output now that it has been verified as still correct
  + PE: Update testcases to include all_stopped (added in cs: 800c2fec24ee)
  + PE: Use master scores to determine which clones to start where
  + Put deBug in in support of Bug 1154: 2.0.4 BSC failure - select() returns with error
  + Put in a change to allow CTS to run.  There is a sort-of-bug (in BSC/CTS) underlying this that I'll have to file a bug on.
  + RA: Add some extra variables dug out from configure
  + RA: Bug #1630 IPaddr2 - Wrong arguments passed to send_arp (test was mistakenly written as an assignment)
  + RA: Convert a number of checks for required binaries
  + RA: Delay (v1) - Remove extra characters from call to ra_execocf
  + RA: Dummy: Just add a comment to make sure people copying from this
  + RA: Filesystem: Unify coding style to match rest of script.
  + RA: IPaddr2 - Remove bash-isms
  + RA: IPaddr2 - handle IP_CIP not being defined
  + RA: IPaddr: Fix a few trivial bugs in lvs_support pointed out by Michael Stiller.
  + RA: LSBDummy - Make sure the action is passed to ra_execocf
  + RA: MailTo: Remove spurious warning about monitor.
  + RA: Move all remaining autoconf variables into common files that are automatically included
  + RA: Move some helper files to their new names (.files dont show up as RAs)
  + RA: Revised handling of directory locations
  + RA: ServeRAID - remove commented out code
  + RA: Use consistent check for required binaries
  + RA: o2cb: Improve configuration stability.
  + RA: o2cb: Optimize redistribution of cluster.cnf.
  + RA: prefer the 'test' program rather than the builtin for some reason
  + RA: v1: IPaddr: Unconditionally enabling LVS support is a mistake.
  + TE: Log the node's uname instead of UUID for completed actions
  + TE: Set failcount to INFINITY for resources that fail to start or stop
  + Tools: Bug 1653 - Further changes to prevent use of NULL when no attribute is specified
  + Tools: Bug 1653 - Misc attrd/attrd_updater cleanups suggested by Keisuke MORI
  + Tools: Bug 1653 - attrd crashes when no attribute is specified
  + debian: Add new dot-ocf files to the heartbeat package
  + debian: Add the ldirectord OCF resource to the ldirectord package
  + debian: Debian bug #432441 will be closed on the next upload
  + debian: Don't create hb_gui symlink
  + GUI: update path for png images in haclient.py
  + ldirectord: Use globals for service check return values
  + ldirectord: Add OCF wrapper
  + ldirectord: Add Oracle check
  + ldirectord: Add external check
  + ldirectord: Add forwarding mechanism to real server ID
  + ldirectord: Add ld_service_to_port()
  + ldirectord: Call ld_emailalert_send() with correct arguments
  + ldirectord: Clean up execute logic in check_sql
  + ldirectord: Cosmetic spelling and grammar fixes
  + ldirectord: Document expire_quiescent_template
  + ldirectord: Document that checktimeout is for ping checks too
  + ldirectord: Don't access CALLBACK unless it is defined
  + ldirectord: Don't die if Net::FTP times out
  + ldirectord: Enhance ftp check debugging
  + ldirectord: Enhance logging in service_set
  + ldirectord: Fix bogus detection of combined check
  + ldirectord: Fix logic bug in _status_down
  + ldirectord: Handle $dbh->prepare() failure in check_sql()
  + ldirectord: List checktype and service in alpabetical order in the documentation
  + ldirectord: Make check_sql < 80col wide
  + ldirectord: Make parsing of the output of ipvsadm more robust
  + ldirectord: Note negotiatetimeout in documentation of checkcount
  + ldirectord: Port of last resort for real server checks
  + ldirectord: Remove connecttimeout
  + ldirectord: Remove stale entries on reload
  + ldirectord: Remove trim down very wordy decripton of read_config
  + ldirectord: Set default negotiatetimeout to 30s
  + ldirectord: Status to stdout
  + ldirectord: Tidy up fallback
  + ldirectord: Use $dbh->errstr instead of $dbh->err when logging
  + ldirectord: Use an alarm for HTTPS timeouts
  + ldirectord: Use goto for error handling in check_sql
  + ldirectord: Use negotiatetimeout and connecttimeout as mutual defaults
  + ldirectord: Use negotiatetimeout for SIP, DNS and Radius checks
  + ldirectord: Use valid string in log message in check_connect()
  + ldirectord: document port behaviour of real servers
  + ldirectord: rearange parsing of service to make it <= 80col (more often)
  + build: Move ldirector OCF resource into the ldirectord package
  + apache RA (LF 1656): include ServerRoot in relative paths.
  + cib: Fix detection of non-status changes
  + configure: Remove unneeded AC_PATH_PROGS checks
  + crmd: Bug 1575 - crmd cannot exit if lrmd is killed and there are pending ops
  + crmd: Bug 1624 - Fix the delete op for cancelled operations
  + crmd: Bug 1655 - crmd can't exit when the PE or TE is killed from underneath it
  + crmd: Only remap monitor operation status to LRM_OP_DONE under the correct conditions
  + log: avoid handing a null pointer as a '%s' variable
  + pingd: Hard code the name used for logging
  + re-enabled code to make symlinks for moved files.
  + remove is_stable() condition from drbd-outdate-peer daemon
  + shellfuncs: 's%:.:%%' should be 's%:.:%:%'; the '.' should be '\.'
  + stonith: external/riloe - new comment in the xml on how acpid may affect the performance (thanks to Guy Coates).
  + stonith: riloe - fix the xml info.
  + stonith: ibmrsa - fix the xml info.
  + stonith: ibmrsa - allow regular users to use it with 'stonith -n' and similar.


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 2.1.0-2
  - Update the source tarball to revision e3c9306b9223
  - Statistics:
      Changesets:	259
      Diff:		625 files changed, 13133 insertions(+), 73569^ deletions(-)
      ^ A large amount of dead code from Intel was removed
  - A full list of changes can be seen at
       http://hg.linux-ha.org/dev/shortlog/e3c9306b9223
  - Mercurial users can obtain the full list by executing:
       hg log -M --template "{desc|firstline|strip} CS: {node|short}\n" -rSTABLE-2.1.0:e3c9306b9223 | sort -f


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 2.1.0-1
  - Update debian packaging files which drop the -2 package suffix
  - Change the version number to the one used upstream


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 2.0.9-2
  - Sync with the version supplied in SLES10
  - Bugs fixed
  + OSDL #393 - Stonith: Update plugin from OpenHPI 2.2 to OpenHPI 2.6
  + OSDL #393 - Stonith: soft_reset is {true|1|false|0}, not {yes|no}
  + OSDL #393 - Stonith: Rename ibmbc to bladehpi
  + OSDL #393 - Stonith: Enable build of bladehpi plugin if OpenHPI present
  + OSDL #761 - RA: Remove history from heartbeat init script.
  + OSDL #1073 - Tools: Add clone support to crm_resource
  + OSDL #1138 - Long delay before CCM propagates membership event
  + OSDL #1292 - Stonith: Support xSeries STONITH (IBM: 06-R212-175)
  + OSDL #1339 - IPC code limits possible cluster size
  + OSDL #1374 - Tools: Check for sane host names when migrating
  + OSDL #1428 - Stonith: Mixing definitions and code
  + OSDL #1430 - CIB: Allow automatic assignment of object IDs
  + OSDL #1451 - Tools: Allow resource meta attributes to be set with crm_admin
  + OSDL #1457 - RA: Resolve unknown command ha_log
  + OSDL #1462 - Tools: crm_migrate should allow creating temporary rules
  + OSDL #1465 - crmd: crmd gets stuck if shutdown while starting up
  + OSDL #1472 - CIB: Use-after-free in find_attr_details()
  + OSDL #1480 - CIB: Create synchronous r/w connections correctly
  + OSDL #1482 - Stonith: stonith command needs a repeat option to make it a better test tool
  + OSDL #1484 - PE: Repair on_fail=stop.  Patch courtesy of YAMAMOTO Takashi.
  + OSDL #1486 - PE: Fix for potential NULL dereference
  + OSDL #1488 - Stonith: Fix passing password to HMC
  + OSDL #1489 - Stonith: Fix HMC errors in hostlist
  + OSDL #1492 - PE: Set common resource attributes before calling the custom unpack function
  + OSDL #1494 - PE: Add node->score to the clone stability function
  + OSDL #1499 - PE: Perform #uname comparisions without case
  + OSDL #1500 - Tools: Calls to attrd_updater with dampen=0 not processed correctly
  + OSDL #1505 - Findif parsing is all screwed up unless all the parameters are passed, not defaulted.
  + OSDL #1506 - Stonith: Add optional ibmhmc plugin parameters to meta-data
  + OSDL #1507 - Stonith: Allow "stonith -h" to display help for specific device
  + OSDL #1511 - LRM: running two actions for the same resource parallel
  + OSDL #1514 - CRM: Empty values in cib.xml loses other RA parameters
  + OSDL #1523 - Stonith: bladehpi performance enhancements
  + OSDL #1528 - RA: IPaddr2 gives a spurious warning on stop (SGI961736)
  + OSDL #1532 - crmd: Single node cluster shutdown
  + OSDL #1554 - PE: Probes should not have priority INFINITY
  + OSDL #1534 - LRM: Compiliation error on OpenBSD
  + OSDL #1544 - Comms: mixed versions of 2.x and 1.x not working
  + OSDL #1545 - Stonith: stonithd signoff fixesO
  + OSDL #1548 - logging: Ensure logs are logged using the correct component name
  + OSDL #1550 - Stonith: Suicide plugin returns hostlist containing itself
  + OSDL #1553 - Stonith: suicide plugin lacking ST_DEVICENAME
  + OSDL #1554 - crmd: Wait for the membership to stabilize before starting transitions to prevent unconfirmed actions
  + Debian #420206 - RA: Bashisms in IPaddr2
  + Novell #239075 - Admin: crm_master uses the same IDs for permanent and transient attributes
  + Novell #239079 - PE: Ensure action priority is set correctly to ensure notifcations are not lost
  + Novell #239082 - PE: Order promotions after _all_ demotions have completed
  + Novell #239086 - PE: Stable Master placement
  + Novell #244444 - crmd: Free'ing g_alloc() data with cl_free()
  + Novell #246681 - PE: Teach NoRoleChange() how to migrate resource's in the master role
  + Novell #250207 - Split-brain caused by non-identical ping-node configuration and auto-join
  + Novell #250273 - RA: Provide an RA for managing evmsd as a resource
  + Novell #250625 - RA: Xen: Fix status function for newer Xen versions
  + Novell #251689 - PE: Avoid needlessly restarting changed monitor operations for stopping resources
  + Novell #252693 - PE: Enable migration in more scenarios
  + Novell #252693 - PE: Teach the PE how to migrate resources in a starting stack
  + Novell #266551 - Stonith: getconfignames returned hostname instead of hostlist
  + Novell #266551 - doc: Bring the stonith man page up-to-date
  - Build Improvements
  + Add explanatory comment for configure kludge
  + Add lha_internal to c-files that dont include it
  + Allow debian packages to also be built directly from Hg archives
  + Always check for the presence of PAM an TLS headers
  + Configure switch to easily enable Valgrind'ing of the CRM
  + Dont install crm-related man pages when --disable-crm is used
  + dopd doesnt build without the crm, disable it if the crm is disabled
  + Fix typo in configure.in
  + Header-file related cleanup
  + Include the exact version being built even when building an archived tree
  + Make supplying a Valgrind suppression file simpler
  + Misc changes to allow building with crm disabled
  + Not all platforms need -lpam
  + Remove redundant and useless items from the build
  + removed unused library dependancies
  + Use existing accounts when building on OSX
  + debian: correct the location of stonith headers in *.files
  + debian: reflect the new header locations in .files
  + debian: sort out a kink in the configure vs. bootstrap logic
  + debian: Packaging updates for 2.0.8-1 release
  + debian: Add heartbeat-2-gui package control files to Makefile
  + Improved grammar in gui package description
  + Improve portability across versions of 'gcc'.
  + Allow data size to be specified
  + Ensure 'awk' is found in runtime environment
  + Use centrally determined GNUTLS cflags and libs
  + Replace multiple derivations (poor) of locations with direct derivation from configure
  + configure: Add closing information to user about '/etc/passwd' and 'make install'
  + Remove an unnecessary 'include' that broke building on some OSes.  It continues to build OK on various OSes.
  + Bourne shell 'test' does not support '-e' flag.  Using '-r' instead.
  + libgnutls: if no 'libgnutls-config', try 'AC_CHECK_LIB(...)'
  + Determine GNUTLS libs centrally in 'configure.in' rather than in individual Makefiles
  + Correct omission of <lha_internal.h>
  + ipctransient tests: Add some flexibility; rationalise some duplicate code
  + ConfigureMe: make usage info a little clearer
  + Add some defaults to configure.in to reduce buildrequires.
  + Remove a bunch of dead code (Perl/SWIG bindings).
  + configure: Check for more pre-requisites of the mgmt/quorum components.
  + Fix use of a future dates in the changelog
  - CRM Library Enhancements and Fixes
  + Fix xml parser bug.
  + Allow retrieval of default config values without a hashtable
  + Changes to fake transition key generation
  + Check the return code from fflush() when writing xml files - AnÃÂ­bal Monsalve Salazar
  + Comprehensive review of error recovery logic for potentially failed calls to fopen()
  + Correctly handle syslog facility == 0
  + Delete dead code, make empty_uuid_cache() safe with NULLs
  + Dont call fflush() or flclose() if the output stream was NULL
  + Ensure the normalized result of (add|subtract)_time is updated before returning
  + Fix a use-after-free in parse_time_duration()
  + Fix replace_xml_child() when neither child nor update have an id
  + Fixes for Coverty issues: 52, 55-58, 61-66, 68-69, 71-73 in run 240
  + Gracefully fail when the target XML file is not writable
  + handle NULL inputs to xml_has_children() gracefully
  + Make the use of valgrind a run-time option
  + Memory leak fixes
  + Prevent a number of potential use-after-free's by zero'ing out free'd loop variables
  + Refactor date printing to allow date -> string conversion
  + Remove noisy and inaccurate memory logging
  + Repair the status_printw macro now that we do logging slightly differently
  + size_t is always positive... broke error handling in XML parser.
  + Use-of-NULL in validate_with_dtd() error path... Only clean up what we created
  + When malloc tracking is enabled, pass through the person that called crm_strdup
  - CLI Enhancements and Fixes
  + Uninitialized string in heartbeat/findif.c
  + Allow cluster config options to be queried/modified/deleted.  Broken in cs: 13c450735ba7
  + Allow crm_verify to be used with a named DTD file
  + Auto populate the provider for OCF resources if one is not provided
  + crm_primitive.py: Include all node preferences in the one rsc_location constraint
  + Include rsc_location details in the resource listing
  + map cib_NOTEXISTS to 0 for crm_failcount
  + Use the current node uname by default when invoked as crm_standby
  + Add two new views to crm_mon.  Patch by Christofer Edvardsen.
  + Centrally define CIB call options so that -f always works in crm_resource
  + Compile when malloc checking is off, fix last mem leak
  + crm_verify - dont complain about missing status section
  + Dont do ID checks on cibadmin diff's, duplicates are expected
  + Fix a number of memory leaks in attrd
  + Help text and input sanity checks for ocf-tester
  + Include class/type/provider in resource delete commands
  + Place the lifetime rule in the correct location
  + Set a slightly higher default action timeout
  + Show help text for crm_uuid
  + Teach crm_uuid to write ascii-form UUIDs to hb_uuid
  + Terminate the attrd process if heartbeat exits from under it
  + lrmadmin: fix the provider list function: first free data and then the list member.
  + crm_attribute/master/standby: Always default the uname to the current machine
  - CIB Enhancements and Fixes
  + Allow cluster options to be created when the default set is not present
  + Allow the remote connection code to be used with or without PAM/TLS
  + Clean up memory at exit
  + Fix a number of memory leaks
  + Compile when malloc tracking is enabled
  + Don't increase the version number if nothing changed
  + Dont examine the group ownership of cib.xml since we set perms to rw-------
  + Exit the writer process correctly so we'll continue to do write outs
  + Prevent node_uuid from having any effect for <crm_config> changes
  + Remove dead code
  + Support processing of commands sent via remote TLS connections.
    See http://www.linux-ha.org/v2/cib_remote for usage details
  + The decision to log failed connection attempts should be left to the client
  + Warn at startup if important version information is missing
  - CRMD Enhancements and Fixes
  + ALL completed actions should be removed from the shutdown_list
  + Correctly parse the shutdown timer option
  + Create the restart digest from an object with the same name that the PE uses
  + Delete the HA connection only at exit
  + Enable Valrind'ing of the PE and TE
  + Indicate the LRM error code if an operation cannot be cancelled
  + No need to create the resource if we're trying to delete it
  + Free memory at shutdown
  + Resolve a number of memory leaks
  + Sort out the whole client deletion business.  Also delete the resources hash at shutdown.
  + Improved Logging
  + Remove dead code
  - Policy Engine Enhancements and Fixes
  + Always print the resource's node scores
  + Avoid a potential NULL dereference in an error path
  + Clean up generation of and contents of dot-files
  + Create an implicit "cant run here" constraint if an action returns "not installed"
  + Don't start resources until we can verify they're not still running
  + Dont waste time checking action definitions on nodes that wont be running resources
  + Fix a use-after-free of {key} when the monitor op already existed
  + Fix anti-colocation when the RHS is not running
  + Fix gcc warning - dont ignore the result of mktemp()
  + Fix group recovery when a group it depends on is restarted
  + Have group-group recovery work for the right reasons
  + Memory leak fixes
  + Make clones ever so slightly sticky by default
  + Make internal group ordering of bullet-proof
  + Make sure things that shouldn't be true are never true (added asserts)
  + Move DeleteRsc to a more appropriate location
  + Move Ncurses related defines to a more optimal location and make sure its included by crm_mon
  + Not all pseudo operations should be included in the graph
  + Only show elements of the graph in the dot-file by default
  + Prevent a potential NULL deference in clone allocation
  + Provide useful feedback when a cloned resource is found active somewhere it shouldn't be
  + Re-use StartRsc/StopRsc for consistancy
  + Rename elements of the pe_ordering enum for clarity
  + Rename migration variables for clarity
  + Updated regression tests with the revised consistant format
  + Utility functions for finding node's by uuid/uname
  - Transitioner Enhancements and Fixes
  + Clean up memory on exit
  + Detect changes to attributes of the cib object
  + Only a limited number of cib attributes warrent aborting the transition
  + Unpack graph actions correctly
  + Improved logging
  + Removed dead code
  - Misc
  + Allow heartbeat to easily run with standard libc malloc-and-friends
  + Allow the malloc tracking code to compile on systems where size_t != int
  + Allow writing to syslog to be turned off
  + Better information about valgrind enablement
  + Sanitize the "crm xyz" option processing.  Dont run valgrind if not using libc malloc
  + The DTD used "integer" instead of "number" (which was used by the code)
  + Stonith: Update the rilo RA with enhacements from Tijl Van den broeck and Guy Coates
  + Moved drbd peer outdater into contrib/
  + clplumbing: We _never_ want to trim memory, use -1 instead of 4*size.
  + clplumbing: Coverity 53: Potential NULL pointer dereference.
  + mgmtd: Certain versions of SWIG do not convert the Python "None" to a
  + initscript: set correct Provides: and Should-Start: entries
  + Stonithd: Relaxed a stonithd timeout so that start will succeed if it completes in a minute
  + Dont log dispatch warnings unless they exceed 30ms instead of 10ms
  - LRM Enhancements and Fixes
  + Inform clients when an RA is not installed on the machine
  + Expanded regression testing
  + convert the LSB meta-data to XML.
  - Resource Agent Enhancements and Fixes
  + -eq is for integer comparisions
  + Avoid concatination with None in riloe stonith agent
  + Filesystem - When checking ocfs2 is cloned, look for variables that are always set
  + Fix up the Dummy metadata
  + Fix variable initialization in pgsql
  + LVS support should always be enabled for the heartbeat IPaddr wrapper
  + Modify the Xen RA to use the new variable names
  + Return after performing a stop action in the Filesystem agent
  + Use configured scratch locations in ibmrsa stonith agent
  + bladehpi readme update
  + Dummy, mysql and drbd - fix meta-data to conform to XML.
  + Convert SAP* from dos
  + Allow ManageRAID to show meta-data at all times.
  + Enhance Pgsql ocf resource to handle multiple instances
  + Xen: Add a little reminder to the code.
  + drbd: Fix some issues and work-arounds for drbdadm bugs.
  + Filesystem: Prune duplicates from active and starting list.
  + Filesystem: Fix metadata require/unique settings.
  + Xen: Fix status function for newer Xen versions (Novell 250625)
  + Filesystem: Increase default suggested timeouts.
  + drbd: When using the nodename-override, drbdadm likes to print an
  + Xen: Swap migrate_to and _from to match PE.
  + Filesystem: Harmless typo corrected.
  + LVM: Add some hints for future todo items.
  + EvmsSCC: More fixes from Jo (Novell 199730)
  + Filesystem: Move ocfs2_init out of the generic stop path (Novell 250603).
  + pgsql: Several enhancements to by Keisuke MORI
  + drbd: Make parsing of drbdadm output more robust.
  + drbd: If drbd is stopped, demote should fail with NOT_RUNNING.
  + Xen: Advertise migrate_from and _to actions. Mention migrate in meta-data.
  + drbd: Add support for overriding the hostname drbd uses based on the clone
  + Filesystem: Whitespace cleanup and minor fixes ("" for -z arguments, using -ne when
  + IPsrcaddr: Added count of how many inet lines to use for the diff -B
  + external/riloe misspelled RI_LOGIN variable name.
  - ldirectord Enhancements and Fixes
  + Use $arrayOfDNs[0] instead of @arrayOfDNs[0] to get rid of the following
  + Remove duplicate $recstr
  + Change the code around a bit to avoid a warning about code following exec
  + Dont use SIGENT, as it doesn't seem to exist.
  + 92d4e521db53 Handle $line more carefully
  + Make sure that frequency is intialised before it is used
  + Use $$ instead of (the uninitialised) $pid
  + Remove useless calls to lc()
  + Make sure that DEBUG is initialised
  + Use implicit variables in read_config()
  + Use the -w flag to perl to find warnings/errors
  + Make ldirectord's version valid
  + If weight is not supplied, set it to 1
  + Fix broken reload command
  - Testing Improvements
  + Account for a small timing window in the ResourceRecover test
  + Explain why we're aborting when nodes aren't found in DNS
  + Ignore ResourceRecover testing artifacts
  + Indicate debug log messages
  + Improved Logging
  + Remove resource tied to the DC - the #is_dc comparision is irrelevant
  + Rewrite the LSBDummy RA
  + Rewrite the ResourceRecover to use asynchronous failures
  + BSC: (1) test IPC before its dependencies; (2) signal-handling: improve and catch some more.
  + ocf-tester: Continue if validate-all succeeds.
  + ocf-tester: Exit with appropriate exit code for success or failure.
  + ocf-tester: Various integers were compared as strings.
  + BSC: Test Dummy, IPaddr, IPaddr2, Filesystem RAs.
  + BSC: Skip IPaddr2 test if ip not installed.


