<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="68">
<package pkgid="a9af4eebdcf046ba8247f910fff682993c0dd062929e478feeb9e895f5f7119dce3301f09a209e06108ce333fa3c379eda493d64e3c9fab15adcf8a4331584bc" name="Fuse" arch="i586">
  <version epoch="0" ver="1.5.7" rel="14.12"/>
  <changelog author="serbalgi@gmail.com" date="1468843200">- Update to version 1.2.1
  * Emulation core improvements:
  * Fix bugs when the detect loaders feature is being used (thanks, Lee
    Tonks and windale) (Fredrick Meunier).
  * Debugger improvements:
  * Remove the need for "%" when accessing system variables (Philip
    Kendall).
  * Add Z80 registers as debugger variables (Philip Kendall).
  * Expose last byte written to the ULA, tstates since interrupt,
    primary and secondary memory control ports as debugger system
    variables (Philip Kendall).
  * Make breakpoints on events honour lifetime (Sergio Baldoví).
  * Extend breakpoints on paging events to more peripherals: Beta 128,
    +D, Didaktik 80, DISCiPLE, Opus Discovery and SpeccyBoot (Sergio
    Baldoví).
  * Split +D memory sources into RAM and ROM sections (Sergio Baldoví).
  * Coalesce +D and DISCiPLE RAM pages so they show as 8K pages (Sergio
    Baldoví).
  * Miscellaneous improvements:
  * Update GNOME .desktop file (Alberto Garcia).
  * Add an emulator module startup manager to automatically handle
    dependency issues (Philip Kendall).
  * Fix crash on widget UIs when hitting the close icon on the title bar
    several times (Sergio Baldoví).
- Update Fuse-desktop-file.patch: Accommodate upstream changes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1471867200">- Update to version 1.2.2
  * New features:
    + Support loading first tape, snapshot, dock cartridge or RZX file
    found inside .zip files (Patrik Rak and Sergio Baldoví).
    + Support auto-booting TR-DOS disk images without a boot file (thanks,
    windale, BogDan Vatra and Fredrick Meunier) (Sergio Baldoví).
  * Emulation core improvements:
    + Change microphone state when 0 tstate pulses do not have the no edge
    flag set (Fredrick Meunier).
  * Machine specific improvements:
    + Fix +3 disk autoload (thanks, windale and BogDan Vatra) (Sergio
    Baldoví and Fredrick Meunier).
    + Fix floppy drive selection when resetting a +3 (thanks, windale and
    BogDan Vatra) (Sergio Baldoví).
  * Miscellaneous improvements:
    + WidgetUI: Use description for tape blocks where available (Fredrick
    Meunier).
    + Use pkg-config to detect libpng and libxml2 (Alberto Garcia).
    + Various minor bugfixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1475496000">- Update to version 1.3.0
  * New features:
    + Recreated ZX Spectrum Bluetooth keyboard support (thanks, thrice,
    Philip Kendall and Sergio Baldoví) (Ekkehard Morgenstern).
  * Emulation core improvements:
    + Reset machine when auto-loading TRD/SCL disks (thanks, BogDan Vatra
    and Fredrick Meunier) (Sergio Baldoví).
  * Machine specific improvements:
    + Update +3e ROMs to v1.43 (Sergio Baldoví; thanks, Garry Lancaster).
  * Miscellaneous improvements:
    + Print summary of enabled features when building Fuse (Alberto
    Garcia).
    + Various minor bugfixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1481371200">- Update to version 1.3.2
  * Emulation core improvements:
    + Allow keyboard arrow keys to be used as a cursor joystick (thanks,
    solaris104) (Fredrick Meunier)
    + Limit sound generation to less than 500% speed (thanks, windale and
    Sergio Baldoví) (Fredrick Meunier).
    + Warn on inserting large disk image (thanks, Stefano Bodrato)
    (Fredrick Meunier)
  * Miscellaneous improvements:
    + WidgetUI: Fix order of Z80 flags in debugger (thanks, Marcos
    Cruz) (Sergio Baldoví).
    + Various minor bugfixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1493553600">- Update to version 1.3.5
  * Emulation core improvements:
    + Disable tape traps when playing/recording RZX files.
    + Add support for the hidden MEMPTR register.
    + Mark new disks as needing to be saved.
    + Show more information on disk modification status in menus.
  * Miscellaneous improvements:
    + WidgetUI: Fix memory leak in file selector.
    + Fix multiple save of disks.
    + Allow overwriting disk images.</changelog>
  <changelog author="serbalgi@gmail.com" date="1499688000">- Update to version 1.3.7
  * New features:
    + Add Multiface One/128/3 interface emulation.
  * Machine specific improvements:
    + Restore +2A/+3 ALL_RAM mode from snapshots.
  * Emulation core improvements:
    + Add Covox interface emulation.
    + Disable accelerate loader while recording RZX files.</changelog>
  <changelog author="serbalgi@gmail.com" date="1507809600">- Update to version 1.4.1
  * New features:
    + Add DivMMC emulation.
    + Add ZXMMC emulation.
  * Emulation core improvements:
    + Improvements to the loader acceleration code to reduce errors -
    Blood Brothers, City Slicker, Driller, Dynamite Dan, Games
    Compendium (by Gremlin), Joe Blade II, Kokotoni Wilf, Powerplay,
    Saboteur, Trapdoor and Zanthrax now all load successfully.
    + Multiface 3 returns values stored from ports 0x1ffd and 0x7ffd.
  * Debugger improvements:
    + Allow an exit code to be specified when using the "exit" command.
    + Add new "tape:microphone" and "spectrum:frames" system variables
    to allow access to the current tape level and frame count since
    reset.
  * Miscellaneous improvements:
    + Add support for MLT format screenshots.</changelog>
  <changelog author="serbalgi@gmail.com" date="1520164800">- Update to version 1.5.1
  * Debugger improvements:
    + Prevent crash when we try to disassemble an instruction with many
    DD or FD prefixes.
    + Fix crash when setting debugger variables.
    + Ensure conditional timed breakpoints work correctly.
  * Profiler improvements:
    + Prevent crash when we try to profile an instruction with many DD
    or FD prefixes.
  * Miscellaneous improvements:
    + GTK+ UI: Improve behaviour of default button on dialogs.
    + GTK+ and win32 UIs: Support hex numbers in load/save binary and
    pokefinder dialogs.
    + SDL UI: Allow to select the video mode used in full-screen.
    + Autoload snapshots replaced by a "phantom typist" which types
    LOAD "" or similar.
    + Alkatraz loaders (e.g. Cobra and Fairlight) are now accelerated.
- Several spec fixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1525176000">- Update to version 1.5.3
  * Emulation core improvements:
    + Emulate ROM bug loading zero length blocks when using tape traps.
    + Disable inactive peripherals after loading a snapshot.
  * Machine specific improvements:
    + Fix the format of double-sided +3 disks.
  * Miscellaneous improvements:
    + Spectrum reset is accelerated when phantom typist is enabled and a
    file is loaded from the menu.
    + Add options UI for phantom typist.
    + GTK+ 3 UI: Memory browser dialog allows to go to specific offset.
    + Re-enable sound after phantom typist finishes loading TAP, standard
    ROM TZX or +3 DSK images.</changelog>
  <changelog author="serbalgi@gmail.com" date="1530878400">- Update to version 1.5.5
  * Emulation core improvements:
    + Improve sound accuracy on Unix 64 bits systems.
  * Miscellaneous improvements:
    + Allow the use of real joystick hats/dpads in the SDL joystick code.
    + Add *.FMF as an allowed filetype to file selectors.
    + Save SCR from current display file.
    + Use 44.1KHz as default sound frequency.
    + Various minor bugfixes.</changelog>
</package>
<package pkgid="fbea1868d6a7aa690924e68ef46a1e60bfb7145d3b24d82709ed1aa8e71de80ffd56d81fa8164927127226060cbd7c7fa3ed9ae35ce8843c39a23f7e706b0810" name="Fuse" arch="src">
  <version epoch="0" ver="1.5.7" rel="14.12"/>
  <changelog author="uli@suse.de" date="1200830400">- update -&gt; 0.9.0</changelog>
  <changelog author="uli@suse.de" date="1229947200">- update -&gt; 0.10.0.1:
  * Writing files would not truncate the file at the correct point,
    leading to corrupt files when overwriting an existing file
    (Philip Kendall; thanks, Matthew Westcott).
  * Distribute ui/fb/fbmouse.h (Fredrick Meunier; thanks, rkd77).
  * New upd765 FDC emulation; all known +3 DSK images now work (Gergely
    Szasz; thanks to Simon Owen for expert technical advice).
  * Loading acceleration (Philip Kendall).
  * Automatic saves while using RZX recording (Philip Kendall).
  * Improved widget UI, with look and feel borrowed from that in FuseX
    (Fredrick Meunier; thanks, crabfists).
  * Emulation core improvements:
  * New --late-timings option to emulate machines with 1 tstate
    later timings (Philip Kendall)
  * Reading from the 128K's memory control port causes that byte to
    be written back to the port (Philip Kendall; thanks, Marat
    Fayzullin).
  * Reading the AY data port on the +2A/+3 is the same as reading
    the register port (Philip Kendall; thanks, Mark Woodmass).
  * NMI causes Z80 to unHALT (Philip Kendall; thanks, Simon Owen).
  * Emulate C, H and P/V flags on repeated IO instructions (Philip
    Kendall).
  * Fix crash when using Interface 1 on unoptimised Fuse builds
    (Philip Kendall).
  * Debugger improvements:
  * Debugger events to allow the debugger to stop when various
    Spectrum-level events happen (Philip Kendall).
  * Allow debugger commands to be run when a breakpoint is hit.
    No UI for this at present, but can be set from the command line.
    (Philip Kendall).
  * Command to exit emulator (Philip Kendall).
  * Make time breakpoints work properly when more than one is present
    (Philip Kendall).
  * Miscellaneous improvements:
  * Loader detection now works with the Digital Integration loader
    (Philip Kendall).
  * New HQ2X and HQ3x scalers (Gergely Szasz).
  * Revert Pentagon 128 to being the "base" machine without extra
    ROMs (Fredrick Meunier).
  * Updated +3e ROMs (Fredrick Meunier; thanks, Garry Lancaster).
  * Allow DivIDE, custom ROMs, Kempston mouse status and Simple 8-bit
    IDE interface to be saved in snapshots (Fredrick Meunier).
  * Better (but probably not perfect) TS2068 contention (Philip
    Kendall).
  * C89 compatibility fixes (Fredrick Meunier; thanks, sweetlilmr).
  * Remove GTK+'s build explicit dependency on Xlib (Philip Kendall).
- clean up spec file</changelog>
  <changelog author="uli@suse.de" date="1252411200">- update -&gt; 0.10.0.2:
  * Make loader acceleration work on all compilers (Philip Kendall;
    thanks, Carlos Almeida, Alberto Garcia and Alexander Yurchenko).
  * Make the "Don't Save" option in the widget UI do the right thing
    (Frederick Meunier).
  * Allow both +3 disk drives to be used at once (Gergely Szasz).
  * Allow both +D disk drives to be used at once (Gergely Szasz).
  * Make .dsk code handle missing newline on "Track-Info" header
    (Gergely Szasz; thanks, Simon Owen).
  * Remove unnecessary 'use' directive when building widget options
    header file; fixes some build issues (Frederick Meunier)
- unrequire lib765, libdsk</changelog>
  <changelog author="nmarques@opensuse.org" date="1317729600">- Update to version 1.0.0.1a:
  + Remove all ROMs for which there isn't explicit permission to
    distribute (Philip Kendall).
- Version 1.0.0.1
  + Fix temporary breakpoints on platforms using replacement Glib
    (Fredrick Meunier, Sergio Baldovi; thanks, Chris Cowley)
  + Ensure Amiga port can load files (Chris Young)
  + Fix SVGAlib compilation (rkd77)</changelog>
  <changelog author="serbalgi@gmail.com" date="1379332800">- add patch Fuse-1.0.0.1a-include-zlib.patch
  * Fix the build with libpng 1.5.X
- fix sound output by using alsa instead of libao.</changelog>
  <changelog author="serbalgi@gmail.com" date="1391342400">- Update to version 1.1.1
  * Add Spectranet ethernet interface emulation (Philip Kendall).
  * Add SpeccyBoot ethernet interface emulation (Patrik Persson).
  * Add SpecDrum sound interface emulation (Jon Mitchell).
  * Add DISCiPLE disk interface emulation (Stuart Brady).
    Sinclair Network emulation is not provided, and the interface is
    not available under 128K emulation in this release.
  * Support reading PZX files (Fredrick Meunier).
  * Add support for POK files (Sergio Baldoví).
  * Add recording of movies to FMF files (Gergely Szasz).
  * Various bugfixes.
- Desktop integration: add menu entry and register mime extensions.
- Add Fuse-desktop-file.patch: Use SUSE categories for menu entry.