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.8-1
  - New Upstream
  + Allow colocation based on node attributes other than #id
  + SAPDatabase and SAPInstance resource agents added.
  + Core/CRM: Improvements to the memory allocation, message, and string
    handling libraries result in an overall speed-up of 65%.
  + CRM: Fix ISO date handling for Jan 01 of any year.
  + CRM: Only update the voted hashtable with no-votes for the current
    election.
  + RA: IPaddr: Support netmask both in CIDR and in dotted-quad notation.
  + logd: Fix trailing random byte in log messages (OSDL 1268).
  + heartbeat:  Work around a glibc/times() bug to prevent failures every
    497 days on 32-bit Linux (OSDL 1407).
  + heartbeat: Retransmits were requested more often than they'd be
    honored (OSDL 1455).
  + CTS/PE: Introduce CRM option "startup_fencing" to disable fencing of
    unseen nodes, because CTS can't handle this.
  + PE: Split-off "network-delay" option from global_timeout to separate
    network delays from action timeouts.
  + PE/CRM: Binaries now support being called with "metadata" command to
    document the complete list of options in the CIB.
  + PE: DTD: Include start_delay as a property of operation objects.
  + PE: Fix implementation of date_spec when no range is specified.
  + PE: Enforce clone_node_max for already running resources.
  + PE: Clones were not being stopped on node shutdown.
  + PE: Allow resource colocation based on node attributes other than #id
    (node_attribute option added to rsc_colocation constraint).
  + PE: Improved handling when timeout < start_delay (OSDL 1421).
  + PE: Pre-notifications for promote occured before start was completed
    (OSDL 1447).
  + PE: Allow any two pairs of actions to be specified for rsc_order (OSDL
    1452).
  + PE: Handle asymmetric clusters where RAs are not installed on all
    nodes.
  + PE: Allow resource stickiness and failure stickiness to change based
    on node attributes.
  + CIB: Fix update_attr() causes attrd to hang at shutdown when there is
    no DC (OSDL 1432).
  + CIB: Corrupted config file prevents heartbeat restart (OSDL 1385).
  + CIB: Startup processing improvements; DTD validation will be
    automatically activated if the CIB on-disk validates.
  + TE: Fix memory leak.
  + TE: Failcount wasn't being updated in all cases.
  + TE: never update the CIB with unconfirmed stop actions (OSDL 1435).
  + CTS/RA: Replace OCFMSDummy with Stateful RA.
  + CCM: Centralize quorum calculation on the transition leader.
  + CCM: Support split-site and external quorum servers.
  + CRM: Ignore status update for non-members (ie, ping nodes).
  + LRM: Don't postpone postponed resources.
  + LRM: Fix restart in case an lrmd is already running (OSDL 1333).
  + LRM: Fix overflow in RA output handling (OSDL 1433).
  + mgmtd: Robustness and memory leak fixes.
  + mgmtd: make the port used configurable (OSDL 1390).
  + haresources2cib.py: Improve v1 to v2 conversion tool (OSDL 1415).
  + GUI: ping nodes appear as failed in gui (OSDL 1394).
  + GUI: Reduce duplicates in RA list by only showing the OCF one if both
    ocf and hb RA exist) (OSDL 1338).
  + GUI: Add new resource to currently selected group (OSDL 1414).
  + GUI: support all attributes of operations (OSDL 1372).
  + GUI: Create first resource along with a new group; delete group when
    last resource is removed (OSDL 1287).
  + GUI: Set defaults for clones and m/s RAs (OSDL 1352).
  + GUI: Use meta-data defaults when creating actions (OSDL 1351).
  + GUI: GUI: start all sub resources when we start a group or a clone
    (OSDL 1449).
  + GUI: support ordered==false or non-collocated==false groups (OSDL
    1257).
  + stonithd: Fix memory leak.
  + stonithd: Remove reliance on farside_pid (OSDL 1412).
  + stonith external/riloe: Make the login name and iLo device address
    configurable.
  + crm_resource: Add manpage.
  + RA: PureFTPd, mysql, ManageVE (to manage an OpenVZ container),
    ManageRAID, WAS6 (Websphere 6) added.
  + RA: Include SAPInstance and SAPDatabase (FATE 2172).
  + RA: IPaddr cleanup to avoid race conditions in the script. Report
    status failure when an IPaddr is active on a different interface but
    allow it to be stopped.
  + RA: IPaddr2 fixes for loopback bound addresses.
  + RA: Filesystem reported wrong status/monitor results for OCFS2 in some
    circumstances (Novell 187080).
  + RA: Improve heartbeat v1 wrappers.
  + RA: Fix db2 monitor operation.
  + RA: ldirectord: Make the emailalert and emailalertfreq options global
    as well as non-global, make checkcount global as well as per-virtual,
    add radius check, improvements to documentation.
  + RA: pgsql: Make server logfile configurable and implement
    validate-all. New parameter ctl_opt added to pgsql to support
    additional options for pg_ctl.
  + CRM: First beginnings of a cluster-wide shell (FATE ...)
  + BEAM / Coverity induced fixes.
  + Minor compatibility fixes (OSDL 1405).
  + Logging improvements all over the place.
  + Extended support for master-slave resources (FATE 300723).
  + OCF RA API compliance checker (FATE 300737).
  + Support weak and uni-directional collocation constraints (FATE
    300792).
  + Many bugfixes.
  - errata: CVE-2006-3121 was incorrectly refered to as CVE-2006-3821 in
    the changelog for 2.0.6-2 and 2.0.7-1
  - Dropped the following patches as they are now upstream
    - ldirectord-1.141-emailalert-2-global.patch (introduced in 2.0.6-2)
  - Remove alternate dependancy on netkit-ping as it is being removed
    from Debian


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.7-2
  - Add dependancy and build dependancy on psmisc for fuser
    Thanks to Hans-Joachim Baader
  - Acknowldge NMU by Roger Leigh


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.7-1
  - New Upstream
   - Remote Denial of Service attack (#195068, CVE-2006-3121).
   - Bugfixes to the CRM, the LRM and the GUI.
   - GUI failed to connect to and retrieve data from the cluster (#198747).
   - Improved log messages.
   - ptest can now read compressed XML directly. Do not include optional
     actions and dependancies in ptest output by default.
   - crm_resource will now warn and demand exact specification when trying
     to modify an attribute while several sets are present.
   - lrmd now limits itself to a maximum of 4 child processes, to avoid
     overloading the node and causing too long delays.
   - pengine: Processing of pending probes; should not be treated as if the
     resource is running or in a known state.
   - target_role now is only taken into account for managed resources.
   - cib: Detect more cases where the nodes section needs to be refreshed.
   - More accurately determine node status. (OSDL 1369)
   - Filter out stop requests that would require a resource to be added.
     (OSDL 1369)
   - Send filtered resource "stops" as successes as to not block waiting
     for filtered actions.
   - By default pass the TE graph via IPC until its too large for IPC to
     deal with, only then fall back to passing via the disk.
   - Stopping of stonith resources can never require stonith, even if the
     node its running on failed; prevent graph loop. (OSDL 1376)
   - STONITH events need to inputs to start events (not stops), to avoid
     graph loop in combination with "stop before" dependencies (ie,
     groups).
   - crmd: Dont stall the FSA if we try to invoke the TE after we've
     stopped it.
   - Always unpack the correct part of a diff operation; diffs should now
     apply in more cases, reducing the need for full refreshs.
   - Correctly observe --disable-snmp-subagent during build.
   - In some states the membership is invalid and shouldn't be referenced.
     (OSDL 1377)
   - Fix a use-before-null-check issue in lrmd. (Coverity #48)
   - OCF Resource Agents outside the default path were incorrectly found to
     be not executable.
   - ccm: hostcache and delnodecache files should not be authoritative if
     autojoin is disabled. (OSDL 1226)
   - With autojoin, llm_get_nodecount() can't return the real max nodes
     anymore, this may cause memory corruption. (OSDL 1382)
   - Fix a memory corruption in membership layer, more frequently observed
     with larger (>5) clusters.
   - Change the default api-auth for pingd to uid=root
   - Dummy RA now OCF compliant.
   - Fix pingd RA metadata to be XML compliant.
  - Dropped the following patches as they are now upstream
    - ldirectord-1.141-emailalert-1-quiet.patch  (introduced in 2.0.6-2)
    - ldirectord-1.141-readline_workaround.patch (introduced in 2.0.6-2)
    - CVE-2006-3821.patch                        (introduced in 2.0.6-2)


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.6-2
  - ldirectord-1.141-emailalert-1-quiet.patch
    Don't send email alerts if the alert address is not configured
  - ldirectord-1.141-emailalert-2-global.patch
    Allow emailalert and emailalertfreq directives to be global
    as well as per-virtual service
  - ldirectord-1.141-readline_workaround.patch
    readline doesn't seem to return lines after Net::FTP
    has been called, so split them up by hand.
  - Added recommends iptables to heartbeat, as it is needed
    for the portblock resource to function correctly
  - Added /var/lib/heartbeat/pengine directory
  - Replace 02-chown-check.patch with chown-check-2.patch
    - use the environement variable FAKED_MODE instead of FAKEROOTKEY to check
      if code is runing in fakeroot. At some stage around fakeroot 1.5.10
      FAKEROOTKEY disapeared. Ran autoconf manually to effect this change
      after repatching.
    - Updated 02-chown-check.patch: fix typos in comment
  - CVE-2006-3821.patch
    Fix remote denial of causes caused by insufficient bounds checking
    on data read from the network.
    CVE-2006-3821
  - Python transition - http://wiki.debian.org/DebianPython/NewPolicy
    - Update build dependancy on debhelper from (>= 4.0.0) to (>= 5.0.37.2)
    - Add dh_python call to debian/rules
    - created debian/pycompat with contents of "2"
    - heartebeat: deplaced depenancy on python with one on ${python:Depends}
    - Added XB-Python-Version: ${python:Versions} to each package
    - Replace build dependancy on python2.3-dev with one on python-dev
    - Use python-central
      + Add build depends on python-central (>= 0.5)
      + Add dh_pycentral call right before dh_python in debian/rules
      + Add XS-Python-Version: current in the source stanza of debian/control


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.5-8
  - ldirectord-2: Add missing dependancy on libmailtools-perl
                  (Mail::Send)
  - ldirectord-2: Add missing dependancy on libnet-perl
                  (Net::SMTP, Net::FTP, Net::POP3)
  - ldirectord-2: Remove unneccesary dependancy on adduser
  - Automake transition: http://wiki.debian.org/AutomakeTransition
    - Remove unneccesary build-depends on automake1.9 | automaken
    - Remove unneccesary build-conflicts on automake1.4


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.5-7
  - Don't run deluser and delgroup in postrm
    - These commands may not be available at this time
    - If there are any files left that belong to this user or group
      then they will be left unowned and get inhereited by the
      next user that comes along that happens to have hacluster's
      old userid or the old haclient groupid respectively.


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.5-5
  - Reverse the change made in 2.0.5-4
    It turns out that in heartbeat (as opposed to heartbeat)
    is a script which calls a binary that is located in
    /usr/lib/ocf/resource.d/heartbeat/


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.5-4
  - Move IPv6addr from /etc/ha.d/resource.d/ into /usr/lib/heartbeat,
    and then symlink that back into /etc/ha.d/resource.d/ as binaries
    are not allowed in /etc


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.5-3
  - Fix libgnutls binary dependancy
    - Build-Depends on libgnutls-dev instead of libgnutls13-dev
    - Recompile against libgnutls13 in place of libgnutls11
    -


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.5-1
  - New Upstream
  - Removed build depenancy on openssl-devel,
    as heartbeat no longer uses openssl directly.
    (Libraries that heartbeat depends on may in turn
     depend on openssl creating an indirect depenancy
     or build-dependancy).


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.3-2
  - Add build dependancy on libncurses-dev to allow crm_mon to work
    Thanks to Guy Coates
  - Move hacluster user and haclient group creation (don't ask me why the
    user and group names are different) from preinst to postinst.
    Once upon a time there might have been a need for it in preinst,
    but the current packaging changes files to have the hacluster user
    and haclient group as neccessary in the postinst. So there is
    no need to create them before postinst.
    This is a better fix to #352158, and the pre-depends on adduser
    has been changed to a depends accordingly.
  - Stop heartbeat in preinst


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.3-1
  - New Upstream
  - Make sure adduser is passed the --system flag
  - Slightly Enhanced package descriptions
  - Add build dependancy on swig
  - As PYTHON_PATH has been added to configure.in it seems that autoconf1.4
    can no longer build this tree.  Currently autoconf is provided by
    autoconf1.4, and autoconfn is a virtual package provided by autoconf1.7,
    1.8 and 1.9.  Accordingly, replace the autoconf build dependancy with
    autoconf1.9 | autoconfn.  And add a build conflict on autoconf1.4. This
    way the autoconf command should be autoconf1.7, 1.8 or 1.9, but not 1.4
    as was previously the case.
  - Don't apply 00-ssh_scp_path.patch as it should no longer be needed,
    instead add a build dependancy on openssh-client.
    Also removed call to relevant configure options.
  - Removed configure option that no longer exists
    --enable-checkpointd
  - Removed configure options that are now on by default
    --enable-crm --enable-lrm
  - Add build dependancy on libgnutls11-dev, as 1.0 probably doesn't
    compile as _t types don't exist.
    http://lists.gnu.org/archive/html/help-gnutls/2004-08/msg00001.html
  - Fix insonsistency between hb_stanby(1) man page, an the wiki
  - Make /usr/bin/cl_status setgid
  - Make sure that /var/run/heartbeat/{ccm,crm} exist on install
    else postinst, and thus the install will abort.
  - Fix inconsistency between hb_standb(1) man page and wiki
  - Add Pre-Depends on adduser
  - Add management tool
    ./confgure --enable-mgmt
    Build-Depends: python2.3-dev, libpam0g-dev


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.2-3
  - Get rid of bogus touching of config.status and friends in clean target,
    which if run as root causes build failures.


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.1-4
  - Add /var/run/heartbeat directory to package
    http://www.osdl.org/developer_bugzilla/show_bug.cgi?id=900


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.1-3
  - Restrurctured  provides, conflicts and replaces
  - Made heartbeat-dev depend on heartbeat, not heartbeat


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.1-2
  - Uptream initally made the wrong tar ball avaliable for
    2.0.1 and this was used to build 2.0.1-1.
    I have asked 2.0.1-1 not to be accepted into the Debian Archive
    for this reason. 2.0.1-2 uses the updated, correct tarball from
    upstream.
  - Note that this package has a binary dependancy on libssl
    only because of linking against libsnmp9 (5.2.1.2-3)
  - Add build dependancy on libsensors-dev (for libsnmp9)


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.1-1
  - New upstream
  - Add /var/lib/heartbeat/cores/root, /var/lib/heartbeat/cores/hacluster
    and /var/lib/heartbeat/cores/nobody
  - Remove usr/lib/stonith/plugins/stonith2/riloe.so, its
    no longer in the tree
  - Enable snmp_agent
  - Added new libplumbgpl
  - Added new ha_logd.cf
  - Added new iso8601 executable
  - Temporarly remove the drac3 module as GPL code that links
    against OpenSSL is not acceptable to Debian.
    - http://lists.community.tummy.com/pipermail/linux-ha-dev/2005-August/011266.html
    - http://www.osdl.org/developer_bugzilla/show_bug.cgi?id=853
  - Update build dependncy from libsnmp5-dev to libsnmp9-dev
  - Make configure chown test fakeroot aware to avoid build hang
  - Fix syntax error in db OCF resource
  - Make crm/test/helper.sh have #! /bin/bash
  - Make resources/OCF/ocf-shellfuncs.in have #! /bin/bash
  - Update FSF address
  - Zero config.status, libltdl/config.log and libltdl/config.status on clean


author: Simon Horman <horms@debian.org>
changelog:
  - version 2.0.0-1
  - New upstream
  - Added dependancy on libnet-dns-perl to ldirectord
  - Added --enable-checkpointd to configure arguments
  - Added --disable-snmp-subagent to configure arguments
  - Added --disable-swig to configure arguments
  - Add build dependancy on uuid-dev
  - Readranged packages to allow heartbeat 1.2.X to exist in debian
    and heartebat 2.X to be heartbeat until heartbeat gets
    a bit more testing in the wild. Also consoldidated binary
    packages into heartbeat, and development packages into
    heartbeat-dev, ldirectord is still in its own package,
    ldirectord2, as it drags in a lot of dependancies that
    no other part of the system uses.


author: Christoph Maser <cmr@financial.com> - 1.3.5-1
changelog:
  - Update version
  - Add BuildRequires: ruby for macro expansion
  - Add BuildRequires: gettext-devel
  - Add Requires: gettext
  - Add fc10 conditionals


author: Matthias Saou <http://freshrpms.net/> 1.0.46-1
changelog:
  - Update to 1.0.46.
  - Use system libpng and zlib instead of bundled ones.
  - Added php-rrdtool sub-package for the php4 module.


author: Matthias Saou <http://freshrpms.net/> 1.0.45-4
changelog:
  - Added epoch to the perl dependency to work with rpm > 4.2.
  - Fixed the % escaping in the perl dep.


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV> 4.3p2-82.el5.slf
changelog:
  For SLF we add legacy GSSAPI
    Spec change: Add management of vulnkey
  - Added patch FERMI-CHANGES-TO-SPEC-FILE-openssh-4.3p2.patch
  - Added patch FERMI-openssh-4.3p2-fermi-pam-sshd.patch
    Configures pam to use kerberos right away
  - Added patch FERMI-openssh-4.3p2-fermi-ssh-config.patch
    Turns on GSSAPI by default
  - Added patch FERMI-openssh-4.3p2-fermi-sshd-config.patch
    Turns on GSSAPI by default
  - Added patch FERMI-openssh-4.3p2-fermi-gss_hostname_for_CMS.patch
    Added for CMS, GSSAPIStrictAcceptorCheck may be better under SL6
  - Added patch openssh_4.3p2-8ubuntu1.5-trimmed.diff
    Modified slightly from upstream so it works with RH better
  - Added patch openssh_4.3p2-8ubuntu1.5.diff
  - Added patch openssh-4.3p2-8ubuntu1.diff
  - Added patch openssh-TROYS_CHANGELOG
  - Prevented application of patch openssh-4.3p2-gssapi-no-spnego.patch
    conflicts with legacy GSSAPI patch
  - Prevented application of patch openssh-4.3p2-gssapi-canohost.patch
    conflicts with legacy GSSAPI patch
  - Prevented application of patch openssh-TROYS_CHANGELOG
    History from Troy, not a real patch
  - Prevented application of patch openssh-4.3p2-8ubuntu1.diff
    History from Troy
  - Prevented application of patch openssh_4.3p2-8ubuntu1.5.diff
    Full upstream patch, unmodified
  - Prevented application of patch FERMI-CHANGES-TO-SPEC-FILE-openssh-4.3p2.patch


author: Petr Lautrbach <plautrba@redhat.com> 4.3p2-81
changelog:
  - make ssh(1)'s ConnectTimeout option apply to both the TCP connection and
    SSH banner exchange (#750725)


author: Jan F. Chadima <jchadima@redhat.com> - 4.3p2-79
changelog:
  - add LANGUAGE to the sent/accepted evvironment (#710229)
  - ssh-copy-id copies now id_rsa.pub by default (#731930)
  - repairs man pages (#731925)


author: Jan F. Chadima <jchadima@redhat.com> - 4.3p2-78
changelog:
  - set cloexec on accept socket (#642935)
  - add umask to sftp (#720598)
  - enable lastolg for big uids (#706315)


author: Jan F. Chadima <jchadima@redhat.com> - 4.3p2-38
changelog:
  - set better buffer length in latency patch (#508914)
  - close error file descriptor before running external subsystem (#530358)
  - prevent initscript from hanging when generates the keys (#531738)


author: Jan F. Chadima <jchadima@redhat.com> - 4.3p2-33
changelog:
  - fix scp hangup on exit (#454812)
  - call integrity checks only on binaries which are part of the OpenSSH FIPS
    modules


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-32
changelog:
  - log if FIPS mode is initialized (#492363)
  - check the integrity of the binaries in the FIPS mode (#467268)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-28
changelog:
  - use OpenSSL RNG directly (needed for FIPS-140-2 compliance)
  - when in FIPS mode do not try to use algorithms which are not allowed (#447936)
  - improve transfer speed on high latency connections (#227722)
  - more correct 'service sshd status' reporting (#430877)
  - add logging support to the sftp server (#452619)
  - small scp manual page improvement (#433381)


author: Dennis Gregorovic <dgregor@redhat.com> - 4.3p2-26.el5_2.1
changelog:
  - CVE-2007-4752 - Prevent ssh(1) from using a trusted X11 cookie if creation of an
    untrusted cookie fails (#280361)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-21
changelog:
  - fix an information leak in Kerberos password authentication (CVE-2006-5052)
    (#234638)
  - correctly setup context when empty level requested (#234951)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
changelog:
  - improved pam_session patch so it doesn't regress, the patch is necessary
    for the pam_session_close to be called correctly as uid 0 (#167488)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-10.1
changelog:
  - CVE-2006-5794 - properly detect failed key verify in monitor (#214642)
  - kill all ssh sessions when stop is called in halt or reboot runlevel (#213008)
  - remove -TERM option from killproc so we don't race on sshd restart (#213490)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
changelog:
  - improve gssapi-no-spnego patch (#208102)
  - CVE-2006-4924 - prevent DoS on deattack detector (#207957)
  - CVE-2006-5051 - don't call cleanups from signal handler (#208459)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
changelog:
  - don't report duplicate syslog messages, use correct local time (#189158)
  - don't allow spnego as gssapi mechanism (from upstream)
  - fixed memleaks found by Coverity (from upstream)
  - allow ip options except source routing (#202856) (patch by HP)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
changelog:
  - drop the pam-session patch from the previous build (#201341)
  - don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
changelog:
  - dropped old ssh obsoletes
  - call the pam_session_open/close from the monitor when privsep is
    enabled so it is always called as root (patch by Darren Tucker)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
changelog:
  - improve selinux patch (by Jan Kiszka)
  - upstream patch for buffer append space error (#191940)
  - fixed typo in configure.ac (#198986)
  - added pam_keyinit to pam configuration (#198628)
  - improved error message when askpass dialog cannot grab
    keyboard input (#198332)
  - buildrequires xauth instead of xorg-x11-xauth
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
changelog:
  - enable the subprocess in chroot to send messages to system log
  - sshd should prevent login if audit call fails


author: Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
changelog:
  - fixed another place where syslog was called in signal handler
  - pass locale environment variables to server, accept them there (#179851)


author: Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
changelog:
  - drop x11-ssh-askpass from the package
  - drop old build_6x ifs from spec file
  - improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
    characters to person looking at the display
  - less hackish fix for the __USE_GNU problem


author: Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
changelog:
  - work around missing gccmakedep by wrapping makedepend in a local script
  - remove now-obsolete build dependency on "xauth"


author: Warren Togami <wtogami@redhat.com> - 4.2p1-7
changelog:
  - xorg-x11-devel -> libXt-devel
  - rebuild for new xauth location so X forwarding works
  - buildreq audit-libs-devel
  - buildreq automake for aclocal
  - buildreq imake for xmkmf
  -  -D_GNU_SOURCE in flags in order to get it to build
     Ugly hack to workaround openssh defining __USE_GNU which is
     not allowed and causes problems according to Ulrich Drepper
     fix this the correct way after FC5test1


author: Tomas Mraz <tmraz@redhat.com> 4.2p1-2
changelog:
  - use include instead of pam_stack in pam config
  - use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  - upstream patch for displaying authentication errors


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-5
changelog:
  - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
  - install ssh-copy-id from contrib (#88707)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-4
changelog:
  - don't deadlock on exit with multiple X forwarded channels (#152432)
  - don't use X11 port which can't be bound on all IP families (#163732)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-3
changelog:
  - fix small regression caused by the nologin patch (#161956)
  - fix race in getpeername error checking (mindrot #1054)


author: Tomas Mraz <tmraz@redhat.com> 4.0p1-2
changelog:
  - fixed Local/RemoteForward in ssh_config.5 manpage
  - fix fatal when Local/RemoteForward is used and scp run (#153258)
  - don't leak user validity when using krb5 authentication


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-11
changelog:
  - don't call syslog in signal handler
  - allow password authentication when copying from remote
    to remote machine (#103364)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-10
changelog:
  - enable trusted forwarding by default if X11 forwarding is 
    required by user (#137685 and duplicates)
  - disable protocol 1 support by default in sshd server config (#88329)
  - keep the gnome-askpass dialog above others (#69131)


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - change permissions on pam.d/sshd to 0644 (#64697)
  - patch initscript so it doesn't kill opened sessions if
    the sshd daemon isn't running anymore (#67624)


author: Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
changelog:
  - add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
    to enable display of a vendor patch level during version exchange (#120285)
  - configure with --disable-strip to build useful debuginfo subpackages


author: Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
changelog:
  - request gssapi-with-mic by default but not delegation (flag day for anyone
    who used previous gssapi patches)
  - no longer request x11 forwarding by default


author: Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
changelog:
  * Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
  - Built RHLE3 U2 update package.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - additional fix for apparently-never-happens double-free in buffer_free()
  - extend fix for #103998 to cover SSH1


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
changelog:
  - apply patch to store the correct buffer size in allocated buffers
    (CAN-2003-0693)
  - skip the initial PAM authentication attempt with an empty password if
    empty passwords are not permitted in our configuration (#103998)


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
changelog:
  - modify patch which clears the supplemental group list at startup to only
    complain if setgroups() fails if sshd has euid == 0
  - handle krb5 installed in %{_prefix} or elsewhere by using krb5-config


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
changelog:
  - move scp to the -clients subpackage, because it directly depends on ssh
    which is also in -clients (#84329)


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
changelog:
  - patch PAM configuration to use relative path names for the modules, allowing
    us to not worry about which arch the modules are built for on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
changelog:
  - rework the close-on-exit docs
  - include configuration file man pages
  - make use of nologin as the privsep shell optional


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
changelog:
  - update to 3.3p1
  - merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
  - disable gtk2 askpass
  - require pam-devel by filename rather than by package for erratum
  - include patch from Solar Designer to work around anonymous mmap failures


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
changelog:
  - drop buildreq on db1-devel
  - require pam-devel by package name
  - require autoconf instead of autoconf253 again


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
changelog:
  - pull patch from CVS to avoid printing error messages when some of the
    default keys aren't available when running ssh-add
  - refresh to current revisions of Simon's patches


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
changelog:
  - reintroduce Simon's gssapi patches
  - add buildprereq for autoconf253, which is needed to regenerate configure
    after applying the gssapi patches
  - refresh to the latest version of Markus's patch to build properly with
    older versions of OpenSSL


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
changelog:
  - require sharutils for building (mindrot #137)
  - require db1-devel only when building for 6.x (#55105), which probably won't
    work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
  - require pam-devel by file (not by package name) again
  - add Markus's patch to compile with OpenSSL 0.9.5a (from
    http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
    building for 6.x


author: Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
changelog:
  - update to SNAP-20020220 for testing purposes (you've been warned, if there's
    anything to be warned about, gss patches won't apply, I don't mind)


author: Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
changelog:
  - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
    exchange, authentication, and named key support


author: Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
changelog:
  - merge some of Damien Miller <djm@mindrot.org> changes from the upstream
    3.0p1 spec file and init script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.0p1
  - update to x11-ssh-askpass 1.2.4.1
  - change build dependency on a file from pam-devel to the pam-devel package
  - replace primes with moduli


author: Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
changelog:
  - fix scp's server's reporting of file sizes, and build with the proper
    preprocessor define to get large-file capable open(), stat(), etc.
    (sftp has been doing this correctly all along) (#51827)
  - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
  - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
  - mark profile.d scriptlets as config files (#42337)
  - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
  - change a couple of log() statements to debug() statements (#50751)
  - pull cvs patch to add -t flag to sshd (#28611)
  - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull cvs patch to add session initialization to no-pty sessions
  - pull cvs patch to not cut off challengeresponse auth needlessly
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed (#49263)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change Copyright: BSD to License: BSD
  - add Markus Friedl's unverified patch for the cookie file deletion problem
    so that we can verify it
  - drop patch to check if xauth is present (was folded into cookie patch)
  - don't apply gssapi patches for the errata candidate
  - clear supplemental groups list at startup


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix an error parsing the new default sshd_config
  - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
    dealing with comments right


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
    to be removed before the next beta cycle because it's a big departure
    from the upstream version


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish marking strings in the init script for translation
  - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
    at startup (change merged from openssh.com init script, originally by
    Pekka Savola)
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed


author: Preston Brown <pbrown@redhat.com>
changelog:
  - remove explicit openssl requirement, fixes builddistro issue
  - make initscript stop() function wait until sshd really dead to avoid 
    races in condrestart


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - mention that challengereponse supports PAM, so disabling password doesn't
    limit users to pubkey and rsa auth (#34378)
  - bypass the daemon() function in the init script and call initlog directly,
    because daemon() won't start a daemon it detects is already running (like
    open connections)
  - require the version of openssl we had when we were built


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make do_pam_setcred() smart enough to know when to establish creds and
    when to reinitialize them
  - add in a couple of other fixes from Damien for inclusion in the errata


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p2
  - call setcred() again after initgroups, because the "creds" could actually
    be group memberships


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
  - don't enable challenge-response by default until we find a way to not
    have too many userauth requests (we may make up to six pubkey and up to
    three password attempts as it is)
  - remove build dependency on rsh to match openssh.com's packages more closely


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Revert the patch to move pam_open_session.
  - Init script and spec file changes from Pekka Savola. (#28750)
  - Patch sftp to recognize '-o protocol' arguments. (#29540)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Chuck the closing patch.
  - Add a trigger to add host keys for protocol 2 to the config file, now that
    configuration file syntax requires us to specify it with HostKey if we
    specify any other HostKey values, which we do.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Redo patch to move pam_open_session after the server setuid()s to the user.
  - Rework the nopam patch to use be picked up by autoconf.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.1p1.
  - Add init script mods from Pekka Savola.
  - Tweak the init script to match the CVS contrib script more closely.
  - Redo patch to ssh-add to try to adding both identity and id_dsa to also try
    adding id_rsa.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.0p1.
  - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
  - Resync with parts of Damien Miller's openssh.spec from CVS, including
    update of x11 askpass to 1.2.0.
  - Only require openssl (don't prereq) because we generate keys in the init
    script now.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't open a PAM session until we've forked and become the user (#25690).
  - Apply Andrew Bartlett's patch for letting pam_authenticate() know which
    host the user is attempting a login from.
  - Resync with parts of Damien Miller's openssh.spec from CVS.
  - Don't expose KbdInt responses in debug messages (from CVS).
  - Detect and handle errors in rsa_{public,private}_decrypt (from CVS).