- Drop Fuse-1.0.0.1a-include-zlib.patch: Upstream fixed.
- Add SDL-devel BuilRequires to enable joystick support.
- Fix package description.
- Modernize package license.</changelog>
  <changelog author="serbalgi@gmail.com" date="1405166400">- add patch Fuse-samdisk-dsk.patch
  * Fix load of SAMdisk dsk files</changelog>
  <changelog author="serbalgi@gmail.com" date="1465300800">- Update to version 1.2.0
  * New features:
    + Add Currah Source emulation (Stuart Brady).
    + Add Didaktik 80/40 emulation (Gergely Szasz).
    + Capture BASIC video functions to SVG file (Stefano Bodrato).
    + Support bash completion (Sergio Baldoví).
    + Allow continuing RZX recordings (Sergio Baldoví).
  * Really lots of bugfixes and miscellaneous improvements.
- Switch to GTK+ 3.
- Drop Fuse-samdisk-dsk.patch: Upstream fixed.
- Several spec fixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1468843200">- Update to version 1.2.1
  * Emulation core improvements:
  * Fix bugs when the detect loaders feature is being used (thanks, Lee
    Tonks and windale) (Fredrick Meunier).
  * Debugger improvements:
  * Remove the need for "%" when accessing system variables (Philip
    Kendall).
  * Add Z80 registers as debugger variables (Philip Kendall).
  * Expose last byte written to the ULA, tstates since interrupt,
    primary and secondary memory control ports as debugger system
    variables (Philip Kendall).
  * Make breakpoints on events honour lifetime (Sergio Baldoví).
  * Extend breakpoints on paging events to more peripherals: Beta 128,
    +D, Didaktik 80, DISCiPLE, Opus Discovery and SpeccyBoot (Sergio
    Baldoví).
  * Split +D memory sources into RAM and ROM sections (Sergio Baldoví).
  * Coalesce +D and DISCiPLE RAM pages so they show as 8K pages (Sergio
    Baldoví).
  * Miscellaneous improvements:
  * Update GNOME .desktop file (Alberto Garcia).
  * Add an emulator module startup manager to automatically handle
    dependency issues (Philip Kendall).
  * Fix crash on widget UIs when hitting the close icon on the title bar
    several times (Sergio Baldoví).
- Update Fuse-desktop-file.patch: Accommodate upstream changes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1471867200">- Update to version 1.2.2
  * New features:
    + Support loading first tape, snapshot, dock cartridge or RZX file
    found inside .zip files (Patrik Rak and Sergio Baldoví).
    + Support auto-booting TR-DOS disk images without a boot file (thanks,
    windale, BogDan Vatra and Fredrick Meunier) (Sergio Baldoví).
  * Emulation core improvements:
    + Change microphone state when 0 tstate pulses do not have the no edge
    flag set (Fredrick Meunier).
  * Machine specific improvements:
    + Fix +3 disk autoload (thanks, windale and BogDan Vatra) (Sergio
    Baldoví and Fredrick Meunier).
    + Fix floppy drive selection when resetting a +3 (thanks, windale and
    BogDan Vatra) (Sergio Baldoví).
  * Miscellaneous improvements:
    + WidgetUI: Use description for tape blocks where available (Fredrick
    Meunier).
    + Use pkg-config to detect libpng and libxml2 (Alberto Garcia).
    + Various minor bugfixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1475496000">- Update to version 1.3.0
  * New features:
    + Recreated ZX Spectrum Bluetooth keyboard support (thanks, thrice,
    Philip Kendall and Sergio Baldoví) (Ekkehard Morgenstern).
  * Emulation core improvements:
    + Reset machine when auto-loading TRD/SCL disks (thanks, BogDan Vatra
    and Fredrick Meunier) (Sergio Baldoví).
  * Machine specific improvements:
    + Update +3e ROMs to v1.43 (Sergio Baldoví; thanks, Garry Lancaster).
  * Miscellaneous improvements:
    + Print summary of enabled features when building Fuse (Alberto
    Garcia).
    + Various minor bugfixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1481371200">- Update to version 1.3.2
  * Emulation core improvements:
    + Allow keyboard arrow keys to be used as a cursor joystick (thanks,
    solaris104) (Fredrick Meunier)
    + Limit sound generation to less than 500% speed (thanks, windale and
    Sergio Baldoví) (Fredrick Meunier).
    + Warn on inserting large disk image (thanks, Stefano Bodrato)
    (Fredrick Meunier)
  * Miscellaneous improvements:
    + WidgetUI: Fix order of Z80 flags in debugger (thanks, Marcos
    Cruz) (Sergio Baldoví).
    + Various minor bugfixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1493553600">- Update to version 1.3.5
  * Emulation core improvements:
    + Disable tape traps when playing/recording RZX files.
    + Add support for the hidden MEMPTR register.
    + Mark new disks as needing to be saved.
    + Show more information on disk modification status in menus.
  * Miscellaneous improvements:
    + WidgetUI: Fix memory leak in file selector.
    + Fix multiple save of disks.
    + Allow overwriting disk images.</changelog>
  <changelog author="serbalgi@gmail.com" date="1499688000">- Update to version 1.3.7
  * New features:
    + Add Multiface One/128/3 interface emulation.
  * Machine specific improvements:
    + Restore +2A/+3 ALL_RAM mode from snapshots.
  * Emulation core improvements:
    + Add Covox interface emulation.
    + Disable accelerate loader while recording RZX files.</changelog>
  <changelog author="serbalgi@gmail.com" date="1507809600">- Update to version 1.4.1
  * New features:
    + Add DivMMC emulation.
    + Add ZXMMC emulation.
  * Emulation core improvements:
    + Improvements to the loader acceleration code to reduce errors -
    Blood Brothers, City Slicker, Driller, Dynamite Dan, Games
    Compendium (by Gremlin), Joe Blade II, Kokotoni Wilf, Powerplay,
    Saboteur, Trapdoor and Zanthrax now all load successfully.
    + Multiface 3 returns values stored from ports 0x1ffd and 0x7ffd.
  * Debugger improvements:
    + Allow an exit code to be specified when using the "exit" command.
    + Add new "tape:microphone" and "spectrum:frames" system variables
    to allow access to the current tape level and frame count since
    reset.
  * Miscellaneous improvements:
    + Add support for MLT format screenshots.</changelog>
  <changelog author="serbalgi@gmail.com" date="1520164800">- Update to version 1.5.1
  * Debugger improvements:
    + Prevent crash when we try to disassemble an instruction with many
    DD or FD prefixes.
    + Fix crash when setting debugger variables.
    + Ensure conditional timed breakpoints work correctly.
  * Profiler improvements:
    + Prevent crash when we try to profile an instruction with many DD
    or FD prefixes.
  * Miscellaneous improvements:
    + GTK+ UI: Improve behaviour of default button on dialogs.
    + GTK+ and win32 UIs: Support hex numbers in load/save binary and
    pokefinder dialogs.
    + SDL UI: Allow to select the video mode used in full-screen.
    + Autoload snapshots replaced by a "phantom typist" which types
    LOAD "" or similar.
    + Alkatraz loaders (e.g. Cobra and Fairlight) are now accelerated.
- Several spec fixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1525176000">- Update to version 1.5.3
  * Emulation core improvements:
    + Emulate ROM bug loading zero length blocks when using tape traps.
    + Disable inactive peripherals after loading a snapshot.
  * Machine specific improvements:
    + Fix the format of double-sided +3 disks.
  * Miscellaneous improvements:
    + Spectrum reset is accelerated when phantom typist is enabled and a
    file is loaded from the menu.
    + Add options UI for phantom typist.
    + GTK+ 3 UI: Memory browser dialog allows to go to specific offset.
    + Re-enable sound after phantom typist finishes loading TAP, standard
    ROM TZX or +3 DSK images.</changelog>
  <changelog author="serbalgi@gmail.com" date="1530878400">- Update to version 1.5.5
  * Emulation core improvements:
    + Improve sound accuracy on Unix 64 bits systems.
  * Miscellaneous improvements:
    + Allow the use of real joystick hats/dpads in the SDL joystick code.
    + Add *.FMF as an allowed filetype to file selectors.
    + Save SCR from current display file.
    + Use 44.1KHz as default sound frequency.
    + Various minor bugfixes.</changelog>
</package>
<package pkgid="eb221b254fa89d3217e2be96063de3083b74b03b1569d714e6414281a7e96953d074b52d923235ce41b1567aed843cf1b4fce8b3a3efd759015a78395441aa3f" name="Fuse" arch="src">
  <version epoch="0" ver="1.6.0" rel="2.79"/>
  <changelog author="uli@suse.de" date="1200830400">- update -&gt; 0.9.0</changelog>
  <changelog author="uli@suse.de" date="1229947200">- update -&gt; 0.10.0.1:
  * Writing files would not truncate the file at the correct point,
    leading to corrupt files when overwriting an existing file
    (Philip Kendall; thanks, Matthew Westcott).
  * Distribute ui/fb/fbmouse.h (Fredrick Meunier; thanks, rkd77).
  * New upd765 FDC emulation; all known +3 DSK images now work (Gergely
    Szasz; thanks to Simon Owen for expert technical advice).
  * Loading acceleration (Philip Kendall).
  * Automatic saves while using RZX recording (Philip Kendall).
  * Improved widget UI, with look and feel borrowed from that in FuseX
    (Fredrick Meunier; thanks, crabfists).
  * Emulation core improvements:
  * New --late-timings option to emulate machines with 1 tstate
    later timings (Philip Kendall)
  * Reading from the 128K's memory control port causes that byte to
    be written back to the port (Philip Kendall; thanks, Marat
    Fayzullin).
  * Reading the AY data port on the +2A/+3 is the same as reading
    the register port (Philip Kendall; thanks, Mark Woodmass).
  * NMI causes Z80 to unHALT (Philip Kendall; thanks, Simon Owen).
  * Emulate C, H and P/V flags on repeated IO instructions (Philip
    Kendall).
  * Fix crash when using Interface 1 on unoptimised Fuse builds
    (Philip Kendall).
  * Debugger improvements:
  * Debugger events to allow the debugger to stop when various
    Spectrum-level events happen (Philip Kendall).
  * Allow debugger commands to be run when a breakpoint is hit.
    No UI for this at present, but can be set from the command line.
    (Philip Kendall).
  * Command to exit emulator (Philip Kendall).
  * Make time breakpoints work properly when more than one is present
    (Philip Kendall).
  * Miscellaneous improvements:
  * Loader detection now works with the Digital Integration loader
    (Philip Kendall).
  * New HQ2X and HQ3x scalers (Gergely Szasz).
  * Revert Pentagon 128 to being the "base" machine without extra
    ROMs (Fredrick Meunier).
  * Updated +3e ROMs (Fredrick Meunier; thanks, Garry Lancaster).
  * Allow DivIDE, custom ROMs, Kempston mouse status and Simple 8-bit
    IDE interface to be saved in snapshots (Fredrick Meunier).
  * Better (but probably not perfect) TS2068 contention (Philip
    Kendall).
  * C89 compatibility fixes (Fredrick Meunier; thanks, sweetlilmr).
  * Remove GTK+'s build explicit dependency on Xlib (Philip Kendall).
- clean up spec file</changelog>
  <changelog author="uli@suse.de" date="1252411200">- update -&gt; 0.10.0.2:
  * Make loader acceleration work on all compilers (Philip Kendall;
    thanks, Carlos Almeida, Alberto Garcia and Alexander Yurchenko).
  * Make the "Don't Save" option in the widget UI do the right thing
    (Frederick Meunier).
  * Allow both +3 disk drives to be used at once (Gergely Szasz).
  * Allow both +D disk drives to be used at once (Gergely Szasz).
  * Make .dsk code handle missing newline on "Track-Info" header
    (Gergely Szasz; thanks, Simon Owen).
  * Remove unnecessary 'use' directive when building widget options
    header file; fixes some build issues (Frederick Meunier)
- unrequire lib765, libdsk</changelog>
  <changelog author="nmarques@opensuse.org" date="1317729600">- Update to version 1.0.0.1a:
  + Remove all ROMs for which there isn't explicit permission to
    distribute (Philip Kendall).
- Version 1.0.0.1
  + Fix temporary breakpoints on platforms using replacement Glib
    (Fredrick Meunier, Sergio Baldovi; thanks, Chris Cowley)
  + Ensure Amiga port can load files (Chris Young)
  + Fix SVGAlib compilation (rkd77)</changelog>
  <changelog author="serbalgi@gmail.com" date="1379332800">- add patch Fuse-1.0.0.1a-include-zlib.patch
  * Fix the build with libpng 1.5.X
- fix sound output by using alsa instead of libao.</changelog>
  <changelog author="serbalgi@gmail.com" date="1391342400">- Update to version 1.1.1
  * Add Spectranet ethernet interface emulation (Philip Kendall).
  * Add SpeccyBoot ethernet interface emulation (Patrik Persson).
  * Add SpecDrum sound interface emulation (Jon Mitchell).
  * Add DISCiPLE disk interface emulation (Stuart Brady).
    Sinclair Network emulation is not provided, and the interface is
    not available under 128K emulation in this release.
  * Support reading PZX files (Fredrick Meunier).
  * Add support for POK files (Sergio Baldoví).
  * Add recording of movies to FMF files (Gergely Szasz).
  * Various bugfixes.
- Desktop integration: add menu entry and register mime extensions.
- Add Fuse-desktop-file.patch: Use SUSE categories for menu entry.
- Drop Fuse-1.0.0.1a-include-zlib.patch: Upstream fixed.
- Add SDL-devel BuilRequires to enable joystick support.
- Fix package description.
- Modernize package license.</changelog>
  <changelog author="serbalgi@gmail.com" date="1405166400">- add patch Fuse-samdisk-dsk.patch
  * Fix load of SAMdisk dsk files</changelog>
  <changelog author="serbalgi@gmail.com" date="1465300800">- Update to version 1.2.0
  * New features:
    + Add Currah µSource emulation (Stuart Brady).
    + Add Didaktik 80/40 emulation (Gergely Szasz).
    + Capture BASIC video functions to SVG file (Stefano Bodrato).
    + Support bash completion (Sergio Baldoví).
    + Allow continuing RZX recordings (Sergio Baldoví).
  * Really lots of bugfixes and miscellaneous improvements.
- Switch to GTK+ 3.
- Drop Fuse-samdisk-dsk.patch: Upstream fixed.
- Several spec fixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1468843200">- Update to version 1.2.1
  * Emulation core improvements:
  * Fix bugs when the detect loaders feature is being used (thanks, Lee
    Tonks and windale) (Fredrick Meunier).
  * Debugger improvements:
  * Remove the need for "%" when accessing system variables (Philip
    Kendall).
  * Add Z80 registers as debugger variables (Philip Kendall).
  * Expose last byte written to the ULA, tstates since interrupt,
    primary and secondary memory control ports as debugger system
    variables (Philip Kendall).
  * Make breakpoints on events honour lifetime (Sergio Baldoví).
  * Extend breakpoints on paging events to more peripherals: Beta 128,
    +D, Didaktik 80, DISCiPLE, Opus Discovery and SpeccyBoot (Sergio
    Baldoví).
  * Split +D memory sources into RAM and ROM sections (Sergio Baldoví).
  * Coalesce +D and DISCiPLE RAM pages so they show as 8K pages (Sergio
    Baldoví).
  * Miscellaneous improvements:
  * Update GNOME .desktop file (Alberto Garcia).
  * Add an emulator module startup manager to automatically handle
    dependency issues (Philip Kendall).
  * Fix crash on widget UIs when hitting the close icon on the title bar
    several times (Sergio Baldoví).
- Update Fuse-desktop-file.patch: Accommodate upstream changes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1471867200">- Update to version 1.2.2
  * New features:
    + Support loading first tape, snapshot, dock cartridge or RZX file
    found inside .zip files (Patrik Rak and Sergio Baldoví).
    + Support auto-booting TR-DOS disk images without a boot file (thanks,
    windale, BogDan Vatra and Fredrick Meunier) (Sergio Baldoví).
  * Emulation core improvements:
    + Change microphone state when 0 tstate pulses do not have the no edge
    flag set (Fredrick Meunier).
  * Machine specific improvements:
    + Fix +3 disk autoload (thanks, windale and BogDan Vatra) (Sergio
    Baldoví and Fredrick Meunier).
    + Fix floppy drive selection when resetting a +3 (thanks, windale and
    BogDan Vatra) (Sergio Baldoví).
  * Miscellaneous improvements:
    + WidgetUI: Use description for tape blocks where available (Fredrick
    Meunier).
    + Use pkg-config to detect libpng and libxml2 (Alberto Garcia).
    + Various minor bugfixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1475496000">- Update to version 1.3.0
  * New features:
    + Recreated ZX Spectrum Bluetooth keyboard support (thanks, thrice,
    Philip Kendall and Sergio Baldoví) (Ekkehard Morgenstern).
  * Emulation core improvements:
    + Reset machine when auto-loading TRD/SCL disks (thanks, BogDan Vatra
    and Fredrick Meunier) (Sergio Baldoví).
  * Machine specific improvements:
    + Update +3e ROMs to v1.43 (Sergio Baldoví; thanks, Garry Lancaster).
  * Miscellaneous improvements:
    + Print summary of enabled features when building Fuse (Alberto
    Garcia).
    + Various minor bugfixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1481371200">- Update to version 1.3.2
  * Emulation core improvements:
    + Allow keyboard arrow keys to be used as a cursor joystick (thanks,
    solaris104) (Fredrick Meunier)
    + Limit sound generation to less than 500% speed (thanks, windale and
    Sergio Baldoví) (Fredrick Meunier).
    + Warn on inserting large disk image (thanks, Stefano Bodrato)
    (Fredrick Meunier)
  * Miscellaneous improvements:
    + WidgetUI: Fix order of Z80 flags in debugger (thanks, Marcos
    Cruz) (Sergio Baldoví).
    + Various minor bugfixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1493553600">- Update to version 1.3.5
  * Emulation core improvements:
    + Disable tape traps when playing/recording RZX files.
    + Add support for the hidden MEMPTR register.
    + Mark new disks as needing to be saved.
    + Show more information on disk modification status in menus.
  * Miscellaneous improvements:
    + WidgetUI: Fix memory leak in file selector.
    + Fix multiple save of disks.
    + Allow overwriting disk images.</changelog>
  <changelog author="serbalgi@gmail.com" date="1499688000">- Update to version 1.3.7
  * New features:
    + Add Multiface One/128/3 interface emulation.
  * Machine specific improvements:
    + Restore +2A/+3 ALL_RAM mode from snapshots.
  * Emulation core improvements:
    + Add Covox interface emulation.
    + Disable accelerate loader while recording RZX files.</changelog>
  <changelog author="serbalgi@gmail.com" date="1507809600">- Update to version 1.4.1
  * New features:
    + Add DivMMC emulation.
    + Add ZXMMC emulation.
  * Emulation core improvements:
    + Improvements to the loader acceleration code to reduce errors -
    Blood Brothers, City Slicker, Driller, Dynamite Dan, Games
    Compendium (by Gremlin), Joe Blade II, Kokotoni Wilf, Powerplay,
    Saboteur, Trapdoor and Zanthrax now all load successfully.
    + Multiface 3 returns values stored from ports 0x1ffd and 0x7ffd.
  * Debugger improvements:
    + Allow an exit code to be specified when using the "exit" command.
    + Add new "tape:microphone" and "spectrum:frames" system variables
    to allow access to the current tape level and frame count since
    reset.
  * Miscellaneous improvements:
    + Add support for MLT format screenshots.</changelog>
  <changelog author="serbalgi@gmail.com" date="1520164800">- Update to version 1.5.1
  * Debugger improvements:
    + Prevent crash when we try to disassemble an instruction with many
    DD or FD prefixes.
    + Fix crash when setting debugger variables.
    + Ensure conditional timed breakpoints work correctly.
  * Profiler improvements:
    + Prevent crash when we try to profile an instruction with many DD
    or FD prefixes.
  * Miscellaneous improvements:
    + GTK+ UI: Improve behaviour of default button on dialogs.
    + GTK+ and win32 UIs: Support hex numbers in load/save binary and
    pokefinder dialogs.
    + SDL UI: Allow to select the video mode used in full-screen.
    + Autoload snapshots replaced by a "phantom typist" which types
    LOAD "" or similar.
    + Alkatraz loaders (e.g. Cobra and Fairlight) are now accelerated.
- Several spec fixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1525176000">- Update to version 1.5.3
  * Emulation core improvements:
    + Emulate ROM bug loading zero length blocks when using tape traps.
    + Disable inactive peripherals after loading a snapshot.
  * Machine specific improvements:
    + Fix the format of double-sided +3 disks.
  * Miscellaneous improvements:
    + Spectrum reset is accelerated when phantom typist is enabled and a
    file is loaded from the menu.
    + Add options UI for phantom typist.
    + GTK+ 3 UI: Memory browser dialog allows to go to specific offset.
    + Re-enable sound after phantom typist finishes loading TAP, standard
    ROM TZX or +3 DSK images.</changelog>
  <changelog author="serbalgi@gmail.com" date="1530878400">- Update to version 1.5.5
  * Emulation core improvements:
    + Improve sound accuracy on Unix 64 bits systems.
  * Miscellaneous improvements:
    + Allow the use of real joystick hats/dpads in the SDL joystick code.
    + Add *.FMF as an allowed filetype to file selectors.
    + Save SCR from current display file.
    + Use 44.1KHz as default sound frequency.
    + Various minor bugfixes.</changelog>
  <changelog author="Luigi Baldoni &lt;aloisio@gmx.com&gt;" date="1572609600">- Update to version 1.5.7
  * UI improvements:
    + GTK+ 3: Make the offset entry wider in memory browser
    (Derek Fountain).
    + GTK+: Remove duplicated surface creation code (Philip
    Kendall).
    + GTK+: Remove use of deprecated gtk_device_(un)grab
    functions (Philip Kendall).
    + GTK+/Win32: Add *.bin as an allowed filetype to file
    selectors and amend .fmf filetype (thanks, Allan Turvey)
    (Sergio Baldoví).
    + Improve Fuse's window sizing under Wayland; still not
    right, but better than it was before (Sergio Baldoví).
    + Improve Fuse's Kempston mouse handling under GTK+ 3.x
    (Philip Kendall).
    + Stop Kempston mouse causing a crash under Wayland; still
    doesn't work properly though (Philip Kendall).
  * Miscellaneous improvements:
    + "Save binary" command can now save 65536 bytes again
    (regression introduced in 1.5.6; thanks, thrice) (Philip
    Kendall).
    + Remove gcc 8 string overflow warnings (Philip Kendall).
  version 1.5.6:
  * Emulation core improvements:
    + Z80 flags register is now correct after SCF and CCF (Sergio
    Baldoví).
  * Miscellaneous improvements:
    + Factor out common paths code between Linux and generic
    UNIX (Alberto Garcia and Fredrick Meunier).
    + More improvements disabling phantom typist after finishing
    loading TAP or standard ROM TZX files (thanks, Alberto
    Garcia) (Fredrick Meunier).
    + Saving and loading binary data no longer increments tstate
    count or triggers breakpoints (thanks, Sergio Baldoví)
    (Philip Kendall).
    + "Variant" Alkatraz loaders (e.g. Gauntlet 3 and Shadow
    Dancer), "Variant" Search Loader programs (e.g. Lotus
    Esprit Turbo Challenge and Space Crusade) and Dinaload
    loaders (e.g. Astro Marine Corps) are now accelerated
    (Philip Kendall).
    + Stop RZX playback/recording on machine reset/change (Sergio
    Baldoví).
    + Various minor bugfixes.
- Spec cleanup</changelog>
  <changelog author="Sergio Baldovi &lt;serbalgi@gmail.com&gt;" date="1614600000">- Update to version 1.6.0
  * New features:
    + Add TTX2000S emulation
    + Experimental PulseAudio sound driver
  * Emulation core improvements:
    + Fix activation of joystick and IF2 peripherals when loading a snapshot
  * UI improvements:
    + New higher resolution keyboard picture
    + Load/save binary dialog remembers last values
    + Improve moving and sizing Fuse's window under Wayland
    + Fix kempston mouse values on Wayland
    + Fix bug when resizing from 2x to 3x
  * Scaler improvements:
    + Fix display corruption with HQ 3x scaler
    + Fix antialiasing effect of AdvMAME3x scaler
    + Add 4x, TV 4x, Pal TV 4x and HQ 4x scalers
  * Various minor bugfixes.
- Switch to PulseAudio sound driver.
- Several spec fixes.</changelog>
</package>
<package pkgid="83311add4d3095840471e33147f2fa867c5e3f83df3e5c08359cbe630234db263622440b954d575745b4279d9387d31765120c565c4ecbb2559802ddca58278c" name="Fuse" arch="x86_64">
  <version epoch="0" ver="1.6.0" rel="2.79"/>
  <changelog author="serbalgi@gmail.com" date="1475496000">- Update to version 1.3.0
  * New features:
    + Recreated ZX Spectrum Bluetooth keyboard support (thanks, thrice,
    Philip Kendall and Sergio Baldoví) (Ekkehard Morgenstern).
  * Emulation core improvements:
    + Reset machine when auto-loading TRD/SCL disks (thanks, BogDan Vatra
    and Fredrick Meunier) (Sergio Baldoví).
  * Machine specific improvements:
    + Update +3e ROMs to v1.43 (Sergio Baldoví; thanks, Garry Lancaster).
  * Miscellaneous improvements:
    + Print summary of enabled features when building Fuse (Alberto
    Garcia).