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - More gettextizing.
  - Close all files after going into daemon mode (needs more testing).
  - Extract patch from CVS to handle auth banners (in the client).
  - Extract patch from CVS to handle compat weirdness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
    succeeded, to allow public-key authentication after a failure with "none"
    authentication.  (#21268)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to x11-askpass 1.1.1. (#21301)
  - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge multiple PAM text messages into subsequent prompts when possible when
    doing keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Disable the built-in MD5 password support.  We're using PAM.
  - Take a crack at doing keyboard-interactive authentication with PAM, and
    enable use of it in the default client configuration so that the client
    will try it when the server disallows password authentication.
  - Build with debugging flags.  Build root policies strip all binaries anyway.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add the primes file from the latest snapshot to the main package (#20884).
  - Add the dev package to the prereq list (#19984).
  - Remove the default path and mimic login's behavior in the server itself.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Resync with conditional options in Damien Miller's .spec file for an errata.
  - Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to OpenSSH 2.3.0p1.
  - Update to x11-askpass 1.1.0.
  - Enable keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
    build PAM authentication in.
  - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
  - Clean out no-longer-used patches.
  - Patch ssh-add to try to add both identity and id_dsa, and to error only
    when neither exists.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update x11-askpass to 1.0.2. (#17835)
  - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
    always find them in the right place. (#17909)
  - Set the default path to be the same as the one supplied by /bin/login, but
    add /usr/X11R6/bin. (#17909)
  - Try to handle obsoletion of ssh-server more cleanly.  Package names
    are different, but init script name isn't. (#17865)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 20000823 snapshot.
  - Change subpackage requirements from %{version} to %{version}-%{release}
  - Back out the pipe patch.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 2.1.1p4, which includes fixes for config file parsing problems.
  - Move the init script back.
  - Add Damien's quick fix for wackiness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Move condrestart to server postun.
  - Move key generation to init script.
  - Actually use the right patch for moving the key generation to the init script.
  - Clean up the init script a bit.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Patch to build with neither RSA nor RSAref.
  - Miscellaneous FHS-compliance tweaks.
  - Fix for possibly-compressed man pages.


author: Troy Dawson <dawson@fnal.gov> - 8.3.7-2.sl
changelog:
  - Updated to version 8.3.7
  - Added Requires: drbd-kernel-module-8.3.7
  - Added %config(noreplace) /etc/drbd.d/global_common.conf


author: Frank Nagy <nagy@fnal.gov> 1.1-1
changelog:
  - New versions of SLF5 executables for kcron and kcron-create
  - Adds -d (debug print) flag to kcron.  kcron modified to
  - invoke /usr/krb5/bin/kinit so that aklog will be invoked
  - on AFS client systems.  Also added aklog executable (replaces
  - link to /usr/bin/akoog from OpenAFS) for SLF5 made from the
  - OpenAFS aklog with added support for Fermilab compound
  - principals.


author: Frank Nagy <nagy@fnal.gov> 1.0-2
changelog:
  - Now have SLF5 executables for kcron and kcron-create, remove
  - libraries and incorporated changes from SLF4 krb1-1.8d.spec


author: Frank Nagy <nagy@fnal.gov> 4.6-1
changelog:
  - Update krb5.conf to v4.6 updating list of Accelerator Division servers
  - Fixed bug in make-cron-keytab so it will take error exit if run
  - in shared account via ksu rather than ssh into the account.


author: Frank Nagy <nagy@fnal.gov> 4.5-1
changelog:
  - Added Nova Far Detector KDC to search list, edit and re-format
  - SysAdmin HowTo instructions for a local KDC search list and
  - set so krb5-fermi-config and krb5-fermi-krb5.conf conflict with
  - each other so only one gets installed


author: Frank Nagy <nagy@fnal.gov> 4.4-1
changelog:
  - Correct spellings and phrasing in this file, config-xinetd and
  - config-services.  Fixed order of paramter statements in the
  - [capaths] section of v4.4 of krb5.conf


author: Frank Nagy <nagy@fnal.gov> 4.3-1
changelog:
  - V4.2 added PSC.EDU and EXTENCI.ORG realms to the [realms] section
  - and V4.3 changed the KDC defintions for the CERN.CN realm


author: Frank Nagy <nagy@fnal.gov> 4.1-1
changelog:
  - Added permitted_enctypes line to [libdefaults] section
  - Removed obsolete AD nodes from [domain_realms]


author: Frank Nagy <nagy@fnal.gov> 4.0-1
changelog:
  - Changed to krb5.conf V4.0 with expanded KDC list, removed
  - Kerberos4 ticket generation from login/pam sections and
  - other minor changes.


author: Frank Nagy <nagy@fnal.gov> 3.1-1
changelog:
  - Emergency fix due to PAM mishandling comments on lines
  - in [appdefults]pam section causing long login times


author: Frank Nagy <nagy@fnal.gov> 3.0-4
changelog:
  - Correct some errors in krb5.conf and the config-krb5.conf scipt to
  - get the editted comments correct during installation


author: Frank Nagy <nagy@fnal.gov> 3.0-1
changelog:
  - Installation scripts modified to drop obsolete edits and support
  - local saved FNAL.GOV KDC list
  - Added 3DEC to default encoding types and allow Wek Encryption in
  - [libdefaults] addded commented tag linges around FNAL.GOV KDC list


author: Frank Nagy <nagy@fnal.gov> 2.12-7
changelog:
  - If /etc/xinetd.d/ekrb5-telnet file found, replace the ftp and telnet
  - template files in config/ (both .xinetd and .xinetd.on files) with
  - the gssftp and ekrb-telnet (encrypted telnet only) templates with
  - modern server options


author: Frank Nagy <nagy@fnal.gov> 2.12-6
changelog:
  - Changed to require krb5-workstation instread of krb5-workstation-fermi and to
  - obsolete previous versions of this RPM so file replacements will work correctly


author: Frank Nagy <nagy@fnal.gov> 2.12-4
changelog:
  - Added make-cron-keytab script and fixed makehostkeys permissions
  - Duplicated following changes by Troy Dawson from 12.2-1 RPM for SLF5
  - Added the triggerin for krb5-libs, updating krb5.conf if EXAMPLE is in the file


author: Troy Dawson <dawson@fnal.gov> 2.5-3
changelog:
  - Updated the name to match the krb5.conf version - 2.5
  - updated the config script to say 2.5
  - Made it so that it moves the old krb5.conf out of the way


author: Troy Dawson <dawson@fnal.gov> 1.25-1.LTS4
changelog:
  - updated the krb5.conf.template file to version 1.25
  - Changed makekeys so that it finds the right kadmin


author: Troy Dawson <dawson@fnal.gov> 1.9-4.LTS
changelog:
  - added config-krb5.conf.aklog and /etc/sysconfig/krb5.conf.aklog
  - added triggers to run config-krb5.conf.aklog with AFS triggers


author: Troy Dawson <dawson@fnal.gov>
changelog:
  - Changed the krb5.conf.template file so that the Pam part was first, 
  also lengthened ticket time
  - Edited the spec file so that it doesn't automatically move the /etc/krb5.conf file


author: Troy Dawson <dawson@fnal.gov>
changelog:
  - Made changes for pam usage in krb.conf and krb5.conf
  - Also removed the linking of /usr/krb5 and /usr/kerberos


author: Troy Dawson <dawson@fnal.gov>
changelog:
  - Made improvements to the makehostkeys script.  I also have it check 
    for the varias files (sshd_config, services) before modifying them.


author: Troy Dawson <dawson@fnal.gov>
changelog:
  - The config-inetd.conf script has been changed to look for services
    that have a kerberos equal.  If these services were originally turned
    off, then the kerberized version is turned off.  I also took out the
    keytab-convert program, as this is dependant on one particular flavor
    of fermi kerberos.


author: Troy Dawson <dawson@fnal.gov>
changelog:
  - I added the keytab-convert program into the config rpm, with it's
    corresponding manpage.  It will also be in the normal kerberos rpm
    but in the bin area.


author: Troy Dawson <dawson@fnal.gov>
changelog:
  - I changed things to the version 1.4.  I also added the config-sshd_config
    script, as well as the config-hostkeys script.


author: Troy Dawson <dawson@fnal.gov>
changelog:
  - I finished with the config-services and config-inetd.conf scripts.
    I also changed how the /usr/krb5 and /usr/kerberos were linked.


author: Troy Dawson <dawson@fnal.gov>
changelog:
  - I put the raw scripts into the package from Fermi.  These will
    need to be rewritten so that they don't depend on Fermi packages.


author: Pat Riehecky <riehecky@fnal.gov> 5x-2-0.sl5
changelog:
  - No longer conflicts with yum-conf-<release>
  - Now can be built for rolling with little risk to the real release


author: Troy Dawson <dawson@fnal.gov> 5x-1-6.SL
changelog:
  - Updated gpg keys to include sl and sl5
  - Updated download server list to include ftp1.scientificlinux.org


author: Troy Dawson <dawson@fnal.gov> 5x-1-4.SL
changelog:
  - Added comments in yum.conf for installonlyn
  - Changed flash.repo to adobe.repo
  - Changed repo's to use http first, and then try ftp


author: Troy Dawson <dawson@fnal.gov> - 4.9.16-1.SL.6
changelog:
  - Re-ordered the rnotes picture, and added one more
  - Put in the final release of the grub picture
  - Put in the final release of the syslinux-splash.png picture


author: Troy Dawson <dawson@fnal.gov> - 4.9.16-1.SL.4
changelog:
  - Tweeked the rnotes images so they aren't squished
  - tweeked the rhgb graphics
  - Change the grub bootscreen


author: David Zeuthen <davidz@redhat.com> - 4.9.14-1
changelog:
  - Don't include LILO splash. Resolves: #216748
  - New syslinux-splash from Diana Fong. Resolves: #217493


author: David Zeuthen <davidz@redhat.com> - 4.9.13-1
changelog:
  - Make firstboot/splash-small.png completely transparent
  - Fix up date for last commit
  - Resolves: #216501


author: John (J5) Palmieri <johnp@redhat.com> - 1.2.7-1
changelog:
  - Add background xml file for the new backgrounds
  - Add po directory for translating the background xml


author: John (J5) Palmieri <johnp@redhat.com> - 1.2.3-1
changelog:
  - Add attributions to the background graphics metadata
  - Add a 4:3 asspect ratio version of the default background graphic


author: Havoc Pennington <hp@redhat.com>
changelog:
  - add firstboot images to makefile/specfile
  - add /usr/share/pixmaps stuff
  - add splash screen images
  - add COPYING


author: Pat Riehecky <riehecky@fnal.gov> 1-2
changelog:
  - Added more 'Requires' to ensure things run correctly
  - Config script now runs in bash rather than sh
  -  No changes were made to the script itself


author: Frank Nagy < nagy@fnal.gov > 2.1-14
changelog:
  = Re-recorrect z_krb5.csh so path varialbe is setup with
  - correct word list.  Shell will automaintian PATH variable
  - to matxh


author: Frank Nagy < nagy@fnal.gov > 2.1-9
changelog:
  - Another set of fixes for the permissions tests and fixes
  - Do stat and chmod on /usr/bin files, not symlinks
  - Correct kdestroy and v4rcp permissions (no setuid)


author: Frank Nagy < nagy@fnal.gov > 2.1-1
changelog:
  - Added triggerun scriptlets to match existing triggerin
  - scripts and remove the symbolic links on uninstalls
  - Added corrected z_krb5 scripts for /etc/profile.d to handle
  - change in SLF6 to df output if no AFS volumes


author: Frank Nagy < nagy@fnal.gov > 2.0-2
changelog:
  - Removed "$RPM_BUILD_ROOT/" from all the commands in the
  - %triggerin sections and definitions of macros used therein


author: Frank Nagy < nagy@fnal.gov > 2.0-1
changelog:
  - Changes to use %defattr and handle both RHEL5 and RHEL6
  - using %trigger* to set symbolic links correctly based on
  - which package(s)/version(s) are installed/removed


author: Frank Nagy < nagy@fnal.gov > 1.1-1
changelog:
  - Replaced symbolic link for kinit with executable script
  - called kinit which calls /usr/kerberos/bin/kinit and,
  - if on an AFS client system, aklog since the kinit from
  - MIT/Redhat knows not of aklog!


author: Frank Nagy < nagy@fnal.gov > 1.0-2
changelog:
  - Updated z_krb5.* scripts (stored in /etc/profile.d/) to speed-up by 
  - reducing unnecessary invocations of aklog when spawning subshells.


author: Frank Nagy <nagy@fnal.gov> 2.0-2
changelog:
  - Merged get-cert.sh versions from SLF5 and SLF6 (which added checks
  - for Firefox and/or Seamonkey current running)


author: Frank Nagy <nagy@fnal.gov> 1.0-2
changelog:
  - Fixed file ownerships and permissions, new get-cert.sh script
  - puts password on .globus/*.pem files


author: Frank Nagy <nagy@fnal.gov> 1.0-1
changelog:
  - created from krb5-getcert made by Troy Dawson and changed to be a
  - complete package with utilities from Mozilla and located in /usr/krb5


author: Troy Dawson <dawson@fnal.gov> 1.0-1
changelog:
  - First go round
  - Remove each part individually so that this can be more general and work 
    on more releases.


author: Ville Skyttä <ville.skytta@iki.fi> - 1:1.3-5
changelog:
  - Fix ant completion when complete-ant-cmd.pl is N/A (#729771).
  - Fix bash < 4 _filedir_xspec uppercase expansion issue (#726220).
  - Drop _filedir_xspec self-parsing with bash >= 4 for speedups (#479936).
  - Do install triggers with lua where available to speed up package install.
  - Add completion for sum (#717341).


author: Ville Skyttä <ville.skytta@iki.fi> - 1:1.3-3
changelog:
  - Patch to not test command availability for each snippet, improves load time.
  - Apply upstream libreoffice flat XML extensions fix for #692548.
  - Apply upstream MANPAGER fix for #689180.
  - Apply upstream (la)tex *.dbj fix for #678122.


author: Ville Skyttä <ville.skytta@iki.fi> - 1:1.2-5
changelog:
  - Install util-linux completions unconditionally.
  - Make trigger target package rename etc tracking easier to maintain, and
    handle man-db/man (#642193, Yanko Kaneti), mysql/MySQL-client-community,
    and tigervnc/vnc renames better.
  - Move pre-1.0 %changelog entries to CHANGES.package.old.


author: Ville Skyttä <ville.skytta@iki.fi> - 1:1.2-3
changelog:
  - Apply upstream ~username completion fix for #628130.
  - Apply upstream rpm completion improvements for #630328.
  - Apply upstream IPv6 address completion fix for #630658.
  - Drop some completions that are included in respective upstream packages.
  - Fix qdbus/dcop uninstall trigger.


author: Ville Skyttä <ville.skytta@iki.fi> - 1:1.2-1
changelog:
  - Update to 1.2, all patches applied upstream.
  - Fixes #444469, #538433, #541423, and #601813, works around #585384.


author: Ville Skyttä <ville.skytta@iki.fi> - 1:1.1-5
changelog:
  - Apply upstream post 1.1 generic vncviewer fixes.
  - Autoinstall vncviewer completion also on tigervnc.
  - Autoinstall chsh completion also on util-linux.


author: Ville Skyttä <ville.skytta@iki.fi> - 1:1.1-4
changelog:
  - Fix autoinstall of completions named other than the package (#546905).
  - Use environment-modules upstream completion instead of ours if available.
  - Autoinstall mysqladmin completion also on MySQL-client-community.


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV> 1.6.1-70.slf5
changelog:
  We must make some minor changes to fix upstream bugs
  - Added patch krb5_krb5-mwm-kshd.patch
    See TUVs Bug 658217


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-68.el5
changelog:
  - backport fixes to teach libkrb5 to use descriptors higher than FD_SETSIZE
    to talk to a KDC by using poll() if it's detected at compile-time, revised
    (#701444, RT#6905)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-67.el5
changelog:
  - add backported patch by way of jbarbuc to free subkeys created by the
    KDC while processing TGS requests (#708516)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-66.el5
changelog:
  - add backported patch by way of several people to better avoid false
    detection of replay attacks when talking to systems with coarse time
    resolution (#713500)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-65.el5
changelog:
  - ftpd: add backported patch to check for errors when calling setegid
    (MITKRB5-SA-2011-005, CVE-2011-1526, #719098)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-63.el5
changelog:
  - unbreak processing of multi-line macros (#735363,#736132), broken by the
    original fix for #665833


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-62.el5
changelog:
  - incorporate a fix to teach the file labeling bits about when replay caches
    are expunged (#712453)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-60.el5
changelog:
  - don't bail halfway through an unlock operation when the result will
    be discarded and the end-result not cleaned up (Martin Osvald, #586032)
  - add a versioned dependency between krb5-server-ldap and krb5-libs (internal
    tooling)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-59.el5
changelog:
  - don't discard the error code from an error message received in response
    to a change-password request (#658871, RT#6893)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-58.el5
changelog:
  - ftpd: add patch from Jatin Nansi to correctly match "$user restrict"
    lines in /etc/ftpusers (#644215, RT#6889)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-57.el5
changelog:
  - ftp: add modified patch from Rogan Kyuseok Lee to report the number of
    bytes transferred correctly when transferring large files on 32-bit
    systems (#648404)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add upstream patch to fix hang or crash in the KDC when using the LDAP kdb
    backend (CVE-2011-0281, CVE-2011-0282, #671097)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-55.el5
changelog:
  - incorporate upstream patch for checksum acceptance issues from
    MITKRB5-SA-2010-007 (CVE-2010-1323, #652308)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-52.el5
changelog:
  - krshd: don't limit user names to 16 chars when utmp can handle names
    at least a bit longer than that (#611713)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-49.el5
changelog:
  - ftpd: backport changes to modify behavior to match telnetd,rshd,rlogind and
    accept GSSAPI auth to any service for which we have a matching key (#538075)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-47.el5
changelog:
  - pull in fix for RT#5551 to treat the referral realm when seen in a ticket
    as though it were the local realm (#498554, also very likely #450122)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-46.el5
changelog:
  - add aes256-cts:normal and aes128-cts:normal to the list of keysalts
    in the default kdc.conf (part of #565941)
  - add a note to kdc.conf(5) pointing to the admin guide for the list of
    recognized key and salt types (the rest of #565941)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-44.el5
changelog:
  - libgssapi: backport patch from svn to stop returning context-expired errors
    when the ticket which was used to set up the context expires (#605367,
    upstream #6739)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-42.el5
changelog:
  - stop caring about the endianness of stash files (#514741), which will be
    replaced by proper keytab files in later releases
  - don't crash in krb5_get_init_creds_password() if the passed-in options
    struct is NULL and the client's keys have expired (#555875)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-41.el5
changelog:
  - ksu: perform PAM account and session management before dropping privileges
    to those of the target user (#540769 and #596887, respectively)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add candidate patch to correct libgssapi null pointer dereference which
    could be triggered by malformed client requests (CVE-2010-1321, #583704)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-40.el5
changelog:
  - fix a null pointer dereference and crash introduced in our PAM patch that
    would happen if ftpd was given the name of a user who wasn't known to the
    local system, limited to being triggerable by gssapi-authenticated clients by
    the default xinetd config (Olivier Fourdan, #569472)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-39.el5
changelog:
  - add upstream patch to fix a few use-after-free bugs, including one in
    kadmind (CVE-2010-0629, #578186)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-38.el5
changelog:
  - merge patch to correct KDC integer overflows which could be triggered by
    malformed RC4 and AES ciphertexts (CVE-2009-4212, #546348)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-37.el5
changelog:
  - pull changes to libkrb5 to properly handle and chase "off-path" referrals
    back from 1.7 (#546538)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-33.el5
changelog:
  - kdb5_util: when renaming a database, if the new name's associated lock
    files don't exist, go ahead and create them (#442879)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - ksu: perform PAM account and session management for the target user;
    authentication is still performed as before (#477033)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix typo in ksu's reporting of errors getting credentials (#462890)
  - kadmind.init: stop setting up a keytab, as kadmind's been able to use
    the database directly for a while now (#473151)
  - pull up patch to set PAM_RHOST (James Leddy, #479071)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-31.el5.2
changelog:
  - add fix for potential buffer read overrun in the SPNEGO GSSAPI mechanism
    (#490636, CVE-2009-0844)
  - add fix for NULL pointer dereference when handling certain error cases
    in the SPNEGO GSSAPI mechanism (#490636, CVE-2009-0845)
  - add fix for attempt to free uninitialized pointer in the ASN.1 decoder
    (#491036, CVE-2009-0846)
  - add fix for bug in length validation in the ASN.1 decoder (CVE-2009-0847)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-32.el5
changelog:
  - add patch to also report an error in rcp if close() returns an error,
    which could indicate an out-of-space error on an NFS filesystem (Tomas
    Smetana, #461902)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-31.el5
changelog:
  - add a backported patch which adds a check on credentials obtained from
    a foreign realm to make sure that they're of an acceptable type, and
    if not, retry to the request to get one of the right type (Sadique Puthen,


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-30.el5
changelog:
  - backport fix from 1.6.3 to register file-based ccaches created with
    the krb5_cc_new_unique() function with the global list, so that we
    don't crash when we go to close the ccache (#468729)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-29.el5
changelog:
  - backport fix from 1.6.3 to abort a sequential scan of a keytab if the
    handle to the keytab has become invalidated during the scan (via Vince
    Worthington, #460911)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-28.el5
changelog:
  - if we successfully change the user's password during an attempt to get
    initial credentials, but then fail to get initial creds from a non-master
    using the new password, retry against the master (#432334)
  - telnet: remove the proviso in the man page which says that the "z" command
    only works in csh, as this is only true on systems where other shells don't
    implement job control (#433947)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - avoid double-logging by not parsing /etc/krb5.conf twice (#434858)
  - ftp: fix to not incorrectly reuse target filenames during mget when case-
    mapping is enabled (#442716)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-25.el5
changelog:
  - add preliminary patch to fix use of uninitialized pointer / double-free in
    KDC (CVE-2008-0062,CVE-2008-0063) (#432620, #432621)
  - add backported patch to fix use-after-free in libgssapi_krb5 (CVE-2007-5901)
    (#415321)
  - add backported patch to fix double-free in libgssapi_krb5 (CVE-2007-5971)
    (#415351)
  - add preliminary patch to fix incorrect handling of high-numbered descriptors
    in the RPC library (CVE-2008-0947) (#433596)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-24
changelog:
  - kdb_ldap: add patch to recognize "nsAccountLock: TRUE" as indicating that
    an entry should have the DISALLOW_ALL_TIX flag set (read only), for better
    interop with Fedora, Netscape, Red Hat Directory Server (Simo Sorce, #431784)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-23
changelog:
  - backport changes from 1.6.3 which allow callers of the the sendto-kdc
    functions to override the failover behavior on a per-response basis, and
    default to failing over on service-unavailable errors (#230384)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-22
changelog:
  - add patch to fall back to TCP kpasswd servers for kdc-unreachable,
    can't-resolve-server, and response-too-big errors (#392631)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-21
changelog:
  - add conditional logic to allow building only the krb5-server-ldap subpackage
    (#427790)
  - use the right sequence numbers when generating password-set/change requests
    for kpasswd servers after the first one (#427789)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-20
changelog:
  - allocate space for the relative path including the nul-terminator (Jose
    Plans, #426085)
  - fix a couple of spots where a file context wouldn't be freed


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-19
changelog:
  - backport from 1.6.3 to initialize a library-allocated get_init_creds_opt
    structure the same way we would one which was allocated by the calling
    application, to restore kinit's traditional behavior of doing a password
    change right when it detects an expired password (#413051)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-18
changelog:
  - fix syntax error in kadmin init script (#373011,#381011)
  - turn off content/size/date verification on krb5.conf (#329771)
  - fix storage of delegated krb5 credentials when they've been wrapped up in
    spnego (#319351)
  - return a delegated credential handle even if the application didn't pass a
    location to store the flags which would be used to indicate that credentials
    were delegated (#314651)
  - in login, allow PAM to interact with the user when they've been strongly
    authenticated (#309951)
  - signal PAM when we're changing an expired password that it's an expired
    password, so that when cracklib flags a password as being weak it's treated
    as an error even if we're running as root (#308131)
  - set the key expiration time in an AS-REP using the sooner of the client's
    entry's key expiration time and the entry's expiration time, instead of
    just the entry's expiration time (#250257)
  - in ftp, don't lose track of a client socket when a server-side error
    causes a download to fail (#248618)
  - in ftp, fix runique when mget is used (#247633)
  - add the snippet documenting the kdc_tcp_ports option to kdc.conf's man
    page, using text taken from the administrator's guide (#282191)
  - in kpasswd, when reading the client's principal name from the ccache fails
    for any reason, fall back to the user's name (#248631)
  - init script cleanups (Michal Marciniszyn, #242500)
  - tweak the telnet man page to refer to the telnet rlogin escape character
    as such instead of rereferring to it simly as the escape character or the
    telnet escape character (#247741)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-17
changelog:
  - ftpd: also do PAM session and credential management when ftp clients use
    strong authentication (#286291)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-14
changelog:
  - make krb5-workstation depend on the PAM configuration file used by login.krb5
  - fix omission of kadmin log file when labeling (#253558)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-13
changelog:
  - add preliminary patch to fix buffer overflow in rpcsec_gss implementation
    in libgssrpc (#250973, CVE-2007-3999) and write through uninitialized
    pointer in kadmind (#250976, CVE-2007-4000)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-11
changelog:
  - login: change to the user's home directory after dropping privileges,
    not before (#248050)
  - turn off the ldap features


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-10
changelog:
  - add a patch to allow applications to try to use a key with kvno=0, if
    found, in place of the "right" version for a request (Luke Howard, #230379)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-9
changelog:
  - incorporate fixes for MITKRB5-SA-2007-004 (CVE-2007-2442,CVE-2007-2443)
    and MITKRB5-SA-2007-005 (CVE-2007-2798) (#239073)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - perform PAM account / session management in krshd (#182195,#195922)
  - perform PAM authentication and account / session management in ftpd
  - perform PAM authentication, account / session management, and password-
    changing in login.krb5 (#182195,#195922)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - preprocess kerberos.ldif into a format FDS will like better, and include
    that as a doc file as well


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - switch man pages to being generated with the right paths in them
  - drop old, incomplete SELinux patch
  - add patch from Greg Hudson to make srvtab routines report missing-file errors
    at same point that keytab routines do (#241805)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-2
changelog:
  - pull patch from svn to undo unintentional chattiness in ftp
  - pull patch from svn to handle NULL krb5_get_init_creds_opt structures
    better in a couple of places where they're expected


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-1
changelog:
  - update to 1.6.1
    - drop no-longer-needed patches for CVE-2007-0956,CVE-2007-0957,CVE-2007-1216
    - drop patch for sendto bug in 1.6, fixed in 1.6.1


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - kadmind.init: don't fail outright if the default principal database
    isn't there if it looks like we might be using the kldap plugin
  - kadmind.init: attempt to extract the key for the host-specific kadmin
    service when we try to create the keytab


author: Nalin Dahyabhai <nalin@redhat.com> 1.6-6
changelog:
  - omit dependent libraries from the krb5-config --libs output, as using
    shared libraries (no more static libraries) makes them unnecessary and
    they're not part of the libkrb5 interface (patch by Rex Dieter, #240220)
    (strips out libkeyutils, libresolv, libdl)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6-4
changelog:
  - fix an uninitialized length value which could cause a crash when parsing
    key data coming from a directory server
  - correct a typo in the krb5.conf man page ("ldap_server"->"ldap_servers")


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move the default acl_file, dict_file, and admin_keytab settings to
    the part of the default/example kdc.conf where they'll actually have
    an effect (#236417)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6-3
changelog:
  - add patch to correct unauthorized access via krb5-aware telnet
    daemon (#229782, CVE-2007-0956)
  - add patch to fix buffer overflow in krb5kdc and kadmind
    (#231528, CVE-2007-0957)
  - add patch to fix double-free in kadmind (#231537, CVE-2007-1216)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6-2
changelog:
  - add buildrequires: on keyutils-libs-devel to enable use of keyring ccaches,
    dragging keyutils-libs in as a dependency


author: Nalin Dahyabhai <nalin@redhat.com> 1.5-22
changelog:
  * Thu Mar 15 2007 Nalin Dahyabhai <nalin@redhat.com> 1.5-21
  - add preliminary patch to fix buffer overflow in krb5kdc and kadmind
    (#231528, CVE-2007-0957)
  - add preliminary patch to fix double-free in kadmind (#231537, CVE-2007-1216)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-20
changelog:
  - temporarily back out %post changes, fix for #143289 for security update
  - add preliminary patch to correct unauthorized access via krb5-aware telnet


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-19
changelog:
  - refrain from killing any lingering members of our child's process group when
    logging that the child process has exited (Jose Plans, #143289)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - initial update to 1.6, pre-package-reorg
  - move workstation daemons to a new subpackage (#81836, #216356, #217301), and
    make the new subpackage require xinetd (#211885)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-18
changelog:
  - make use of install-info more failsafe (Ville Skyttä, #223704)
  - preserve timestamps on shell scriptlets at %install-time


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-14
changelog:
  - apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (#218456)
  - apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (#218456)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update backport of the preauth module interface
  - add proposed patches 4566, 4567
  - add proposed edata reporting interface for KDC
  - add temporary placeholder for module global context fixes


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-11
changelog:
  - don't bail from the KDC init script if there's no database, it may be in
    a different location than the default (fenlason)
  - remove the [kdc] section from the default krb5.conf -- doesn't seem to have
    been applicable for a while


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-10
changelog:
  - rename krb5.sh and krb5.csh so that they don't overlap (#210623)
  - way-late application of added error info in kadmind.init (#65853)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-4
changelog:
  - ensure that the gssapi library's been initialized before walking the
    internal mechanism list in gss_release_oid(), needed if called from
    gss_release_name() right after a gss_import_name() (#198092)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.3-7
changelog:
  - further munge krb5-config so that 'libdir=/usr/lib' is given even on 64-bit
    architectures, to avoid multilib conflicts; other changes will conspire to
    strip out the -L flag which uses this, so it should be harmless (#192692)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.3-6
changelog:
  - adjust the patch which removes the use of rpath to also produce a
    krb5-config which is okay in multilib environments (#190118)
  - make the name-of-the-tempfile comment which compile_et adds to error code
    headers always list the same file to avoid conflicts on multilib installations
  - strip SIZEOF_LONG out of krb5.h so that it doesn't conflict on multilib boxes
  - strip GSS_SIZEOF_LONG out of gssapi.h so that it doesn't conflict on mulitlib
    boxes


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.3-4
changelog:
  - give a little bit more information to the user when kinit gets the catch-all
    I/O error (#180175)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.3-3
changelog:
  - rebuild properly when pthread_mutexattr_setrobust_np() is defined but not
    declared, such as with recent glibc when _GNU_SOURCE isn't being used


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - login: don't truncate passwords before passing them into crypt(), in
    case they're significant (#149476)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.2-3
changelog:
  - add an xinetd configuration file for encryption-only telnetd, parallelling
    the kshell/ekshell pair (#167535)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.2-2
changelog:
  - change the default configured encryption type for KDC databases to the
    compiled-in default of des3-hmac-sha1 (#57847)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-5
changelog:
  - fix telnet client environment variable disclosure the same way NetKit's
    telnet client did (CAN-2005-0488) (#159305)
  - keep apps which call krb5_principal_compare() or krb5_realm_compare() with
    malformed or NULL principal structures from crashing outright (Thomas Biege)
    (#161475)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - apply fixes from draft of MIT-KRB5-SA-2005-002 (CAN-2005-1174,CAN-2005-1175)
    (#157104)
  - apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (#159755)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-4
changelog:
  - fix double-close in keytab handling
  - add port of fixes for CAN-2004-0175 to krb5-aware rcp (#151612)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-3
changelog:
  - prevent spurious EBADF in krshd when stdin is closed by the client while
    the command is running (#151111)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-1
changelog:
  - update to 1.4.1, incorporating fixes for CAN-2005-0468 and CAN-2005-0469
  - when starting the KDC or kadmind, if KRB5REALM is set via the /etc/sysconfig
    file for the service, pass it as an argument for the -r flag