    + Various minor bugfixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1481371200">- Update to version 1.3.2
  * Emulation core improvements:
    + Allow keyboard arrow keys to be used as a cursor joystick (thanks,
    solaris104) (Fredrick Meunier)
    + Limit sound generation to less than 500% speed (thanks, windale and
    Sergio Baldoví) (Fredrick Meunier).
    + Warn on inserting large disk image (thanks, Stefano Bodrato)
    (Fredrick Meunier)
  * Miscellaneous improvements:
    + WidgetUI: Fix order of Z80 flags in debugger (thanks, Marcos
    Cruz) (Sergio Baldoví).
    + Various minor bugfixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1493553600">- Update to version 1.3.5
  * Emulation core improvements:
    + Disable tape traps when playing/recording RZX files.
    + Add support for the hidden MEMPTR register.
    + Mark new disks as needing to be saved.
    + Show more information on disk modification status in menus.
  * Miscellaneous improvements:
    + WidgetUI: Fix memory leak in file selector.
    + Fix multiple save of disks.
    + Allow overwriting disk images.</changelog>
  <changelog author="serbalgi@gmail.com" date="1499688000">- Update to version 1.3.7
  * New features:
    + Add Multiface One/128/3 interface emulation.
  * Machine specific improvements:
    + Restore +2A/+3 ALL_RAM mode from snapshots.
  * Emulation core improvements:
    + Add Covox interface emulation.
    + Disable accelerate loader while recording RZX files.</changelog>
  <changelog author="serbalgi@gmail.com" date="1507809600">- Update to version 1.4.1
  * New features:
    + Add DivMMC emulation.
    + Add ZXMMC emulation.
  * Emulation core improvements:
    + Improvements to the loader acceleration code to reduce errors -
    Blood Brothers, City Slicker, Driller, Dynamite Dan, Games
    Compendium (by Gremlin), Joe Blade II, Kokotoni Wilf, Powerplay,
    Saboteur, Trapdoor and Zanthrax now all load successfully.
    + Multiface 3 returns values stored from ports 0x1ffd and 0x7ffd.
  * Debugger improvements:
    + Allow an exit code to be specified when using the "exit" command.
    + Add new "tape:microphone" and "spectrum:frames" system variables
    to allow access to the current tape level and frame count since
    reset.
  * Miscellaneous improvements:
    + Add support for MLT format screenshots.</changelog>
  <changelog author="serbalgi@gmail.com" date="1520164800">- Update to version 1.5.1
  * Debugger improvements:
    + Prevent crash when we try to disassemble an instruction with many
    DD or FD prefixes.
    + Fix crash when setting debugger variables.
    + Ensure conditional timed breakpoints work correctly.
  * Profiler improvements:
    + Prevent crash when we try to profile an instruction with many DD
    or FD prefixes.
  * Miscellaneous improvements:
    + GTK+ UI: Improve behaviour of default button on dialogs.
    + GTK+ and win32 UIs: Support hex numbers in load/save binary and
    pokefinder dialogs.
    + SDL UI: Allow to select the video mode used in full-screen.
    + Autoload snapshots replaced by a "phantom typist" which types
    LOAD "" or similar.
    + Alkatraz loaders (e.g. Cobra and Fairlight) are now accelerated.
- Several spec fixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1525176000">- Update to version 1.5.3
  * Emulation core improvements:
    + Emulate ROM bug loading zero length blocks when using tape traps.
    + Disable inactive peripherals after loading a snapshot.
  * Machine specific improvements:
    + Fix the format of double-sided +3 disks.
  * Miscellaneous improvements:
    + Spectrum reset is accelerated when phantom typist is enabled and a
    file is loaded from the menu.
    + Add options UI for phantom typist.
    + GTK+ 3 UI: Memory browser dialog allows to go to specific offset.
    + Re-enable sound after phantom typist finishes loading TAP, standard
    ROM TZX or +3 DSK images.</changelog>
  <changelog author="serbalgi@gmail.com" date="1530878400">- Update to version 1.5.5
  * Emulation core improvements:
    + Improve sound accuracy on Unix 64 bits systems.
  * Miscellaneous improvements:
    + Allow the use of real joystick hats/dpads in the SDL joystick code.
    + Add *.FMF as an allowed filetype to file selectors.
    + Save SCR from current display file.
    + Use 44.1KHz as default sound frequency.
    + Various minor bugfixes.</changelog>
  <changelog author="Luigi Baldoni &lt;aloisio@gmx.com&gt;" date="1572609600">- Update to version 1.5.7
  * UI improvements:
    + GTK+ 3: Make the offset entry wider in memory browser
    (Derek Fountain).
    + GTK+: Remove duplicated surface creation code (Philip
    Kendall).
    + GTK+: Remove use of deprecated gtk_device_(un)grab
    functions (Philip Kendall).
    + GTK+/Win32: Add *.bin as an allowed filetype to file
    selectors and amend .fmf filetype (thanks, Allan Turvey)
    (Sergio Baldoví).
    + Improve Fuse's window sizing under Wayland; still not
    right, but better than it was before (Sergio Baldoví).
    + Improve Fuse's Kempston mouse handling under GTK+ 3.x
    (Philip Kendall).
    + Stop Kempston mouse causing a crash under Wayland; still
    doesn't work properly though (Philip Kendall).
  * Miscellaneous improvements:
    + "Save binary" command can now save 65536 bytes again
    (regression introduced in 1.5.6; thanks, thrice) (Philip
    Kendall).
    + Remove gcc 8 string overflow warnings (Philip Kendall).
  version 1.5.6:
  * Emulation core improvements:
    + Z80 flags register is now correct after SCF and CCF (Sergio
    Baldoví).
  * Miscellaneous improvements:
    + Factor out common paths code between Linux and generic
    UNIX (Alberto Garcia and Fredrick Meunier).
    + More improvements disabling phantom typist after finishing
    loading TAP or standard ROM TZX files (thanks, Alberto
    Garcia) (Fredrick Meunier).
    + Saving and loading binary data no longer increments tstate
    count or triggers breakpoints (thanks, Sergio Baldoví)
    (Philip Kendall).
    + "Variant" Alkatraz loaders (e.g. Gauntlet 3 and Shadow
    Dancer), "Variant" Search Loader programs (e.g. Lotus
    Esprit Turbo Challenge and Space Crusade) and Dinaload
    loaders (e.g. Astro Marine Corps) are now accelerated
    (Philip Kendall).
    + Stop RZX playback/recording on machine reset/change (Sergio
    Baldoví).
    + Various minor bugfixes.
- Spec cleanup</changelog>
  <changelog author="Sergio Baldovi &lt;serbalgi@gmail.com&gt;" date="1614600000">- Update to version 1.6.0
  * New features:
    + Add TTX2000S emulation
    + Experimental PulseAudio sound driver
  * Emulation core improvements:
    + Fix activation of joystick and IF2 peripherals when loading a snapshot
  * UI improvements:
    + New higher resolution keyboard picture
    + Load/save binary dialog remembers last values
    + Improve moving and sizing Fuse's window under Wayland
    + Fix kempston mouse values on Wayland
    + Fix bug when resizing from 2x to 3x
  * Scaler improvements:
    + Fix display corruption with HQ 3x scaler
    + Fix antialiasing effect of AdvMAME3x scaler
    + Add 4x, TV 4x, Pal TV 4x and HQ 4x scalers
  * Various minor bugfixes.
- Switch to PulseAudio sound driver.
- Several spec fixes.</changelog>
</package>
<package pkgid="9cab1afb4b3e08d423959f4bf83fea3a2c59c84957f66e3a83411b1ac0ef2ae0dd71fac68a93db0327a5877b7a9ad15b45779faa94630167f8fb15109fe8b859" name="ctdb" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="33c1c7a106fdf677c1821802967b5e47d568f070d2db510d4b575107151bc13ca4b3d75347599f6fb059bdbce9a922a13317d140b9b83d68a2bf7008fa0ec504" name="ctdb-pcp-pmda" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="6baac9867b5e5871f79c831a95c7a1c3bbf7b7e9c31e5937d52ccf8bf4b42b457cff2d4c8190f025ca1404a0729a9478d5be4d45525a04d35abfe24ba0192c45" name="frr" arch="src">
  <version epoch="0" ver="10.6.0" rel="4.23"/>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1701691200">- Apply upstream fix for a crash on malformed BGP UPDATE message
  with an EOR, because the presence of EOR does not lead to a
  treat-as-withdraw outcome (CVE-2023-47235,bsc#1216896,https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
  [+ 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch]
- Apply upstream fix for a crash on crafted BGP UPDATE message with
  a MP_UNREACH_NLRI attribute and additional NLRI data (CVE-2023-47234,
  bsc#1216897,https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf)
  [+ 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch]
- Apply upstream fix for attempts to read beyond the end of the
  stream during labeled unicast parsing (CVE-2023-38407,bsc#1216899,https://github.com/FRRouting/frr/pull/12956/commits/ab362eae68edec12c175d9bc488bcc3f8b73d36f)
  [+ 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch]
- Apply upstream fix for an nlri length of zero mishandling, aka
  "flowspec overflow" (CVE-2023-38406,bsc#1216900,https://github.com/FRRouting/frr/pull/12884/commits/0b999c886e241c52bd1f7ef0066700e4b618ebb3)
  [+ 0018-bgpd-Flowspec-overflow-issue.patch]</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build with RPM 4.19: a stray %-escape sequence was found in
  the files section.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1707393600">- Provide user/group symbol for user created during pre.</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1712750400">- add
  0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch:
  * Apply upstream fix on error handling when receiving BGP Prefix
    SID attribute (bsc#1222518,CVE-2024-31948,gh#FRRouting/frr#15628)</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1713960000">- Apply upstream fix solving crash in OSPF TE parsing (bsc#1220548,
  CVE-2024-27913, gh#FRRouting/frr#15431)
  [+ 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1717502400">- Apply upstream fix solving ospfd denial of service via get_edge()
  function returning a NULL pointer (CVE-2024-34088,bsc#1223786,
  gh#FRRouting/frr#16088).
  [+ 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in ospf_te_parse_ext_link for OSPF LSA packets during an attempt
  to read Segment Routing Adjacency SID subTLVs (CVE-2024-31951,
  bsc#1222528,gh#FRRouting/frr#16088).
  [+ 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in RI parsing with OSPF TE (CVE-2024-31950,bsc#1222526,
  gh#FRRouting/frr#16088).
  [+ 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch]</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722168000">- Update to version 10.0.1 from official sources.
  See https://frrouting.org/release/10.0.1/
- Clean slate: removing all previous patches.
- The following patches were obsoleted:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  - 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch
  - 0004-tools-remove-backslash-from-declare-check-regex.patch
  - 0005-root-ok-in-account-frr.pam.patch
  - 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch
  - 0007-bgpd-Ensure-stream-received-has-enough-data.patch
  - 0008-bgpd-Don-t-read-the-first-byte-of-ORF-header-if-we-a.patch
  - 0009-bgpd-Do-not-process-NLRIs-if-the-attribute-length-is.patch
  - 0010-bgpd-Use-treat-as-withdraw-for-tunnel-encapsulation-.patch
  - 0011-babeld-fix-11808-to-avoid-infinite-loops.patch
  - 0012-bgpd-Limit-flowspec-to-no-attribute-means-a-implicit.patch
  - 0013-bgpd-Check-mandatory-attributes-more-carefully-for-U.patch
  - 0014-bgpd-Handle-MP_REACH_NLRI-malformed-packets-with-ses.patch
  - 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch
  - 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch
  - 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch
  - 0018-bgpd-Flowspec-overflow-issue.patch
  - 0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch
  - 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch
  - 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch
  - 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch
  - 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1723204800">- Fixing Source URL/archive name.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1724328000">- Apply upstream fix for crash in bgp_attr_encap that were missing
  a check of the actual remaining stream length before taking the
  TLV value (CVE-2024-44070,bsc#1229438,gh#FRRouting/frr#16502):
  + 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch
- Re-added 0001-disable-zmq-test.patch to avoid (sporadic or arch
  specific, e.g. aarch64) "make check" test failures (bsc#1180217).
  + 0001-disable-zmq-test.patch
- Re-added hardening patch for systemd service(s) (bsc#1181400):
  + harden_frr.service.patch
- Cleanup unknown --enable-systemd and correct the --sysconfdir
  and --localstatedir configure options to not end in …/frr.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488000">- fixed bug/pull request references in frr.changes file</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488001">- add release notes url to 10.0.1 update</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1727697600">- Update to frr 10.0.2 release providing fix for CVE-2024-44070
  and other issues, see https://frrouting.org/release/10.0.2/
- Removed patch included in the sources:
  [- 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1736424000">- Update to frr 10.2.1 release providing fix for a Denial of Service
  scenario due to RIB revalidation (CVE-2024-55553,bsc#1235237) and
  other fixes, see https://frrouting.org/release/10.2.1/
  The 10.2 version provides new features and many enhancements, see
  https://frrouting.org/release/10.2/
- Add new fpm_listener daemon binary to rpm file lists.
- Remove --localstatedir configure parameter causing to use /run/lib
  instead of /var/lib prefix for the northbound databases and added
  the /var/lib/frr directory to the rpm file list.
- Adjust to set permissions in rpm attr macros (rpmlint suggestion)
  and use frr_group instead of frr_user in group parameter.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742558400">- build with pcre2</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1759233600">- Drop rcfrr service symlink (jsc#PED-266)
- Change to sysuser-tools and macros to create user+groups
- rpmlint: add su option to logrotate file definitions
- rpmlint: use python3_fix_shebang_path to adjust interpreter</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1759492800">- Adding updated copyright notice
- 0002-frr-logrotate.patch: rotating logfiles under the frr user</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770897600">- Apply upstream ospfd NULL Pointer Dereference fixes.
  The vulnerability allowed attackers to cause a Denial of Service
  (DoS) via crafted OSPF packets
  (bsc#1252838,bsc#1252829,bsc#1252833,bsc#1252835,bsc#1252810,
  bsc#1252811,bsc#1252761,bsc#1252812,bsc#1252813,CVE-2025-61099,
  CVE-2025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,
  CVE-2025-61104,CVE-2025-61105,CVE-2025-61106,CVE-2025-61107,
  https://github.com/FRRouting/frr/pull/19983)
  [+ 0003-ospfd-NULL-Pointer-Dereference-fixes.patch]
- Add -Wno-error=declaration-after-statement to avoid C90 errors;
  frr requires C11 compiler with atomic support and sets -std=gnu11</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770984000">- Switch to logrotate config correcting log file empty issue
  (gh#FRRouting/frr/issues/15818) depending if syslog or file
  logging is used in the frr.conf.
- Fix /var/run leftovers in logrotate config and service file,
  create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).
- Adjust rpm requires for service macros and log rotation (lsof).</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771070400">- Bumping version to 10.5.1.
- new module: PIM MLAG Active-Active support (mlab_pb0)
- removed module: zebra_irdp (replaced by dpdk)
- bgpd
  - Allow proper shutdown of bgp dynamic peers in rare case
  - Check length for dynamic capability (software version new encoding)
  - Correction in json output structure for no data case
  - Fix labeled unicast inbound policy lookup
  - Fix labeled-unicast output
  - Fix maximum-prefix session recovery for peers and peer-groups
  - Fix memory leak in bgp nhc tlv processing
  - Fix route node lock leak in nht resolved prefix marking
  - Fix srv6-only command defaulted when 'no segment-routing ipv6'
  - Send route-refresh and/or trigger soft reconfig on enforce-first-as
  - Try to handle software version capability with the new encoding format
- isisd
  - Use ipv6 mtid for srv6 locator tlvs when ipv6 mt is enabled
- pimd
  - Add pim_debug_pim_reg protection for pim register stop debug message
  - Crash while trying mroute_read when fd=-1
  - Df election on zebra peer down synced to the mlag peer
  - Fix for mc frame loss in a sequential traffic test
  - Fix pim mlag update peer zebra status upon local mlag connection restoration
  - Fix warnings for pimd
  - Crash when pimreg interface not present
  - Crashed because of indexing invalid index in an array
  - Prevent crash on interface removal
- vrrpd
  - vrrp interface delete fails to free connected route
- zebrad
  - Fix crash due to lack of control of received number of srv6 sid from netlink</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1772712000">- Add a factorydir build conditional to install the /etc/frr files in
  the /usr/share/factory and copy/link this initial/default config via
  tmpfiles.conf, enabled for suse versions &gt; 16.0 (jsc#PED-14796).
- Create the tmpfiles.conf in the spec file instead to sed rpm source.
- Move creation of config files from rpm install to the build section.
- Improve to use 0751 permissions for the /etc/frr directory to avoid
  permission denied warning for vtysh.conf in vtysh started as user.
- Change to frr.conf to use log syslog (journal) by default
- Do not install obsolete/unused system-v script and manual page
- Fix (include) file listed twice rpm warning in frr-devel package.</changelog>
</package>
<package pkgid="880c8445943afe7dd25622aca3f99a71999f1e30a1bc4fb94d8698cffd6ded124b2cf70b7f6bdcc93834ab1b79247013254832d891f71479870a059b4fda3152" name="frr" arch="x86_64">
  <version epoch="0" ver="10.6.0" rel="4.23"/>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1701691200">- Apply upstream fix for a crash on malformed BGP UPDATE message
  with an EOR, because the presence of EOR does not lead to a
  treat-as-withdraw outcome (CVE-2023-47235,bsc#1216896,https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
  [+ 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch]
- Apply upstream fix for a crash on crafted BGP UPDATE message with
  a MP_UNREACH_NLRI attribute and additional NLRI data (CVE-2023-47234,
  bsc#1216897,https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf)
  [+ 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch]
- Apply upstream fix for attempts to read beyond the end of the
  stream during labeled unicast parsing (CVE-2023-38407,bsc#1216899,https://github.com/FRRouting/frr/pull/12956/commits/ab362eae68edec12c175d9bc488bcc3f8b73d36f)
  [+ 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch]
- Apply upstream fix for an nlri length of zero mishandling, aka
  "flowspec overflow" (CVE-2023-38406,bsc#1216900,https://github.com/FRRouting/frr/pull/12884/commits/0b999c886e241c52bd1f7ef0066700e4b618ebb3)
  [+ 0018-bgpd-Flowspec-overflow-issue.patch]</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build with RPM 4.19: a stray %-escape sequence was found in
  the files section.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1707393600">- Provide user/group symbol for user created during pre.</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1712750400">- add
  0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch:
  * Apply upstream fix on error handling when receiving BGP Prefix
    SID attribute (bsc#1222518,CVE-2024-31948,gh#FRRouting/frr#15628)</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1713960000">- Apply upstream fix solving crash in OSPF TE parsing (bsc#1220548,
  CVE-2024-27913, gh#FRRouting/frr#15431)
  [+ 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1717502400">- Apply upstream fix solving ospfd denial of service via get_edge()
  function returning a NULL pointer (CVE-2024-34088,bsc#1223786,
  gh#FRRouting/frr#16088).
  [+ 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in ospf_te_parse_ext_link for OSPF LSA packets during an attempt
  to read Segment Routing Adjacency SID subTLVs (CVE-2024-31951,
  bsc#1222528,gh#FRRouting/frr#16088).
  [+ 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in RI parsing with OSPF TE (CVE-2024-31950,bsc#1222526,
  gh#FRRouting/frr#16088).
  [+ 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch]</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722168000">- Update to version 10.0.1 from official sources.
  See https://frrouting.org/release/10.0.1/
- Clean slate: removing all previous patches.
- The following patches were obsoleted:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  - 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch
  - 0004-tools-remove-backslash-from-declare-check-regex.patch
  - 0005-root-ok-in-account-frr.pam.patch
  - 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch
  - 0007-bgpd-Ensure-stream-received-has-enough-data.patch
  - 0008-bgpd-Don-t-read-the-first-byte-of-ORF-header-if-we-a.patch
  - 0009-bgpd-Do-not-process-NLRIs-if-the-attribute-length-is.patch
  - 0010-bgpd-Use-treat-as-withdraw-for-tunnel-encapsulation-.patch
  - 0011-babeld-fix-11808-to-avoid-infinite-loops.patch
  - 0012-bgpd-Limit-flowspec-to-no-attribute-means-a-implicit.patch
  - 0013-bgpd-Check-mandatory-attributes-more-carefully-for-U.patch
  - 0014-bgpd-Handle-MP_REACH_NLRI-malformed-packets-with-ses.patch
  - 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch
  - 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch
  - 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch
  - 0018-bgpd-Flowspec-overflow-issue.patch
  - 0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch
  - 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch
  - 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch
  - 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch
  - 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1723204800">- Fixing Source URL/archive name.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1724328000">- Apply upstream fix for crash in bgp_attr_encap that were missing
  a check of the actual remaining stream length before taking the
  TLV value (CVE-2024-44070,bsc#1229438,gh#FRRouting/frr#16502):
  + 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch
- Re-added 0001-disable-zmq-test.patch to avoid (sporadic or arch
  specific, e.g. aarch64) "make check" test failures (bsc#1180217).
  + 0001-disable-zmq-test.patch
- Re-added hardening patch for systemd service(s) (bsc#1181400):
  + harden_frr.service.patch
- Cleanup unknown --enable-systemd and correct the --sysconfdir
  and --localstatedir configure options to not end in …/frr.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488000">- fixed bug/pull request references in frr.changes file</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488001">- add release notes url to 10.0.1 update</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1727697600">- Update to frr 10.0.2 release providing fix for CVE-2024-44070
  and other issues, see https://frrouting.org/release/10.0.2/
- Removed patch included in the sources:
  [- 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1736424000">- Update to frr 10.2.1 release providing fix for a Denial of Service
  scenario due to RIB revalidation (CVE-2024-55553,bsc#1235237) and
  other fixes, see https://frrouting.org/release/10.2.1/
  The 10.2 version provides new features and many enhancements, see
  https://frrouting.org/release/10.2/
- Add new fpm_listener daemon binary to rpm file lists.
- Remove --localstatedir configure parameter causing to use /run/lib
  instead of /var/lib prefix for the northbound databases and added
  the /var/lib/frr directory to the rpm file list.
- Adjust to set permissions in rpm attr macros (rpmlint suggestion)
  and use frr_group instead of frr_user in group parameter.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742558400">- build with pcre2</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1759233600">- Drop rcfrr service symlink (jsc#PED-266)
- Change to sysuser-tools and macros to create user+groups
- rpmlint: add su option to logrotate file definitions
- rpmlint: use python3_fix_shebang_path to adjust interpreter</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1759492800">- Adding updated copyright notice
- 0002-frr-logrotate.patch: rotating logfiles under the frr user</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770897600">- Apply upstream ospfd NULL Pointer Dereference fixes.
  The vulnerability allowed attackers to cause a Denial of Service
  (DoS) via crafted OSPF packets
  (bsc#1252838,bsc#1252829,bsc#1252833,bsc#1252835,bsc#1252810,
  bsc#1252811,bsc#1252761,bsc#1252812,bsc#1252813,CVE-2025-61099,
  CVE-2025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,
  CVE-2025-61104,CVE-2025-61105,CVE-2025-61106,CVE-2025-61107,
  https://github.com/FRRouting/frr/pull/19983)
  [+ 0003-ospfd-NULL-Pointer-Dereference-fixes.patch]
- Add -Wno-error=declaration-after-statement to avoid C90 errors;
  frr requires C11 compiler with atomic support and sets -std=gnu11</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770984000">- Switch to logrotate config correcting log file empty issue
  (gh#FRRouting/frr/issues/15818) depending if syslog or file
  logging is used in the frr.conf.
- Fix /var/run leftovers in logrotate config and service file,
  create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).
- Adjust rpm requires for service macros and log rotation (lsof).</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771070400">- Bumping version to 10.5.1.
- new module: PIM MLAG Active-Active support (mlab_pb0)
- removed module: zebra_irdp (replaced by dpdk)
- bgpd
  - Allow proper shutdown of bgp dynamic peers in rare case
  - Check length for dynamic capability (software version new encoding)
  - Correction in json output structure for no data case
  - Fix labeled unicast inbound policy lookup
  - Fix labeled-unicast output
  - Fix maximum-prefix session recovery for peers and peer-groups
  - Fix memory leak in bgp nhc tlv processing
  - Fix route node lock leak in nht resolved prefix marking
  - Fix srv6-only command defaulted when 'no segment-routing ipv6'
  - Send route-refresh and/or trigger soft reconfig on enforce-first-as
  - Try to handle software version capability with the new encoding format
- isisd
  - Use ipv6 mtid for srv6 locator tlvs when ipv6 mt is enabled
- pimd
  - Add pim_debug_pim_reg protection for pim register stop debug message
  - Crash while trying mroute_read when fd=-1
  - Df election on zebra peer down synced to the mlag peer
  - Fix for mc frame loss in a sequential traffic test
  - Fix pim mlag update peer zebra status upon local mlag connection restoration
  - Fix warnings for pimd
  - Crash when pimreg interface not present
  - Crashed because of indexing invalid index in an array
  - Prevent crash on interface removal
- vrrpd
  - vrrp interface delete fails to free connected route
- zebrad
  - Fix crash due to lack of control of received number of srv6 sid from netlink</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1772712000">- Add a factorydir build conditional to install the /etc/frr files in
  the /usr/share/factory and copy/link this initial/default config via
  tmpfiles.conf, enabled for suse versions &gt; 16.0 (jsc#PED-14796).
- Create the tmpfiles.conf in the spec file instead to sed rpm source.
- Move creation of config files from rpm install to the build section.
- Improve to use 0751 permissions for the /etc/frr directory to avoid
  permission denied warning for vtysh.conf in vtysh started as user.