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add draft fix from Tom Yu for slc_add_reply() buffer overflow (CAN-2005-0469)
  - add draft fix from Tom Yu for env_opt_add() buffer overflow (CAN-2005-0468)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4-1
changelog:
  - update to 1.4
    - v1.4 kadmin client requires a v1.4 kadmind on the server, or use the "-O"
      flag to specify that it should communicate with the server using the older
      protocol
    - new libkrb5support library
    - v5passwdd and kadmind4 are gone
    - versioned symbols
  - pick up $KRB5KDC_ARGS from /etc/sysconfig/krb5kdc, if it exists, and pass
    it on to krb5kdc
  - pick up $KADMIND_ARGS from /etc/sysconfig/kadmin, if it exists, and pass
    it on to kadmind
  - pick up $KRB524D_ARGS from /etc/sysconfig/krb524, if it exists, and pass
    it on to krb524d *instead of* "-m"
  - set "forwardable" in [libdefaults] in the default krb5.conf to match the
    default setting which we supply for pam_krb5
  - set a default of 24h for "ticket_lifetime" in [libdefaults], reflecting the
    compiled-in default


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - silence compiler warning in kprop by using an in-memory ccache with a fixed
    name instead of an on-disk ccache with a name generated by tmpnam()


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove rc4-hmac:norealm and rc4-hmac:onlyrealm from the default list of
    supported keytypes in kdc.conf -- they produce exactly the same keys as
    rc4-hmac:normal because rc4 string-to-key ignores salts
  - nuke kdcrotate -- there are better ways to balance the load on KDCs, and
    the SELinux policy for it would have been scary-looking
  - update to 1.3.5, mainly to include MITKRB5SA 2004-002 and 2004-003


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.4-3
changelog:
  - incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772
    (MITKRB5-SA-2004-002, #130732)
  - incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, #130732)


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.3-2
changelog:
  - re-enable large file support, fell out in 1.3-1
  - patch rcp to use long long and %lld format specifiers when reporting file
    sizes on large files


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.1-9
changelog:
  - remove patch to set TERM in klogind which, combined with the upstream fix in
    1.3.1, actually produces the bug now (#114762)


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.1-8
changelog:
  - when iterating over lists of interfaces which are "up" from getifaddrs(),
    skip over those which have no address (#113347)


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.1-6
changelog:
  - fix bug in patch to make rlogind start login with a clean environment a la
    netkit rlogin, spotted and fixed by Scott McClung


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.1-5
changelog:
  - include profile.d scriptlets in krb5-devel so that krb5-config will be in
    the path if krb5-workstation isn't installed, reported by Kir Kolyshkin


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add more etypes (arcfour) to the default enctype list in kdc.conf
  - don't apply previous patch, refused upstream


author: Nalin Dahyabhai <nalin@redhat.com> 1.3-2
changelog:
  - pull fix for non-compliant encoding of salt field in etype-info2 preauth
    data from 1.3.1 beta 1, until 1.3.1 is released.


author: Nalin Dahyabhai <nalin@redhat.com> 1.3-0.beta.4
changelog:
  - test update to 1.3 beta 4
  - ditch statglue build option
  - krb5-devel requires e2fsprogs-devel, which now provides libss and libcom_err


author: Jakub Jelinek <jakub@redhat.com> 1.2.7-2
changelog:
  - always #include <errno.h> to access errno, never do it directly
  - enable LFS on a bunch of other 32-bit arches


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - increase the maximum name length allowed by kuserok() to the higher value
    used in development versions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - install src/krb524/README as README.krb524 in the -servers package,
    includes information about converting for AFS principals


author: Nalin Dahyabhai <nalin@redhat.com> 1.2.6-2
changelog:
  - remove hashless key types from the default kdc.conf, they're not supposed to
    be there, noted by Sam Hartman on krbdev


author: Nalin Dahyabhai <nalin@redhat.com> 1.2.3-1
changelog:
  - rename the krb5 package back to krb5-libs; the previous rename caused
    something of an uproar
  - update to 1.2.3, which includes the FTP and telnetd fixes
  - configure without --enable-dns-for-kdc --enable-dns-for-realm, which now set
    the default behavior instead of enabling the feature (the feature is enabled
    by --enable-dns, which we still use)
  - reenable optimizations on Alpha
  - support more encryption types in the default kdc.conf (heads-up from post
    to comp.protocols.kerberos by Jason Heiss)


author: Nalin Dahyabhai <nalin@redhat.com> 1.2.2-14
changelog:
  - rename the krb5-libs package to krb5 (naming a subpackage -libs when there
    is no main package is silly)
  - move defaults for PAM to the appdefaults section of krb5.conf -- this is
    the area where the krb5_appdefault_* functions look for settings)
  - disable statglue (warning: breaks binary compatibility with previous
    packages, but has to be broken at some point to work correctly with
    unpatched versions built with newer versions of glibc)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add patch to support "ANY" keytab type (i.e.,
    "default_keytab_name = ANY:FILE:/etc/krb5.keytab,SRVTAB:/etc/srvtab"
    patch from Gerald Britton, #42551)
  - build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (#30697)
  - patch ftpd to use long long and %lld format specifiers to support the SIZE
    command on large files (also #30697)
  - don't use LOG_AUTH as an option value when calling openlog() in ksu (#45965)
  - implement reload in krb5kdc and kadmind init scripts (#41911)
  - lose the krb5server init script (not using it any more)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.2, which fixes some bugs relating to empty ETYPE-INFO
  - re-enable optimization on Alpha


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix krb5-send-pr (#18932) and move it from -server to -workstation
  - buildprereq libtermcap-devel
  - temporariliy disable optimization on alphas
  - gettextize init scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make krb5-libs obsolete the old krb5-configs package (#18351)
  - don't quit from the kpropd init script if there's no principal database so
    that you can propagate the first time without running kpropd manually
  - don't complain if /etc/ld.so.conf doesn't exist in the -libs %post


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix credential forwarding problem in klogind (goof in KRB5CCNAME handling)
    (#11588)
  - fix heap corruption bug in FTP client (#14301)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix summaries and descriptions
  - switched the default transfer protocol from PORT to PASV as proposed on
    bugzilla (#16134), and to match the regular ftp package's behavior


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable servers by default to keep linuxconf from thinking they need to be
    started when they don't


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move condrestarts to postun
  - make xinetd configs noreplace
  - add descriptions to xinetd configs
  - add /etc/init.d as a prereq for the -server package
  - patch to properly truncate $TERM in krlogind


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.1
  - back out Tom Yu's patch, which is a big chunk of the 1.2 -> 1.2.1 update
  - start using the official source tarball instead of its contents


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Tom Yu's patch to fix compatibility between 1.2 kadmin and 1.1.1 kadmind
  - pull out 6.2 options in the spec file (sonames changing in 1.2 means it's not
    compatible with other stuff in 6.2, so no need)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to the 1.2 release
  - ditch a lot of our patches which went upstream
  - enable use of DNS to look up things at build-time
  - disable use of DNS to look up things at run-time in default krb5.conf
  - change ownership of the convert-config-files script to root.root
  - compress PS docs
  - fix some typos in the kinit man page
  - run condrestart in server post, and shut down in preun


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch mkdir/rmdir problem in ftpcmd.y
  - add condrestart option to init script
  - split the server init script into three pieces and add one for kpropd


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - apply second set of buffer overflow fixes from Tom Yu
  - fix from Dirk Husung for a bug in buffer cleanups in the test suite
  - work around possibly broken rev binary in running test suite
  - move default realm configs from /var/kerberos to /var/kerberos


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - use %{_infodir} to better comply with FHS
  - move .so files to -devel subpackage
  - tweak xinetd config files (bugs #11833, #11835, #11836, #11840)
  - fix package descriptions again


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change a LINE_MAX to 1024, fix from Ken Raeburn
  - add fix for login vulnerability in case anyone rebuilds without krb4 compat
  - add tweaks for byte-swapping macros in krb.h, also from Ken
  - add xinetd config files
  - make rsh and rlogin quieter
  - build with debug to fix credential forwarding
  - add rsh as a build-time req because the configure scripts look for it to
    determine paths


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove setuid bit on v4rcp and ksu in case the checks previously added
    don't close all of the problems in ksu
  - apply patches from Jeffrey Schiller to fix overruns Chris Evans found
  - reintroduce configs subpackage for use in the errata
  - add PreReq: sh-utils


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix double-free in the kdc (patch merged into MIT tree)
  - include convert-config-files script as a documentation file


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch ksu man page because the -C option never works
  - add access() checks and disable debug mode in ksu
  - modify default ksu build arguments to specify more directories in CMD_PATH
    and to use getusershell()


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add LDCOMBINE=-lc to configure invocation to use libc versioning (bug #10653)
  - change Requires: for/in subpackages to include 1.6.1


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge krb5-configs back into krb5-libs.  The krb5.conf file is marked as
    a %config file anyway.
  - Make krb5.conf a noreplace config file.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't enable the server by default.
  - Compress info pages.
  - Add defaults for the PAM module to krb5.conf


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Correct copyright: it's exportable now, provided the proper paperwork is
    filed with the government.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - apply Mike Friedman's patch to fix format string problems
  - don't strip off argv[0] when invoking regular rsh/rlogin


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak server init script to automatically extract kadm5 keys if
    /var/kerberos/krb5kdc/kadm5.keytab doesn't exist yet
  - adjust package descriptions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch around TIOCGTLC defined on alpha and remove warnings from libpty.h
  - add installation of info docs
  - remove krb4 compat patch because it doesn't fix workstation-side servers


author: Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
changelog:
  - clean up init script for server, verify that it works [jlkatz]
  - clean up rotation script so that rc likes it better
  - add clean stanza


author: Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
changelog:
  - backed out ncurses and makeshlib patches
  - update for krb5-1.1
  - add KDC rotation to rc.boot, based on ideas from Michael's C version


author: Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
changelog:
  - started changelog (previous package from zedz.net)
  - updated existing 1.0.5 RPM from Eos Linux to krb5 1.0.6
  - added --force to makeinfo commands to skip errors during build


author: Philip J Perry <phil@elrepo.org> - 5-4
changelog:
  - Add requires for kernel to prevent installing on wrong dist.
  - Fix name of Extras repository
    [http://elrepo.org/bugs/view.php?id=339]


author: Akemi Yagi <toracat@elrepo.org> - 5-3
changelog:
  - Added extras repo
  - Enable elrepo repo by default
  - Clean up the code in the spec file [Alan Bartlett <ajb@elrepo.org>]


author: Akemi Yagi <toracat@elrepo.org> - 5-1
changelog:
  - Release number now has 5-x format
  - Added kernel repo
  - Removed fasttrack repo
  - Added mirror sites


author: Troy Dawson <dawson@fnal.gov> - 8.3.7-1
changelog:
  - Update to 8.3.7
  - Separated the kernel module out to a separate rpm
    This is because the driver is now in the generic kernel
  - Combined spec files from atrpms and normal SL kernel module specs


author: Konstantin Ryabitsev <icon@fedoraproject.org> - 1.10.1-1
changelog:
  - Upstream 1.10.1:
          - Fixes to build against pidgin-2.7
          - Initial support for Office 2007+ "Access Levels"
          - SVG icon artwork
          - Miscellaneous bugfixes


author: Konstantin Ryabitsev <icon@fedoraproject.org> - 1.9.1-1
changelog:
  - Upstream 1.9.1:
          - Fix Kerberos authentication for unix platforms (broken in 1.9.0)
          - Bugfixes


author: Konstantin Ryabitsev <icon@fedoraproject.org> - 1.9.0-1
changelog:
  - Upstream 1.9.0:
          - Contributed File transfer functionality. File encryption is supported.
          - NTLMv2 and NTLMv2 Session Security support
          - Implemented SIP Authentication Extensions protocol version 4 and 3
          - another shot at presence update problems
          - fix crash caused by uninitialized security contexts
          - Updated translations: ru, de, es, pt_BR
          - Bugfixes and crash fixes
  - BR libpurple >= 2.4.0
  - Split into purple-sipe and pidgin-sipe
  - Other spec fixes to match upstream's spec file


author: Konstantin Ryabitsev <icon@fedoraproject.org> - 1.8.0-1
changelog:
  - Upstream 1.8.0 (new features)
  - Exchange Calendar integration
  - New and updated translations
  - Bugfixes


author: Pat Riehecky <riehecky@fnal.gov> 1.0-4
changelog:
  - Comment addition is now in its own block so that failure
     to leave a comment doesn't prevent the config changes
     from happening.


author: Pat Riehecky <riehecky@fnal.gov> 1.0-3
changelog:
  - Sets up mod_userdir with no indexes too
  - Now leaves a comment behind saying what it did
  - Now archives httpd.conf before making the edits


author: Troy Dawson <dawson@fnal.gov> 51-0.1.rolling.SL
changelog:
  - Changed the repos from 50 to 5rolling
  - Changed the default from ftp to http, with ftp as the fallback


author: Troy Dawson <dawson@fnal.gov> 50-1.SL
changelog:
  - Change repositories from 5rolling to 50
  - Added sl-fastbugs, sl-bugfix-51, sl-contrib, sl-debuginfo, sl-srpms repositories


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 1.0.1-1
  - Update source tarball to revision: 6fc5ce8302ab (stable-1.0) tip
  - Statistics:
      Changesets:      170
      Diff:            816 files changed, 7633 insertions(+), 6286 deletions(-)
  - Changes since Pacemaker-1.0.1
  + High: ais: Allow the crmd to get callbacks whenever a node's state changes
  + High: ais: Create an option for starting the mgmtd daemon automatically
  + High: ais: Ensure HA_RSCTMP exists for use by resource agents
  + High: ais: Hook up the openais.conf config logging options
  + High: ais: Zero out the PID of disconnecting clients
  + High: cib: Ensure global updates cause a disk write when appropriate
  + High: Core: Add an extra snaity check to getXpathResults() to prevent segfaults
  + High: Core: Don't redefine __FUNCTION__ unnecessarily
  + High: Core: Repair the ability to have comments in the configuration
  + High: crmd: Bug:1975 - crmd should wait indefinitely for stonith operations to complete
  + High: crmd: Ensure PE processing does not occur for all error cases in do_pe_invoke_callback
  + High: crmd: Requests to the CIB should cause any prior PE calculations to be ignored
  + High: heartbeat: Wait for membership 'up' events before removing stale node status data
  + High: PE: Bug LF:1988 - Ensure recurring operations always have the correct target-rc set
  + High: PE: Bug LF:1988 - For unmanaged resources we need to skip the usual can_run_resources() checks
  + High: PE: Ensure the terminate node attribute is handled correctly
  + High: PE: Fix optional colocation
  + High: PE: Improve up the detection of 'new' nodes joining the cluster
  + High: PE: Prevent assert failures in master_color() by ensuring unmanaged masters are always reallocated to their current location
  + High: Tools: crm cli: parser: return False on syntax error and None for comments
  + High: Tools: crm cli: unify template and edit commands
  + High: Tools: crm_shadow - Show more line number information after validation failures
  + High: Tools: hb2openais: add option to upgrade the CIB to v3.0
  + High: Tools: hb2openais: add U option to getopts and update usage
  + High: Tools: hb2openais: backup improved and multiple fixes
  + High: Tools: hb2openais: fix class/provider reversal
  + High: Tools: hb2openais: fix testing
  + High: Tools: hb2openais: move the CIB update to the end
  + High: Tools: hb2openais: update logging and set logfile appropriately
  + High: Tools: LF:1969 - Attrd never sets any properties in the cib
  + High: Tools: Make attrd functional on OpenAIS
  + Medium: ais: Hook up the options for specifying the expected number of nodes and total quorum votes
  + Medium: ais: Look for pacemaker options inside the service block with 'name: pacemaker' instead of creating an addtional configuration block
  + Medium: ais: Provide better feedback when nodes change nodeid's (in openais.conf)
  + Medium: cib: Always store cib contents on disk with num_updates=0
  + Medium: cib: Ensure remote access ports are cleaned up on shutdown
  + Medium: crmd: Detect deleted resource operations automatically
  + Medium: crmd: Erase a node's resource operations and transient attributes after a successful STONITH
  + Medium: crmd: Find a more appropriate place to update quorum and refresh attrd attributes
  + Medium: crmd: Fix the handling of unexpected PE exits to ensure the current CIB is stored
  + Medium: crmd: Fix the recording of pending operations in the CIB
  + Medium: crmd: Initiate an attrd refresh _after_ the status section has been fully repopulated
  + Medium: crmd: Only the DC should update quorum in an openais cluster
  + Medium: Ensure meta attributes are used consistantly
  + Medium: PE: Allow group and clone level resource attributes
  + Medium: PE: Bug N:437719 - Ensure scores from colocated resources count when allocating groups
  + Medium: PE: Prevent lsb scripts from being used in globally unique clones
  + Medium: PE: Make a best-effort guess at a migration threshold for people with 0.6 configs
  + Medium: Resources: controld - ensure we are part of a clone with globally_unique=false
  + Medium: Tools: attrd - Automatically refresh all attributes after a CIB replace operation
  + Medium: Tools: Bug LF:1985 - crm_mon - Correctly process failed cib queries to allow reconnection after cluster restarts
  + Medium: Tools: Bug LF:1987 - crm_verify incorrectly warns of configuration upgrades for the most recent version
  + Medium: Tools: crm (bnc#441028): check for key error in attributes management
  + Medium: Tools: crm_mon - display the meaning of the operation's rc code instead of the status
  + Medium: Tools: crm_mon - Fix the display of timing data
  + Medium: Tools: crm_verify - check that we're being asked to validate a complete config
  + Medium: xml: Relax the restriction on the contents of rsc_locaiton.node