- Change to frr.conf to use log syslog (journal) by default
- Do not install obsolete/unused system-v script and manual page
- Fix (include) file listed twice rpm warning in frr-devel package.</changelog>
</package>
<package pkgid="74707ce23b0d693e8971c7542b386206a1053f65a222aabfa49a22121db26f7baa2249de956cda667a2209972ef5ea94ba2f202b8742d60007f8819524475c97" name="frr-devel" arch="x86_64">
  <version epoch="0" ver="10.6.0" rel="4.23"/>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1701691200">- Apply upstream fix for a crash on malformed BGP UPDATE message
  with an EOR, because the presence of EOR does not lead to a
  treat-as-withdraw outcome (CVE-2023-47235,bsc#1216896,https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
  [+ 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch]
- Apply upstream fix for a crash on crafted BGP UPDATE message with
  a MP_UNREACH_NLRI attribute and additional NLRI data (CVE-2023-47234,
  bsc#1216897,https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf)
  [+ 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch]
- Apply upstream fix for attempts to read beyond the end of the
  stream during labeled unicast parsing (CVE-2023-38407,bsc#1216899,https://github.com/FRRouting/frr/pull/12956/commits/ab362eae68edec12c175d9bc488bcc3f8b73d36f)
  [+ 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch]
- Apply upstream fix for an nlri length of zero mishandling, aka
  "flowspec overflow" (CVE-2023-38406,bsc#1216900,https://github.com/FRRouting/frr/pull/12884/commits/0b999c886e241c52bd1f7ef0066700e4b618ebb3)
  [+ 0018-bgpd-Flowspec-overflow-issue.patch]</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build with RPM 4.19: a stray %-escape sequence was found in
  the files section.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1707393600">- Provide user/group symbol for user created during pre.</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1712750400">- add
  0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch:
  * Apply upstream fix on error handling when receiving BGP Prefix
    SID attribute (bsc#1222518,CVE-2024-31948,gh#FRRouting/frr#15628)</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1713960000">- Apply upstream fix solving crash in OSPF TE parsing (bsc#1220548,
  CVE-2024-27913, gh#FRRouting/frr#15431)
  [+ 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1717502400">- Apply upstream fix solving ospfd denial of service via get_edge()
  function returning a NULL pointer (CVE-2024-34088,bsc#1223786,
  gh#FRRouting/frr#16088).
  [+ 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in ospf_te_parse_ext_link for OSPF LSA packets during an attempt
  to read Segment Routing Adjacency SID subTLVs (CVE-2024-31951,
  bsc#1222528,gh#FRRouting/frr#16088).
  [+ 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in RI parsing with OSPF TE (CVE-2024-31950,bsc#1222526,
  gh#FRRouting/frr#16088).
  [+ 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch]</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722168000">- Update to version 10.0.1 from official sources.
  See https://frrouting.org/release/10.0.1/
- Clean slate: removing all previous patches.
- The following patches were obsoleted:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  - 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch
  - 0004-tools-remove-backslash-from-declare-check-regex.patch
  - 0005-root-ok-in-account-frr.pam.patch
  - 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch
  - 0007-bgpd-Ensure-stream-received-has-enough-data.patch
  - 0008-bgpd-Don-t-read-the-first-byte-of-ORF-header-if-we-a.patch
  - 0009-bgpd-Do-not-process-NLRIs-if-the-attribute-length-is.patch
  - 0010-bgpd-Use-treat-as-withdraw-for-tunnel-encapsulation-.patch
  - 0011-babeld-fix-11808-to-avoid-infinite-loops.patch
  - 0012-bgpd-Limit-flowspec-to-no-attribute-means-a-implicit.patch
  - 0013-bgpd-Check-mandatory-attributes-more-carefully-for-U.patch
  - 0014-bgpd-Handle-MP_REACH_NLRI-malformed-packets-with-ses.patch
  - 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch
  - 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch
  - 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch
  - 0018-bgpd-Flowspec-overflow-issue.patch
  - 0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch
  - 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch
  - 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch
  - 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch
  - 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1723204800">- Fixing Source URL/archive name.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1724328000">- Apply upstream fix for crash in bgp_attr_encap that were missing
  a check of the actual remaining stream length before taking the
  TLV value (CVE-2024-44070,bsc#1229438,gh#FRRouting/frr#16502):
  + 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch
- Re-added 0001-disable-zmq-test.patch to avoid (sporadic or arch
  specific, e.g. aarch64) "make check" test failures (bsc#1180217).
  + 0001-disable-zmq-test.patch
- Re-added hardening patch for systemd service(s) (bsc#1181400):
  + harden_frr.service.patch
- Cleanup unknown --enable-systemd and correct the --sysconfdir
  and --localstatedir configure options to not end in …/frr.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488000">- fixed bug/pull request references in frr.changes file</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488001">- add release notes url to 10.0.1 update</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1727697600">- Update to frr 10.0.2 release providing fix for CVE-2024-44070
  and other issues, see https://frrouting.org/release/10.0.2/
- Removed patch included in the sources:
  [- 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1736424000">- Update to frr 10.2.1 release providing fix for a Denial of Service
  scenario due to RIB revalidation (CVE-2024-55553,bsc#1235237) and
  other fixes, see https://frrouting.org/release/10.2.1/
  The 10.2 version provides new features and many enhancements, see
  https://frrouting.org/release/10.2/
- Add new fpm_listener daemon binary to rpm file lists.
- Remove --localstatedir configure parameter causing to use /run/lib
  instead of /var/lib prefix for the northbound databases and added
  the /var/lib/frr directory to the rpm file list.
- Adjust to set permissions in rpm attr macros (rpmlint suggestion)
  and use frr_group instead of frr_user in group parameter.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742558400">- build with pcre2</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1759233600">- Drop rcfrr service symlink (jsc#PED-266)
- Change to sysuser-tools and macros to create user+groups
- rpmlint: add su option to logrotate file definitions
- rpmlint: use python3_fix_shebang_path to adjust interpreter</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1759492800">- Adding updated copyright notice
- 0002-frr-logrotate.patch: rotating logfiles under the frr user</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770897600">- Apply upstream ospfd NULL Pointer Dereference fixes.
  The vulnerability allowed attackers to cause a Denial of Service
  (DoS) via crafted OSPF packets
  (bsc#1252838,bsc#1252829,bsc#1252833,bsc#1252835,bsc#1252810,
  bsc#1252811,bsc#1252761,bsc#1252812,bsc#1252813,CVE-2025-61099,
  CVE-2025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,
  CVE-2025-61104,CVE-2025-61105,CVE-2025-61106,CVE-2025-61107,
  https://github.com/FRRouting/frr/pull/19983)
  [+ 0003-ospfd-NULL-Pointer-Dereference-fixes.patch]
- Add -Wno-error=declaration-after-statement to avoid C90 errors;
  frr requires C11 compiler with atomic support and sets -std=gnu11</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770984000">- Switch to logrotate config correcting log file empty issue
  (gh#FRRouting/frr/issues/15818) depending if syslog or file
  logging is used in the frr.conf.
- Fix /var/run leftovers in logrotate config and service file,
  create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).
- Adjust rpm requires for service macros and log rotation (lsof).</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771070400">- Bumping version to 10.5.1.
- new module: PIM MLAG Active-Active support (mlab_pb0)
- removed module: zebra_irdp (replaced by dpdk)
- bgpd
  - Allow proper shutdown of bgp dynamic peers in rare case
  - Check length for dynamic capability (software version new encoding)
  - Correction in json output structure for no data case
  - Fix labeled unicast inbound policy lookup
  - Fix labeled-unicast output
  - Fix maximum-prefix session recovery for peers and peer-groups
  - Fix memory leak in bgp nhc tlv processing
  - Fix route node lock leak in nht resolved prefix marking
  - Fix srv6-only command defaulted when 'no segment-routing ipv6'
  - Send route-refresh and/or trigger soft reconfig on enforce-first-as
  - Try to handle software version capability with the new encoding format
- isisd
  - Use ipv6 mtid for srv6 locator tlvs when ipv6 mt is enabled
- pimd
  - Add pim_debug_pim_reg protection for pim register stop debug message
  - Crash while trying mroute_read when fd=-1
  - Df election on zebra peer down synced to the mlag peer
  - Fix for mc frame loss in a sequential traffic test
  - Fix pim mlag update peer zebra status upon local mlag connection restoration
  - Fix warnings for pimd
  - Crash when pimreg interface not present
  - Crashed because of indexing invalid index in an array
  - Prevent crash on interface removal
- vrrpd
  - vrrp interface delete fails to free connected route
- zebrad
  - Fix crash due to lack of control of received number of srv6 sid from netlink</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1772712000">- Add a factorydir build conditional to install the /etc/frr files in
  the /usr/share/factory and copy/link this initial/default config via
  tmpfiles.conf, enabled for suse versions &gt; 16.0 (jsc#PED-14796).
- Create the tmpfiles.conf in the spec file instead to sed rpm source.
- Move creation of config files from rpm install to the build section.
- Improve to use 0751 permissions for the /etc/frr directory to avoid
  permission denied warning for vtysh.conf in vtysh started as user.