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 1.0.0-1
  - Update source tarball to revision: 388654dfef8f tip
  - Statistics:
      Changesets:      261
      Diff:            3021 files changed, 244985 insertions(+), 111596 deletions(-)
  - Changes since f805e1b30103
  + High: add the crm cli program
  + High: ais: Move the service id definition to a common location and make sure it is always used
  + High: build: rename hb2openais.sh to .in and replace paths with vars
  + High: cib: Implement --create for crm_shadow
  + High: cib: Remove dead files
  + High: Core: Allow the expected number of quorum votes to be configrable
  + High: Core: cl_malloc and friends were removed from Heartbeat
  + High: Core: Only call xmlCleanupParser() if we parsed anything.  Doing so unconditionally seems to cause a segfault
  + High: hb2openais.sh: improve pingd handling; several bugs fixed
  + High: hb2openais: fix clone creation; replace EVMS strings
  + High: new hb2openais.sh conversion script
  + High: PE: Bug LF:1950 - Ensure the current values for all notification variables are always set (even if empty)
  + High: PE: Bug LF:1955 - Ensure unmanaged masters are unconditionally repromoted to ensure they are monitored correctly.
  + High: PE: Bug LF:1955 - Fix another case of filtering causing unmanaged master failures
  + High: PE: Bug LF:1955 - Umanaged mode prevents master resources from being allocated correctly
  + High: PE: Bug N:420538 - Anit-colocation caused a positive node preference
  + High: PE: Correctly handle unmanaged resources to prevent them from being started elsewhere
  + High: PE: crm_resource - Fix the --migrate command
  + High: PE: MAke stonith-enabled default to true and warn if no STONITH resources are found
  + High: PE: Make sure orphaned clone children are created correctly
  + High: PE: Monitors for unmanaged resources don't need to wait for start/promote/demote actions to complete
  + High: stonithd (LF 1951): fix remote stonith operations
  + High: stonithd: fix handling of timeouts
  + High: stonithd: fix logic for stonith resource priorities
  + High: stonithd: implement the fence-timeout instance attribute
  + High: stonithd: initialize value before reading fence-timeout
  + High: stonithd: set timeouts for fencing ops to the timeout of the start op
  + High: stonithd: stonith rsc priorities (new feature)
  + High: Tools: Add hb2openais - a tool for upgrading a Heartbeat cluster to use OpenAIS instead
  + High: Tools: crm_verify - clean up the upgrade logic to prevent crash on invalid configurations
  + High: Tools: Make pingd functional on Linux
  + High: Update version numbers for 1.0 candidates
  + Medium: ais: Add support for a synchronous call to retrieve the node's nodeid
  + Medium: ais: Use the agreed service number
  + Medium: Build: Reliably detect heartbeat libraries during configure
  + Medium: Build: Supply prototypes for libreplace functions when needed
  + Medium: Build: Teach configure how to find corosync
  + Medium: Core: Provide better feedback if Pacemaker is started by a stack it doesn't support
  + Medium: crmd: Avoid calling GHashTable functions with NULL
  + Medium: crmd: Delay raising I_ERROR when the PE exits until we've had a chance to save the current CIB
  + Medium: crmd: Hook up the stonith-timeout option to stonithd
  + Medium: crmd: Prevent potential use-of-NULL in global_timer_callback
  + Medium: crmd: Rationalize the logging of graph aborts
  + Medium: PE: Add a stonith_timeout option and remove new options that are better set in rsc_defaults
  + Medium: PE: Allow external entities to ask for a node to be shot by creating a terminate=true transient node attribute
  + Medium: PE: Bug LF:1950 - Notifications do not contain all documented resource state fields
  + Medium: PE: Bug N:417585 - Don't restart group children who's individual score drops below zero
  + Medium: PE: Detect clients that disconnect before receiving their reply
  + Medium: PE: Implement a true maintenance mode
  + Medium: PE: Implement on-fail=standby for NTT.  Derived from a patch by Satomi TANIGUCHI
  + Medium: PE: Print the correct message when stonith is disabled
  + Medium: PE: ptest - check the input is valid before proceeding
  + Medium: PE: Revert group stickiness to the 'old way'
  + Medium: PE: Use the correct attribute for action 'requires' (was prereq)
  + Medium: stonithd: Fix compilation without full heartbeat install
  + Medium: stonithd: exit with better code on empty host list
  + Medium: tools: Add a new regression test for CLI tools
  + Medium: tools: crm_resource - return with non-zero when a resource migration command is invalid
  + Medium: tools: crm_shadow - Allow the admin to start with an empty CIB (and no cluster connection)
  + Medium: xml: pacemaker-0.7 is now an alias for the 1.0 schema


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 0.7.3-1
  - Update source tarball to revision: 33e677ab7764+ tip
  - Statistics:
      Changesets:      133
      Diff:            89 files changed, 7492 insertions(+), 1125 deletions(-)
  - Changes since f805e1b30103
  + High: Tools: add the crm cli program
  + High: Core: cl_malloc and friends were removed from Heartbeat
  + High: Core: Only call xmlCleanupParser() if we parsed anything.  Doing so unconditionally seems to cause a segfault
  + High: new hb2openais.sh conversion script
  + High: PE: Bug LF:1950 - Ensure the current values for all notification variables are always set (even if empty)
  + High: PE: Bug LF:1955 - Ensure unmanaged masters are unconditionally repromoted to ensure they are monitored correctly.
  + High: PE: Bug LF:1955 - Fix another case of filtering causing unmanaged master failures
  + High: PE: Bug LF:1955 - Umanaged mode prevents master resources from being allocated correctly
  + High: PE: Bug N:420538 - Anit-colocation caused a positive node preference
  + High: PE: Correctly handle unmanaged resources to prevent them from being started elsewhere
  + High: PE: crm_resource - Fix the --migrate command
  + High: PE: MAke stonith-enabled default to true and warn if no STONITH resources are found
  + High: PE: Make sure orphaned clone children are created correctly
  + High: PE: Monitors for unmanaged resources don't need to wait for start/promote/demote actions to complete
  + High: stonithd (LF 1951): fix remote stonith operations
  + High: Tools: crm_verify - clean up the upgrade logic to prevent crash on invalid configurations
  + Medium: ais: Add support for a synchronous call to retrieve the node's nodeid
  + Medium: ais: Use the agreed service number
  + Medium: PE: Allow external entities to ask for a node to be shot by creating a terminate=true transient node attribute
  + Medium: PE: Bug LF:1950 - Notifications do not contain all documented resource state fields
  + Medium: PE: Bug N:417585 - Don't restart group children who's individual score drops below zero
  + Medium: PE: Implement a true maintenance mode
  + Medium: PE: Print the correct message when stonith is disabled
  + Medium: stonithd: exit with better code on empty host list
  + Medium: xml: pacemaker-0.7 is now an alias for the 1.0 schema


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 0.7.1-1
  - Update source tarball to revision: f805e1b30103+ tip
  - Statistics:
      Changesets:      184
      Diff:            513 files changed, 43408 insertions(+), 43783 deletions(-)
  - Testing Notes:
  + Test hardware:
  + All testing was performed with STONITH enabled
  + Pending bugs encountered during testing:
  - Changes since 0.7.0-19
  + Fix compilation when GNUTLS isnt found
  + Hg: Use the default branch name for dev
  + High: admin: Fix use-after-free in crm_mon
  + High: Build: Remove testing code that prevented heartbeat-only builds
  + High: cib: Use single quotes so that the xpath queries for nvpairs will succeed
  + High: crmd: Always connect to stonithd when the TE starts and ensure we notice if it dies
  + High: crmd: Correctly handle a dead PE process
  + High: crmd: Make sure async-failures cause the failcount to be incrimented
  + High: PE: Bug LF:1941 - Handle failed clone instance probes when clone-max < #nodes
  + High: PE: Parse resource ordering sets correctly
  + High: PE: Prevent use-of-NULL - order->rsc_rh will not always be non-NULL
  + High: PE: Unpack colocation sets correctly
  + High: Tools: crm_mon - Prevent use-of-NULL for orphaned resources
  + Medium: ais: Add support for a synchronous call to retrieve the node's nodeid
  + Medium: ais: Allow transient clients to receive membership updates
  + Medium: ais: Avoid double-free in error path
  + Medium: ais: Include in the mebership nodes for which we haven't determined their hostname
  + Medium: ais: Spawn the PE from the ais plugin instead of the crmd
  + Medium: cib: By default, new configurations use the latest schema
  + Medium: cib: Clean up the CIB if it was already disconnected
  + Medium: cib: Only incriment num_updates if something actually changed
  + Medium: cib: Prevent use-after-free in client after abnormal termination of the CIB
  + Medium: Core: Fix memory leak in xpath searches
  + Medium: Core: Get more details regarding parser errors
  + Medium: Core: Repair expand_plus_plus - don't call char2score on unexpanded values
  + Medium: Core: Switch to the libxml2 parser - its significantly faster
  + Medium: Core: Use a libxml2 library function for xml -> text conversion
  + Medium: crmd: Asynchronous failure actions have no parameters
  + Medium: crmd: Avoid calling glib functions with NULL
  + Medium: crmd: Do not allow an election to promote a node from S_STARTING
  + Medium: crmd: Do not vote if we've not completed the local startup
  + Medium: crmd: Fix te_update_diff() now that get_object_root() functions differently
  + Medium: crmd: Fix the lrmd xpath expressions to not contain quotes
  + Medium: crmd: If we get a join offer during an election, better restart the election
  + Medium: crmd: No further processing is needed when using the LRM's API call for failing resources
  + Medium: crmd: Only update have-quorum if the value changed
  + Medium: crmd: Repair the input validation logic in do_te_invoke
  + Medium: cts: CIB's can no longer contain comments
  + Medium: cts: Enable a bunch of tests that were incorrectly disabled
  + Medium: cts: The libxml2 parser wont allow v1 resources to use integers as parameter names
  + Medium: Don't use the cluster UID and GID directly.  Look them up based on the configured value of HA_CCMUSER
  + Medium: Fix compilation when heartbeat is not supported
  + Medium: PE: Allow groups to be involved in optional ordering constraints
  + Medium: PE: Allow sets of operations to be reused by multiple resources
  + Medium: PE: Bug LF:1941 - Mark extra clone instances as orphans and don't show inactive ones
  + Medium: PE: Determin the correct migration-threshold during resource expansion
  + Medium: PE: Implement no-quorum-policy=suicide (FATE #303619)
  + Medium: pengine: Clean up resources after stopping old copies of the PE
  + Medium: pengine: Teach the PE how to stop old copies of itself
  + Medium: Tools: Backport hb_report updates
  + Medium: Tools: cib_shadow - On create, spawn a new shell with CIB_shadow and PS1 set accordingly
  + Medium: Tools: Rename cib_shadow to crm_shadow


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 0.7.0-19
  - Update source tarball to revision: 007c3a1c50f5 (unstable) tip
  - Statistics:
      Changesets:      108
      Diff:            216 files changed, 4632 insertions(+), 4173 deletions(-)
  - Changes added since unstable-0.7
  + High: admin: Fix use-after-free in crm_mon
  + High: ais: Change the tag for the ais plugin to "pacemaker" (used in openais.conf)
  + High: ais: Log terminated processes as an error
  + High: cib: Performance - Reorganize things to avoid calculating the XML diff twice
  + High: PE: Bug LF:1941 - Handle failed clone instance probes when clone-max < #nodes
  + High: PE: Fix memory leak in action2xml
  + High: PE: Make OCF_ERR_ARGS a node-level error rather than a cluster-level one
  + High: PE: Properly handle clones that are not installed on all nodes
  + Medium: admin: cibadmin - Show any validation errors if the upgrade failed
  + Medium: admin: cib_shadow - Implement --locate to display the underlying filename
  + Medium: admin: cib_shadow - Implement a --diff option
  + Medium: admin: cib_shadow - Implement a --switch option
  + Medium: admin: crm_resource - create more compact constraints that don't use lifetime (which is deprecated)
  + Medium: ais: Approximate born_on for OpenAIS based clusters
  + Medium: cib: Remove do_id_check, it is a poor substitute for ID validation by a schema
  + Medium: cib: Skip construction of pre-notify messages if no-one wants one
  + Medium: Core: Attempt to streamline some key functions to increase performance
  + Medium: Core: Clean up XML parser after validation
  + Medium: crmd: Detect and optimize the crm's behavior when processing diffs of an LRM refresh
  + Medium: Fix memory leaks when resetting the name of an XML object
  + Medium: PE: Prefer the current location if it is one of a group of nodes with the same (highest) score


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 0.7.0-1
  - Update source tarball to revision: bde0c7db74fb tip
  - Statistics:
      Changesets:      439
      Diff:            676 files changed, 41310 insertions(+), 52071 deletions(-)
  - Changes added since stable-0.6
  + High: A new tool for setting up and invoking CTS
  + High: Admin: All tools now use --node (-N) for specifying node unames
  + High: Admin: All tools now use --xml-file (-x) and --xml-text (-X) for specifying where to find XML blobs
  + High: cib: Cleanup the API - remove redundant input fields
  + High: cib: Implement CIB_shadow - a facility for making and testing changes before uploading them to the cluster
  + High: cib: Make registering per-op callbacks an API call and renamed (for clarity) the API call for requesting notifications
  + High: Core: Add a facility for automatically upgrading old configurations
  + High: Core: Adopt libxml2 as the XML processing library - all external clients need to be recompiled
  + High: Core: Allow sending TLS messages larger than the MTU
  + High: Core: Fix parsing of time-only ISO dates
  + High: Core: Smarter handling of XML values containing quotes
  + High: Core: XML memory corruption - catch, and handle, cases where we're overwriting an attribute value with itself
  + High: Core: The xml ID type doesn't allow UUIDs that start with a number
  + High: Core: Implement XPath based versions of query/delete/replace/modify
  + High: Core: Remove some HA2.0.(3,4) compatability code
  + High: crmd: Overhaul the detection of nodes that are starting vs. failed
  + High: PE: Bug LF:1459 - Allow failures to expire
  + High: PE: Have the PE do non-persistent configuration upgrades before performing calculations
  + High: PE: Replace failure-stickiness with a simple 'migration-threshold'
  + High: TE: Simplify the design by folding the tengine process into the crmd
  + Medium: Admin: Bug LF:1438 - Allow the list of all/active resource operations to be queried by crm_resource
  + Medium: Admin: Bug LF:1708 - crm_resource should print a warning if an attribute is already set as a meta attribute
  + Medium: Admin: Bug LF:1883 - crm_mon should display fail-count and operation history
  + Medium: Admin: Bug LF:1883 - crm_mon should display operation timing data
  + Medium: Admin: Bug N:371785 - crm_resource -C doesn't also clean up fail-count attributes
  + Medium: Admin: crm_mon - include timing data for failed actions
  + Medium: ais: Read options from the environment since objdb isn't completely usable yet
  + Medium: cib: Add sections for op_defaults and rsc_defaults
  + Medium: cib: Better matching notification callbacks (for detecting duplicates and removal)
  + Medium: cib: Bug LF:1348 - Allow rules and attribute sets to be referenced for use in other objects
  + Medium: cib: BUG LF:1918 - By default, all cib calls now timeout after 30s
  + Medium: cib: Detect updates that decrease the version tuple
  + Medium: cib: Implement a client-side operation timeout - Requires LHA update
  + Medium: cib: Implement callbacks and async notifications for remote connections
  + Medium: cib: Make cib->cmds->update() an alias for modify at the API level (also implemented in cibadmin)
  + Medium: cib: Mark the CIB as disconnected if the IPC connection is terminated
  + Medium: cib: New call option 'cib_can_create' which can be passed to modify actions - allows the object to be created if it doesn't exist yet
  + Medium: cib: Reimplement get|set|delete attributes using XPath
  + Medium: cib: Remove some useless parts of the API
  + Medium: cib: Remove the 'attributes' scaffolding from the new format
  + Medium: cib: Implement the ability for clients to connect to remote servers
  + Medium: Core: Add support for validating xml against RelaxNG schemas
  + Medium: Core: Allow more than one item to be modified/deleted in XPath based operations
  + Medium: Core: Fix the sort_pairs function for creating sorted xml objects
  + Medium: Core: iso8601 - Implement subtract_duration and fix subtract_time
  + Medium: Core: Reduce the amount of xml copying occuring
  + Medium: Core: Support value='value+=N' XML updates (in addtion to value='value++')
  + Medium: crmd: Add support for lrm_ops->fail_rsc if its available
  + Medium: crmd: HB - watch link status for node leaving events
  + Medium: crmd: Bug LF:1924 - Improved handling of lrmd disconnects and shutdowns
  + Medium: crmd: Do not wait for actions with a start_delay over 5 minutes. Confirm them immediately
  + Medium: PE: Bug LF:1328 - Don't fencing nodes in clusters without managed resources
  + Medium: PE: Bug LF:1461 - Give transient node attributes (in <status/>) preference over persistent ones (in <nodes/>)
  + Medium: PE: Bug LF:1884, Bug LF:1885 - Implement N:M ordering and colocation constraints
  + Medium: PE: Bug LF:1886 - Create a resource and operation 'defaults' config section
  + Medium: PE: Bug LF:1892 - Allow recurring actions to be triggered at known times
  + Medium: PE: Bug LF:1926 - Probes should complete before stop actions are invoked
  + Medium: PE: Fix the standby when it's set as a transient attribute
  + Medium: PE: Implement a global 'stop-all-resources' option
  + Medium: PE: Implement cibpipe, a tool for performing/simulating config changes "offline"
  + Medium: PE: We don't allow colocation with specific clone instances
  + Medium: Tools: pingd - Implement a stack-independant version of pingd
  + Medium: xml: Ship an xslt for upgrading from 0.6 to 0.7