- Change to frr.conf to use log syslog (journal) by default
- Do not install obsolete/unused system-v script and manual page
- Fix (include) file listed twice rpm warning in frr-devel package.</changelog>
</package>
<package pkgid="308763317f7f123c7f0a740f412a7a3afddb182a83c13e513d46b8e1df3b7500398038a48a26005551dbfd0cdf59bb9820ad3eec51ff743b74a6fead62b24499" name="ladspa-caps" arch="src">
  <version epoch="0" ver="0.9.26" rel="3.60"/>
  <changelog author="tiwai@suse.de" date="1387195200">- Initial version 0.4.4: split from ladspa package
- Patch carried from the original ladspa package
  caps-fix-double-free.diff</changelog>
  <changelog author="tiwai@suse.de" date="1393416000">- correct the license to GPL-2.0+</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1393675200">- use verbatim upstream tarball
- add source URLs, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="tiwai@suse.de" date="1393848000">- Remove obsoleted autoreq/autoprov tags</changelog>
  <changelog author="bwiedemann@suse.com" date="1495454400">- Add reproducible.patch to sort input files to make build more reproducible</changelog>
  <changelog author="Luigi Baldoni &lt;aloisio@gmx.com&gt;" date="1572782400">- Update to version 0.9.26:
  * documentation updates
  * DDDelay removed, needs more work
  version 0.9.25:
  * potential gcc overoptimisation resulting in NaN in Kaiser
    window setup eliminated (fix contributed by Jean Pierre
    Cimalando)
  * updated to reflect changes to the div() and pow10f()
    functions in libc
  * tonestack coefficient update reverted to original Yeh
    implementation
  * Compress default measurement mode switched to RMS, attack
    range doubled
  * Compress power and gain filter cutoff lowered to lessen
    intermodulation distortion
  * Plate defaults changed
  * volume control added to Spice hi and lo circuits, max gain
    reduced on both
  * Wider output channels swapped
  * AutoFilter rate lowered
  * Scape parameters cleaned up and remapped, tune control
    removed
  * Noisegate hysteresis increased to 180 ms
  * dc-30 tonestack R3 20k -&gt; 10k
  * Eq10 Q changed to render optimally flat response at all zero
    band gain settings
  * div port added to Click
  * new plugin DDDelay
  version 0.9.24:
  * documentation updates including switch to 48k for all spectra
  * "twin" and "stanford" tonestack models swap places
  * ChorusI feedback changed to interpolation, softens zipper
    noise on t changes
  * use vestigial FPTruncateMode only on pre-SSE2 hardware
  * 4x128 oversampling option removed from Compress plugins
  * state port displaying current gain reduction on Compress
    plugins
  * _latency port for parallel Eq
  * Saturate fade-in bug eliminated
  * Noisegate hysteresis interval lengthened
  * Click sounds "stick" brightened and "beep" shortened
  * run_adding() removed, reducing binary size by 30 % and
    compile time similarly
  * JVRev tail modified, low-passed
  * all ports reordered to consistent ctrl i/o audio i/o order
  * Eq4p crossfade reimplemented as equal-power squared cosine,
    smoother now
  * EqFA4p added
  * non-SSE v4f_shuffle surrogate fixed
    (fixes Eq4p on ARM, reported by Jens Dreske)
  * dropped 44.1 kHz ToneStackLT
  * OnePole header renamed IIR1, filters renamed LP1 and HP1
  * BiQuad header and filter renamed IIR2, SIMD *4f filters
    renamed *v4
  * CabinetIII (less demanding loudspeaker emulation resurrected
    again)
  * ChorusI port ranges and defaults adjusted
  * Compress parameter mappings and defaults adjusted
  version 0.9.23:
  * ChorusI hp filter denormal protection added
  version 0.9.22:
  * ChorusI blend behaviour changed
  * ChorusI parameters adjusted
  * ChorusI hp filter before delay added
  * AutoFilter parameters adjusted
  * AutoFilter 'range' port becomes 'depth'
  version 0.9.21:
  * Eq10 Q increased
  * AmpVTS bright/compression/gain mappings adjusted
  * AutoFilter reverted to 0.9.1 version with adjusted parameters
  version 0.9.20:
  * ToneStack ports rearranged (following "control before audio"
    convention)
  * ToneStack LT model selection fixed
  version 0.9.19:
  * Noisegate partially rewritten, defaults adjusted
  * Noisegate bug causing spurious gain fluctuations in closed
    state eliminated
  * AmpVTS compression controls adjusted
  * influence of total gain on compression in AmpVTS reduced
  * documentation polish
  version 0.9.18:
  * restored ToneStack presets to present the full list
  * AmpVTS 'bright' filter given slight resonance
  * AmpVTS compression control range widened
  version 0.9.17:
  * multiple inclusion header guards changed to comply with
    ISO/IEC 9899:2011 (at the insistence of Markus Elfring)
  * PlateX2 fixed to read correct port for damping parameter
    (reported by James Morris)
  * uninstall removes rdf
  * DSP::FIR4f::set_kernel size overflow in default parameter
    fixed (reported and isolated by Ricardo Crudo)
  * AmpVTS "lowcut" filter changed from 2- to 1-pole
  * "HK 20" tonestack renamed to "AK 20"
  * AmpVTS lowcut mapping changed, default lowered
  * AmpVTS highpass 1 cutoff raised
  * lowpass filter added to Noisegate's opening peak detector
  * Noisegate not NoiseGate
  * Click normal addition limited to idle loop
  * NoiseGate logic loop bug fixed, hysteresis added
  * documentation polish
  version 0.9.16:
  * NoiseGate simplified, sped up, gain lowpassed, click bug
    eliminated
  * Sin smoothened, defaults updated
  * PhaserII defaults updated
  * Fractal defaults updated
  * documentation polish
  version 0.9.15:
  * no-vector-arithmetic compilation fixed
  version 0.9.14:
  * AutoFilter x/y parameter eliminated
  * Fractal hp changed to be configurable, attractors
    recalibrated
  * DSP::Lorenz instantly initialises to useful state
  * documentation polish
  version 0.9.13:
  * Eq4p softens drastic parameter changes by crossfading static
    filters
  * Eq4p employing single v4f filter, slightly quicker
  * Eq4p 'off' filter mode
  * documentation and interface polish
  version 0.9.12:
  * non-SSE compilation fixed
  version 0.9.11:
  * DSP::Roessler instantly initialises to useful state
  * Logarithmic port bounds and values fixed to reflect actual
    intent, affecting Spice, AutoFilter and ChorusI
  * clicking automatic gain fade on activate() eliminated in
    Saturate
  * Dirac merged into Click
  * Lorenz and Roessler merged into Fractal
  * JVRev removed
  * running plugins for zero frames returns without touching
    state
  * CabinetII and III removed
  * PhaserII sine LFO and LFO choice port added
  * PhaserII fractal modulation extensively revised
  * ChorusI rate lower bound slightly increased
  * ChorusI delay line length adjusted to accommodate full
    t+width range
  * all Chorus and Phaser plugins removed save for ChorusI and
    PhaserII
  * major documentation revision
  * Eq4p parametric equaliser plugin
  * RBJ shelving filter prototype implementation fixed
  * "2x2" stereo plugin label postfix changed to "X2"
  * Eq renamed Eq10
  * SIMD implementation updates
  * DSP::RBJ coefficient calculation rearranged
  * Click bpm range changed, default lowered substantially
  version 0.9.10:
  * DSP::RMS protected against negative sum of squares
  * documentation updates
  version 0.9.8:
  * Spice enabled by default, Spice2x2 added
  * AmpVTS default oversampling ratio changed to 4x
  * JVRev refinements
  * Cabinet gain upper limit reinstated to 24 dB
  * AutoFilter modulation slightly adjusted
  * more *ChorusII modulation smoothness
  * 1st-order IIR lp set_f fix part 2
  * 1st-order IIR lp set_f fix part 1
  * 1st order low-pass for AutoFilter modulation LFO
  * DelayTapA removed
  * README updated
  * Click 'stick' sound brightened
  * moved processor_specific_denormal_measures() to activate(),
    speedup
  version 0.9.7:
  * ChorusI is back
  * AutoFilter modulation range and default parameter updates
  version 0.9.6:
  * Click fixed to compile by older g++ versions
  version 0.9.5:
  * AmpVTS model port moved, renamed to the more apt 'tonestack'
  * documentation refinements
  * appreciable AmpVTS speedup by going back to sample_t for
    accumulator
  * NoiseRatio attack time control
  * sample rate dependencies in NoiseGate removed, time
    constants revised
  * Tonestacks reordered
  * Plugin::over_fs
  * AmpVTS model setting fixed to follow the correct input
  * CabinetIII resurrected
  * AmpVTS 'ratio' port renamed to 'over'
  * more filters for AutoFilter, ladder stage gain control
  * AutoFilter oversampling
  * AmpVTS bias in poweramp, dcblock before output
  * AutoFilter envelope calculation fixed for fs &gt; 153.6 kHz
  * peak/rms selection for Compress
  * AmpVTS tuning
  version 0.9.4:
  * AmpVTS bright mapping revised
  * Compress hi-pass removed
  * Compress saturation changed from tanh to atan
  * beep wave for Click
  * selectable oversampling ratio for Compress in saturating
    mode
  * fixed Compress to apply gain before saturation
  * replaced sample_func_t with the more apt yield_func_t
  * minor cosmetics
  * caps-doc is a separate package
  * selectable wave for Click, parfiltmodel added
  * further smoothened ChorusII modulation
  * selectable oversampling ratio for Amp
  * moved some compress setup calls from Amp's run() to
    activate()
  * rdf target prerequisite for dist
  * Eq Q fixed, flat response at 0 gain
  version 0.9.3:
  * Smoother modulation for ChorusII
  * AmpVTS filters retuned
  * correction for ToneStack gain in AmpVTS
  * ToneStack models reordered, 'wookie', 'porky', 'HK 20',
    'nihon ace' models added
  * Amp 'bias' now a filtered function of output power, control
    removed
  * division operation in 1st-order hipass setup replaced by
    multiplication
  * Saturate gain = 0 dB in 'bypass' mode
  * Saturate 'rectify' mode
  * AmpVTS, Plate control mapping adjusted
  version 0.9.2:
  * included dsp/polynomials.cc in the tarball
  version 0.9.1:
  * Lorenz/Roessler rate linked to fs
  * AutoFilter replaces SweepVFI
  * CabinetIV
  * fixed erroneous float promotion of upsampler z padding
    parameter
  * lots of parameter tuning
  * many cleanuppies here and there
  * SweepVFI/AutoFilter saturating SVFII ladder (instead of
    oversampled SVFI)
  * UniqueIDs moved into interface.cc
  * SweepVFI modulation comes as range + x/z now
  * GPL v3
  * more Phaser notches
  * LR filters for Spice
  * Saturate inverse gain for approximately constant loudness
  * Scape extensively reworked
  * further refinements to Chorus and Phaser units for smoother
    modulation
  * SweepVFII removed
  * LADSPA_PORT_GROUP
  * Compress* input gain removed
  * ToneStackLT rolled into ToneStack and eliminated
  * fixed w miscalculation in DSP::Sine::set_f with fs given
  * AmpPlus/AmpVTS total rewrite
  * TubeCompress merged into Compress, for great template
    goodness
  * *Chorus* modulation rate decoupled from samplerate
  * tanh approximation, available in the Saturate plugin
  * *Chorus* units reworked for smoother modulation and sound
  * StereoChorusII2x2 plugin
  * JVRev bandwidth filter/control added
  * VCO* removed
  * HRTF removed
  * ChorusI, StereoChorusI, PhaserI removed
  * CabinetI removed
  * No more AmpStub silliness
  * All Amp and Preamp plugins removed, save for AmpVTS
  * Incite rechristened Spice
  * JVRev blend range normalised to [0..1]
  * Plate input value ranges adjusted to uniform [0..1]
  * Phaser* spread value range upper bound adjusted to 1 from pi
    multiples
  version 0.9.0:
  * White bleached (was slightly pinkish before)
  * up+down oversampling functionality rolled into one class
  * Incite plugin
  * total redesign of the Clip plugin, renamed to Saturate
  * NoiseGate plugin
  * RBJ prototypes changed to accept biquad instead of coeff.
    arrays
  * various default value changes
  * all FIRs changed to use templated kernel size, appreciable
    speedup for all oversampled plugins
  * reduced the number of arithmetic operations in the tonestack
    coefficient update function, speedup for ToneStack and
    AmpVTS
  * TubeCompress2x2 plugin
  * TubeCompress plugin
  * no more borrowed kernels!
  * CabinetII gain adjusted for Mesa and Pro Jr models (much
    lower now and more in line with the other models)
  * Amp final drive gain reduced slightly to prevent foldover
    distortion
  * SweepVF fractal rate control mapping adjusted
  * Pan completely redesigned with Orban-like stereo image
    synthesis
  * Narrower mode switch and mid/side operation added
  * Plate parameter ranges modified for a brighter and less
    reverberant default sound
  * VCOd sync option had to be dropped due to compiler
    incompatibility
  * Lorenz, Roessler fitted with a dc-blocking filter
  * all int sample loop variables changed to unsigned, slightest
    speedup
  * Compress2x2 plugin
  * Compress plugin replaced with a completely new design
  * Phaser feedback port ranges sanitised
  * StereoPhaser plugins
  * PhaserII gain reduced by 6dB
  * "latency" outputs of all plugins removed
  * Descriptor array handling changed to disable individual
    plugins with relative ease
  * fixed instances of g++ -O3 and above compiled code
    segfaulting, performance gained everywhere
  * documentation reworked extensively
  * CEO wave is resampled at runtime from fs = 8kHz source
  * CEO mantra changed (now an flite recording)
  * Click changed to use modal synthesis to generate the click
    wavetable, for improved sound and independency of sample
    rate
  * Plate changed to do delay summation using doubles
  * 1st and 2nd order filters changed to use templated types for
    coefficient and state storage
  * 1st order input hipass added to AmpVTS plugin
  * filter 'mode' port added to AutoWah, and renamed to
    AutoFilter
  * fixed improper 'model' labels meant to be 'mode' in the rdf
    generator
  version 0.4.5:
  * Narrower plugin added
  * fixed 'configure.py' to work with python3
  * fixed Sin, Roessler and Lorenz gain smoothing on activation
- Dropped caps-fix-double-free.diff (no longer applicable)
- Refreshed reproducible.patch
- Spec cleanup</changelog>
</package>
<package pkgid="bc24253fa95b41cf5166f261909dee2e2db56998f76150242d1831311efad6e294a4d87433ea7004466f784796a9cbe2511845851c4d20651ab8d42a8f7cf3a3" name="ladspa-caps" arch="x86_64">
  <version epoch="0" ver="0.9.26" rel="3.60"/>
  <changelog author="tiwai@suse.de" date="1387195200">- Initial version 0.4.4: split from ladspa package