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 0.6.5-1
  - Update source tarball to revision: b9fe723d1ac5 tip
  - Statistics:
      Changesets:      48
      Diff:            37 files changed, 1204 insertions(+), 234 deletions(-)
  - Changes since Pacemaker-0.6.4
  + High: Admin: Repair the ability to delete failcounts
  + High: ais: Audit IPC handling between the AIS plugin and CRM processes
  + High: ais: Have the plugin create needed /var/lib directories
  + High: ais: Make sure the sync and async connections are assigned correctly (not swapped)
  + High: cib: Correctly detect configuration changes - num_updates does not count
  + High: PE: Apply stickiness values to the whole group, not the individual resources
  + High: PE: Bug N:385265 - Ensure groups are migrated instead of remaining partially active on the current node
  + High: PE: Bug N:396293 - Enforce manditory group restarts due to ordering constraints
  + High: PE: Correctly recover master instances found active on more than one node
  + High: PE: Fix memory leaks reported by Valgrind
  + Medium: Admin: crm_mon - Misc improvements from Satomi Taniguchi
  + Medium: Bug LF:1900 - Resource stickiness should not allow placement in asynchronous clusters
  + Medium: crmd: Ensure joins are completed promptly when a node taking part dies
  + Medium: PE: Avoid clone instance shuffling in more cases
  + Medium: PE: Bug LF:1906 - Remove an optimization in native_merge_weights() causing group scores to behave eratically
  + Medium: PE: Make use of target_rc data to correctly process resource operations
  + Medium: PE: Prevent a possible use of NULL in sort_clone_instance()
  + Medium: TE: Include target rc in the transition key - used to correctly determin operation failure


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 0.6.4-1
  - Update source tarball to revision: 226d8e356924 tip
  - Statistics:
      Changesets:       55
      Diff:             199 files changed, 7103 insertions(+), 12378 deletions(-)
  - Changes since Pacemaker-0.6.3
  + High: crmd: Bug LF:1881 LF:1882 - Overhaul the logic for operation cancelation and deletion
  + High: crmd: Bug LF:1894 - Make sure cancelled recurring operations are cleaned out from the CIB
  + High: PE: Bug N:387749 - Colocation with clones causes unnecessary clone instance shuffling
  + High: PE: Ensure 'master' monitor actions are cancelled _before_ we demote the resource
  + High: PE: Fix assert failure leading to core dump - make sure variable is properly initialized
  + High: PE: Make sure 'slave' monitoring happens after the resource has been demoted
  + High: PE: Prevent failure stickiness underflows (where too many failures become a _positive_ preference)
  + Medium: Admin: crm_mon - Only complain if the output file could not be opened
  + Medium: Common: filter_action_parameters - enable legacy handling only for older versions
  + Medium: PE: Bug N:385265 - The failure stickiness of group children is ignored until it reaches -INFINITY
  + Medium: PE: Implement master and clone colocation by exlcuding nodes rather than setting one's score to INFINITY (similar to cs: 756afc42dc51)
  + Medium: TE: Bug LF:1875 - Correctly find actions to cancel when their node leaves the cluster


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 0.6.3-1
  - Update source tarball to revision: fd8904c9bc67 tip
  - Statistics:
      Changesets:      117
      Diff:            354 files changed, 19094 insertions(+), 11338 deletions(-)
  - Changes since Pacemaker-0.6.2
  + High: Admin: Bug LF:1848 - crm_resource - Pass set name and id to delete_resource_attr() in the correct order
  + High: Build: SNMP has been moved to the management/pygui project
  + High: crmd: Bug LF1837 - Unmanaged resources prevent crmd from shutting down
  + High: crmd: Prevent use-after-free in lrm interface code (Patch based on work by Keisuke MORI)
  + High: PE: Allow the cluster to make progress by not retrying failed demote actions
  + High: PE: Anti-colocation with slave shouldn't prevent master colocation
  + High: PE: Bug LF 1768 - Wait more often for STONITH ops to complete before starting resources
  + High: PE: Bug LF1836 - Allow is-managed-default=false to be overridden by individual resources
  + High: PE: Bug LF185 - Prevent pointless master/slave instance shuffling by ignoring the master-pref of stopped instances
  + High: PE: Bug N-191176 - Implement interleaved ordering for clone-to-clone scenarios
  + High: PE: Bug N-347004 - Ensure clone notifications are always sent when an instance is stopped/started
  + High: PE: Bug N-347004 - Include notification ordering is correct for interleaved clones
  + High: PE: Bug PM-11 - Directly link probe_complete to starting clone instances
  + High: PE: Bug PM1 - Fix setting failcounts when applied to complex resources
  + High: PE: Bug PM12, LF1648 - Extensive revision of group ordering
  + High: PE: Bug PM7 - Ensure masters are always demoted before they are stopped
  + High: PE: Create probes after allocation to allow smarter handling of anonymous clones
  + High: PE: Don't prioritize clone instances that must be moved
  + High: PE: Fix error in previous commit that allowed more than the required number of masters to be promoted
  + High: PE: Group start ordering fixes
  + High: PE: Implement promote/demote ordering for cloned groups
  + High: TE: Repair failcount updates
  + High: TE: Use the correct offset when updating failcount
  + Medium: Admin: Add a summary output that can be easily parsed by CTS for audit purposes
  + Medium: Build: Make configure fail if bz2 or libxml2 are not present
  + Medium: Build: Re-instate a better default for LCRSODIR
  + Medium: CIB: Bug LF-1861 - Filter irrelvant error status from synchronous CIB clients
  + Medium: Core: Bug 1849 - Invalid conversion of ordinal leap year to gregorian date
  + Medium: Core: Drop compataibility code for 2.0.4 and 2.0.5 clusters
  + Medium: crmd: Bug LF-1860 - Automatically cancel recurring ops before demote and promote operations (not only stops)
  + Medium: crmd: Save the current CIB contents if we detect the PE crashed
  + Medium: PE: Bug LF:1866 - Fix version check when applying compatability handling for failed start operations
  + Medium: PE: Bug LF:1866 - Restore the ability to have start failures not be fatal
  + Medium: PE: Bug PM1 - Failcount applies to all instances of non-unique clone
  + Medium: PE: Correctly set the state of partially active master/slave groups
  + Medium: PE: Don't claim to be stopping an already stopped orphan
  + Medium: PE: Ensure implies_left ordering constraints are always effective
  + Medium: PE: Indicate each resource's 'promotion' score
  + Medium: PE: Prevent a possible use-of-NULL
  + Medium: PE: Reprocess the current action if it changed (so that any prior dependancies are updated)
  + Medium: TE: Bug LF-1859 - Wait for fail-count updates to complete before terminating the transition
  + Medium: TE: Bug LF:1859 - Don't abort graphs due to our own failcount updates
  + Medium: TE: Bug LF:1859 - Prevent the TE from interupting itself


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 0.6.2-1
  - Update source tarball to revision: 28b1a8c1868b tip
  - Statistics:
      Changesets:    11
      Diff:          7 files changed, 58 insertions(+), 18 deletions(-)
  - Changes since Pacemaker-0.6.1
  + haresources2cib.py: set default-action-timeout to the default (20s)
  + haresources2cib.py: update ra parameters lists
  + Medium: SNMP: Allow the snmp subagent to be built (patch from MATSUDA, Daiki)
  + Medium: Tools: Make sure the autoconf variables in haresources2cib are expanded


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 0.6.1-1
  - Update source tarball to revision: e7152d1be933 tip
  - Statistics:
      Changesets:    25
      Diff:          37 files changed, 1323 insertions(+), 227 deletions(-)
  - Changes since Pacemaker-0.6.0
  + High: CIB: Ensure changes to top-level attributes (like admin_epoch) cause a disk write
  + High: CIB: Ensure the archived file hits the disk before returning
  + High: CIB: Repair the ability to do 'atomic incriment' updates (value="value++")
  + High: crmd: Bug #7 - Connecting to the crmd immediately after startup causes use-of-NULL
  + Medium: CIB: Mask cib_diff_resync results from the caller - they don't need to know
  + Medium: crmd: Delay starting the IPC server until we're fully functional
  + Medium: CTS: Fix the startup patterns
  + Medium: PE: Bug 1820 - Allow the first resource in a group to be migrated
  + Medium: PE: Bug 1820 - Check the colocation dependancies of resources to be migrated


author: Andrew Beekhof <abeekhof@suse.de>
changelog:
  - version 0.6.0-2
  - This is the first release of the Pacemaker Cluster Resource Manager formerly part of Heartbeat.
  - For those looking for the GUI, mgmtd, CIM or TSA components, they are now found in
    the new pacemaker-pygui project.  Build dependancies prevent them from being
    included in Heartbeat (since the built-in CRM is no longer supported) and,
    being non-core components, are not included with Pacemaker.
  - Update source tarball to revision: c94b92d550cf
  - Statistics:
      Changesets:      347
      Diff:            2272 files changed, 132508 insertions(+), 305991 deletions(-)
  - Test hardware:
    + 6-node vmware cluster (sles10-sp1/256Mb/vmware stonith) on a single host (opensuse10.3/2Gb/2.66Ghz Quad Core2)
    + 7-node EMC Centera cluster (sles10/512Mb/2Ghz Xeon/ssh stonith)
  - Notes: Heartbeat Stack
    + All testing was performed with STONITH enabled
    + The CRM was enabled using the "crm respawn" directive
    + Testing
      2-nodes ::= 1000 CTS iterations (passed)
      4-nodes ::= 1000 CTS iterations (passed)
      6-nodes ::= 2000 CTS iterations (passed)
    + Total estimated cluster transitions: 18000
  - Notes: OpenAIS Stack
    + This release contains a preview of support for the OpenAIS cluster stack
    + The current release of the OpenAIS project is missing two important
      patches that we require.  OpenAIS packages containing these patches are
      available for most major distributions at:
        http://download.opensuse.org/repositories/server:/ha-clustering
    + The OpenAIS stack is not currently recommended for use in clusters that
      have shared data as STONITH support is not yet implimented
    + pingd is not yet available for use with the OpenAIS stack
    + 3 significant OpenAIS issues were found during testing of 4 and 6 node
      clusters.  We are activly working together with the OpenAIS project to
      get these resolved.
    + Testing
      2-nodes ::= 1000 CTS iterations (passed)
      4-nodes ::= 1000 CTS iterations (sporadic problems - see pending bugs)
      6-nodes ::= 1000 CTS iterations (significant problems - see pending bugs)
    + Total estimated cluster transitions: 12000
  - Pending bugs encountered during testing:
    + OpenAIS   #1736 - Openais membership took 20s to stabilize
    + Heartbeat #1750 - ipc_bufpool_update: magic number in head does not match
    + OpenAIS   #1793 - Assertion failure in memb_state_gather_enter()
    + OpenAIS   #1796 - Cluster message corruption
  - Changes since Heartbeat-2.1.2-24
  + High: Add OpenAIS support
  + High: Admin: crm_uuid - Look in the right place for Heartbeat UUID files
  + High: admin: Exit and indicate a problem if the crmd exits while crmadmin is performing a query
  + High: cib: Fix CIB_OP_UPDATE calls that modify the whole CIB
  + High: cib: Fix compilation when supporting the heartbeat stack
  + High: cib: Fix memory leaks caused by the switch to get_message_xml()
  + High: cib: HA_VALGRIND_ENABLED needs to be set _and_ set to 1|yes|true
  + High: cib: Use get_message_xml() in preference to cl_get_struct()
  + High: cib: Use the return value from call to write() in cib_send_plaintext()
  + High: Core: ccm nodes can legitimately have a node id of 0
  + High: Core: Fix peer-process tracking for the Heartbeat stack
  + High: Core: Heartbeat doesn't send status notifications for nodes that were already part of the cluster.  Fake them instead
  + High: CRM: Add children to HA_Messages such that the field name matches F_XML_TAGNAME
  + High: crm: Adopt a more flexible appraoch to enabling Valgrind
  + High: crm: Fix compilation when bzip2 is not installed
  + High: CRM: Future-proof get_message_xml()
  + High: crmd: Filter election responses based on time not FSA state
  + High: crmd: Handle all possible peer states in crmd_ha_status_callback()
  + High: crmd: Make sure the current date/time is set - prevents use-of-NULL when evaluating rules
  + High: crmd: Relax an assertion regrading  ccm membership instances
  + High: crmd: Use (node->processes&crm_proc_ais) to accurately update the CIB after replace operations
  + High: crmd: Heartbeat: Accurately record peer client status
  + High: PE: Bug 1777 - Allow colocation with a resource in the Stopped state
  + High: PE: Bug 1822 - Prevent use-of-NULL in PromoteRsc()
  + High: PE: Implement three recovery policies based on op_status and op_rc
  + High: PE: Parse fail-count correctly (it may be set to ININFITY)
  + High: PE: Prevent graph-loop when stonith agents need to be moved around before a STONITH op
  + High: PE: Prevent graph-loops when two operations have the same name+interval
  + High: te: Cancel active timers when destroying graphs
  + High: TE: Ensure failcount is set correctly for failed stops/starts
  + High: TE: Update failcount for oeprations that time out
  + Medium: admin: Prevent hang in crm_mon -1 when there is no cib connection - Patch from Junko IKEDA
  + Medium: cib: Require --force|-f when performing potentially dangerous commands with cibadmin
  + Medium: cib: Tweak the shutdown code
  + Medium: Common: Only count peer processes of active nodes
  + Medium: Core: Create generic cluster sign-in method
  + Medium: core: Fix compilation when Heartbeat support is disabled
  + Medium: Core: General cleanup for supporting two stacks
  + Medium: Core: iso6601 - Support parsing of time-only strings
  + Medium: core: Isolate more code that's only needed when SUPPORT_HEARTBEAT is enabled
  + Medium: crm: Improved logging of errors in the XML parser
  + Medium: crmd: Fix potential use-of-NULL in string comparison
  + Medium: crmd: Reimpliment syncronizing of CIB queries and updates when invoking the PE
  + Medium: crm_mon: Indicate when a node is both in standby mode and offline
  + Medium: PE: Bug 1822 - Don't try an promote groups if not all of it is active
  + Medium: PE: on_fail=nothing is an alias for 'ignore' not 'restart'
  + Medium: PE: Prevent a potential use-of-NULL in cron_range_satisfied()
  + snmp subagent: fix a problem on displaying an unmanaged group
  + snmp subagent: use the syslog setting
  + snmp: v2 support (thanks to Keisuke MORI)
  + snmp_subagent - made it not complain about some things if shutting down


author: Troy Dawson <dawson@fnal.gov> - 5.1-1
changelog:
  - Moved everything to 51
  - Added the new redhat rpm key
  - Changed sources to be 5rolling instead of 50


author: Troy Dawson <dawson@fnal.gov> - 5.0-3
changelog:
  - Changed sources to reflect the new directory structure
  - added trigger to get rid of additional cd's page of firstboot
  - added more rpm GPG keys


author: Pat Riehecky <riehecky@fnal.gov> 0.9.9-16
changelog:
  - made /etc/sysconfig/ocsinventory-fermi for control values
  - merged Connie's 'ip addr' patch for the cronjob
  - added requirement for iproute and iputils
  - added extra check for DNS resolution
  - added syntax check for cronjob at build time


author: Pat Riehecky <riehecky@fnal.gov> 0.9.9-15
changelog:
  - added missing dependency on /bin/mail
  - added /usr/lib/perl5/vendor_perl to @INC for non SLF systems (patch)
  - added /usr/share/perl5/vendor_perl to @INC for non SLF systems (patch)


author: Connie Sieh <csieh@fnal.gov> 0.9.9-14
changelog:
  - replaced "ifconfig" to "ip addr" in z_ocs.inventory.client.cron
  - ifconfig did not work with infiniband


author: Troy Dawson <dawson@fnal.gov> 0.9.9-7
changelog:
  - Updated cron to check to see if it can access the server
    and goes through a list of domains to see if it's at Fermilab


author: Troy Dawson <dawson@fnal.gov> 0.9.9-6
changelog:
  - Turned off debugging, check to see if we're on fermilab networks
  - Write to a log, and do logrotate
  - Minor fixes to the client to now do --local --xml


author: Troy Dawson <dawson@fnal.gov> 0.9.9-1
changelog:
  - Client now points to fortytwo as the server
  - cronjob now moved to z_... to get a more random time


author: Troy Dawson <dawson@fnal.gov> 0.9.8-3
changelog:
  - Client was updated 
  - Fixes issues with users using ups perl
  - Fixed issue when the rpm comments field has a newline in it.
  - Turned debug on the cron job so mail will get sent