- Patch carried from the original ladspa package
  caps-fix-double-free.diff</changelog>
  <changelog author="tiwai@suse.de" date="1393416000">- correct the license to GPL-2.0+</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1393675200">- use verbatim upstream tarball
- add source URLs, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="tiwai@suse.de" date="1393848000">- Remove obsoleted autoreq/autoprov tags</changelog>
  <changelog author="bwiedemann@suse.com" date="1495454400">- Add reproducible.patch to sort input files to make build more reproducible</changelog>
  <changelog author="Luigi Baldoni &lt;aloisio@gmx.com&gt;" date="1572782400">- Update to version 0.9.26:
  * documentation updates
  * DDDelay removed, needs more work
  version 0.9.25:
  * potential gcc overoptimisation resulting in NaN in Kaiser
    window setup eliminated (fix contributed by Jean Pierre
    Cimalando)
  * updated to reflect changes to the div() and pow10f()
    functions in libc
  * tonestack coefficient update reverted to original Yeh
    implementation
  * Compress default measurement mode switched to RMS, attack
    range doubled
  * Compress power and gain filter cutoff lowered to lessen
    intermodulation distortion
  * Plate defaults changed
  * volume control added to Spice hi and lo circuits, max gain
    reduced on both
  * Wider output channels swapped
  * AutoFilter rate lowered
  * Scape parameters cleaned up and remapped, tune control
    removed
  * Noisegate hysteresis increased to 180 ms
  * dc-30 tonestack R3 20k -&gt; 10k
  * Eq10 Q changed to render optimally flat response at all zero
    band gain settings
  * div port added to Click
  * new plugin DDDelay
  version 0.9.24:
  * documentation updates including switch to 48k for all spectra
  * "twin" and "stanford" tonestack models swap places
  * ChorusI feedback changed to interpolation, softens zipper
    noise on t changes
  * use vestigial FPTruncateMode only on pre-SSE2 hardware
  * 4x128 oversampling option removed from Compress plugins
  * state port displaying current gain reduction on Compress
    plugins
  * _latency port for parallel Eq
  * Saturate fade-in bug eliminated
  * Noisegate hysteresis interval lengthened
  * Click sounds "stick" brightened and "beep" shortened
  * run_adding() removed, reducing binary size by 30 % and
    compile time similarly
  * JVRev tail modified, low-passed
  * all ports reordered to consistent ctrl i/o audio i/o order
  * Eq4p crossfade reimplemented as equal-power squared cosine,
    smoother now
  * EqFA4p added
  * non-SSE v4f_shuffle surrogate fixed
    (fixes Eq4p on ARM, reported by Jens Dreske)
  * dropped 44.1 kHz ToneStackLT
  * OnePole header renamed IIR1, filters renamed LP1 and HP1
  * BiQuad header and filter renamed IIR2, SIMD *4f filters
    renamed *v4
  * CabinetIII (less demanding loudspeaker emulation resurrected
    again)
  * ChorusI port ranges and defaults adjusted
  * Compress parameter mappings and defaults adjusted
  version 0.9.23:
  * ChorusI hp filter denormal protection added
  version 0.9.22:
  * ChorusI blend behaviour changed
  * ChorusI parameters adjusted
  * ChorusI hp filter before delay added
  * AutoFilter parameters adjusted
  * AutoFilter 'range' port becomes 'depth'
  version 0.9.21:
  * Eq10 Q increased
  * AmpVTS bright/compression/gain mappings adjusted
  * AutoFilter reverted to 0.9.1 version with adjusted parameters
  version 0.9.20:
  * ToneStack ports rearranged (following "control before audio"
    convention)
  * ToneStack LT model selection fixed
  version 0.9.19:
  * Noisegate partially rewritten, defaults adjusted
  * Noisegate bug causing spurious gain fluctuations in closed
    state eliminated
  * AmpVTS compression controls adjusted
  * influence of total gain on compression in AmpVTS reduced
  * documentation polish
  version 0.9.18:
  * restored ToneStack presets to present the full list
  * AmpVTS 'bright' filter given slight resonance
  * AmpVTS compression control range widened
  version 0.9.17:
  * multiple inclusion header guards changed to comply with
    ISO/IEC 9899:2011 (at the insistence of Markus Elfring)
  * PlateX2 fixed to read correct port for damping parameter
    (reported by James Morris)
  * uninstall removes rdf
  * DSP::FIR4f::set_kernel size overflow in default parameter
    fixed (reported and isolated by Ricardo Crudo)
  * AmpVTS "lowcut" filter changed from 2- to 1-pole
  * "HK 20" tonestack renamed to "AK 20"
  * AmpVTS lowcut mapping changed, default lowered
  * AmpVTS highpass 1 cutoff raised
  * lowpass filter added to Noisegate's opening peak detector
  * Noisegate not NoiseGate
  * Click normal addition limited to idle loop
  * NoiseGate logic loop bug fixed, hysteresis added
  * documentation polish
  version 0.9.16:
  * NoiseGate simplified, sped up, gain lowpassed, click bug
    eliminated
  * Sin smoothened, defaults updated
  * PhaserII defaults updated
  * Fractal defaults updated
  * documentation polish
  version 0.9.15:
  * no-vector-arithmetic compilation fixed
  version 0.9.14:
  * AutoFilter x/y parameter eliminated
  * Fractal hp changed to be configurable, attractors
    recalibrated
  * DSP::Lorenz instantly initialises to useful state
  * documentation polish
  version 0.9.13:
  * Eq4p softens drastic parameter changes by crossfading static
    filters
  * Eq4p employing single v4f filter, slightly quicker
  * Eq4p 'off' filter mode
  * documentation and interface polish
  version 0.9.12:
  * non-SSE compilation fixed
  version 0.9.11:
  * DSP::Roessler instantly initialises to useful state
  * Logarithmic port bounds and values fixed to reflect actual
    intent, affecting Spice, AutoFilter and ChorusI
  * clicking automatic gain fade on activate() eliminated in
    Saturate
  * Dirac merged into Click
  * Lorenz and Roessler merged into Fractal
  * JVRev removed
  * running plugins for zero frames returns without touching
    state
  * CabinetII and III removed
  * PhaserII sine LFO and LFO choice port added
  * PhaserII fractal modulation extensively revised
  * ChorusI rate lower bound slightly increased
  * ChorusI delay line length adjusted to accommodate full
    t+width range
  * all Chorus and Phaser plugins removed save for ChorusI and
    PhaserII
  * major documentation revision
  * Eq4p parametric equaliser plugin
  * RBJ shelving filter prototype implementation fixed
  * "2x2" stereo plugin label postfix changed to "X2"
  * Eq renamed Eq10
  * SIMD implementation updates
  * DSP::RBJ coefficient calculation rearranged
  * Click bpm range changed, default lowered substantially
  version 0.9.10:
  * DSP::RMS protected against negative sum of squares
  * documentation updates
  version 0.9.8:
  * Spice enabled by default, Spice2x2 added
  * AmpVTS default oversampling ratio changed to 4x
  * JVRev refinements
  * Cabinet gain upper limit reinstated to 24 dB
  * AutoFilter modulation slightly adjusted
  * more *ChorusII modulation smoothness
  * 1st-order IIR lp set_f fix part 2
  * 1st-order IIR lp set_f fix part 1
  * 1st order low-pass for AutoFilter modulation LFO
  * DelayTapA removed
  * README updated
  * Click 'stick' sound brightened
  * moved processor_specific_denormal_measures() to activate(),
    speedup
  version 0.9.7:
  * ChorusI is back
  * AutoFilter modulation range and default parameter updates
  version 0.9.6:
  * Click fixed to compile by older g++ versions
  version 0.9.5:
  * AmpVTS model port moved, renamed to the more apt 'tonestack'
  * documentation refinements
  * appreciable AmpVTS speedup by going back to sample_t for
    accumulator
  * NoiseRatio attack time control
  * sample rate dependencies in NoiseGate removed, time
    constants revised
  * Tonestacks reordered
  * Plugin::over_fs
  * AmpVTS model setting fixed to follow the correct input
  * CabinetIII resurrected
  * AmpVTS 'ratio' port renamed to 'over'
  * more filters for AutoFilter, ladder stage gain control
  * AutoFilter oversampling
  * AmpVTS bias in poweramp, dcblock before output
  * AutoFilter envelope calculation fixed for fs &gt; 153.6 kHz
  * peak/rms selection for Compress
  * AmpVTS tuning
  version 0.9.4:
  * AmpVTS bright mapping revised
  * Compress hi-pass removed
  * Compress saturation changed from tanh to atan
  * beep wave for Click
  * selectable oversampling ratio for Compress in saturating
    mode
  * fixed Compress to apply gain before saturation
  * replaced sample_func_t with the more apt yield_func_t
  * minor cosmetics
  * caps-doc is a separate package
  * selectable wave for Click, parfiltmodel added
  * further smoothened ChorusII modulation
  * selectable oversampling ratio for Amp
  * moved some compress setup calls from Amp's run() to
    activate()
  * rdf target prerequisite for dist
  * Eq Q fixed, flat response at 0 gain
  version 0.9.3:
  * Smoother modulation for ChorusII
  * AmpVTS filters retuned
  * correction for ToneStack gain in AmpVTS
  * ToneStack models reordered, 'wookie', 'porky', 'HK 20',
    'nihon ace' models added
  * Amp 'bias' now a filtered function of output power, control
    removed
  * division operation in 1st-order hipass setup replaced by
    multiplication
  * Saturate gain = 0 dB in 'bypass' mode
  * Saturate 'rectify' mode
  * AmpVTS, Plate control mapping adjusted
  version 0.9.2:
  * included dsp/polynomials.cc in the tarball
  version 0.9.1:
  * Lorenz/Roessler rate linked to fs
  * AutoFilter replaces SweepVFI
  * CabinetIV
  * fixed erroneous float promotion of upsampler z padding
    parameter
  * lots of parameter tuning
  * many cleanuppies here and there
  * SweepVFI/AutoFilter saturating SVFII ladder (instead of
    oversampled SVFI)
  * UniqueIDs moved into interface.cc
  * SweepVFI modulation comes as range + x/z now
  * GPL v3
  * more Phaser notches
  * LR filters for Spice
  * Saturate inverse gain for approximately constant loudness
  * Scape extensively reworked
  * further refinements to Chorus and Phaser units for smoother
    modulation
  * SweepVFII removed
  * LADSPA_PORT_GROUP
  * Compress* input gain removed
  * ToneStackLT rolled into ToneStack and eliminated
  * fixed w miscalculation in DSP::Sine::set_f with fs given
  * AmpPlus/AmpVTS total rewrite
  * TubeCompress merged into Compress, for great template
    goodness
  * *Chorus* modulation rate decoupled from samplerate
  * tanh approximation, available in the Saturate plugin
  * *Chorus* units reworked for smoother modulation and sound
  * StereoChorusII2x2 plugin
  * JVRev bandwidth filter/control added
  * VCO* removed
  * HRTF removed
  * ChorusI, StereoChorusI, PhaserI removed
  * CabinetI removed
  * No more AmpStub silliness
  * All Amp and Preamp plugins removed, save for AmpVTS
  * Incite rechristened Spice
  * JVRev blend range normalised to [0..1]
  * Plate input value ranges adjusted to uniform [0..1]
  * Phaser* spread value range upper bound adjusted to 1 from pi
    multiples
  version 0.9.0:
  * White bleached (was slightly pinkish before)
  * up+down oversampling functionality rolled into one class
  * Incite plugin
  * total redesign of the Clip plugin, renamed to Saturate
  * NoiseGate plugin
  * RBJ prototypes changed to accept biquad instead of coeff.
    arrays
  * various default value changes
  * all FIRs changed to use templated kernel size, appreciable
    speedup for all oversampled plugins
  * reduced the number of arithmetic operations in the tonestack
    coefficient update function, speedup for ToneStack and
    AmpVTS
  * TubeCompress2x2 plugin
  * TubeCompress plugin
  * no more borrowed kernels!
  * CabinetII gain adjusted for Mesa and Pro Jr models (much
    lower now and more in line with the other models)
  * Amp final drive gain reduced slightly to prevent foldover
    distortion
  * SweepVF fractal rate control mapping adjusted
  * Pan completely redesigned with Orban-like stereo image
    synthesis
  * Narrower mode switch and mid/side operation added
  * Plate parameter ranges modified for a brighter and less
    reverberant default sound
  * VCOd sync option had to be dropped due to compiler
    incompatibility
  * Lorenz, Roessler fitted with a dc-blocking filter
  * all int sample loop variables changed to unsigned, slightest
    speedup
  * Compress2x2 plugin
  * Compress plugin replaced with a completely new design
  * Phaser feedback port ranges sanitised
  * StereoPhaser plugins
  * PhaserII gain reduced by 6dB
  * "latency" outputs of all plugins removed
  * Descriptor array handling changed to disable individual
    plugins with relative ease
  * fixed instances of g++ -O3 and above compiled code
    segfaulting, performance gained everywhere
  * documentation reworked extensively
  * CEO wave is resampled at runtime from fs = 8kHz source
  * CEO mantra changed (now an flite recording)
  * Click changed to use modal synthesis to generate the click
    wavetable, for improved sound and independency of sample
    rate
  * Plate changed to do delay summation using doubles
  * 1st and 2nd order filters changed to use templated types for
    coefficient and state storage
  * 1st order input hipass added to AmpVTS plugin
  * filter 'mode' port added to AutoWah, and renamed to
    AutoFilter
  * fixed improper 'model' labels meant to be 'mode' in the rdf
    generator
  version 0.4.5:
  * Narrower plugin added
  * fixed 'configure.py' to work with python3
  * fixed Sin, Roessler and Lorenz gain smoothing on activation
- Dropped caps-fix-double-free.diff (no longer applicable)
- Refreshed reproducible.patch
- Spec cleanup</changelog>
</package>
<package pkgid="cfbcd9a260ad62bfbb79258a44a259704099b1c38ff0e3919843d14c6bae81b5f98fb4a1515c870195887bea4bbb7f3d3411dbbc073b171812e57e1cbeca86af" name="ldb-tools" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="413261e8d56616704f34cc91ae5ca4224a14a6fde472d2444a1c827aa897cb4d157cb30abe56097746473541fd25fbe23bd5d84ff7a6490fcb56e68168c2bd3d" name="libfrr0" arch="x86_64">
  <version epoch="0" ver="10.6.0" rel="4.23"/>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1701691200">- Apply upstream fix for a crash on malformed BGP UPDATE message
  with an EOR, because the presence of EOR does not lead to a
  treat-as-withdraw outcome (CVE-2023-47235,bsc#1216896,https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
  [+ 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch]
- Apply upstream fix for a crash on crafted BGP UPDATE message with
  a MP_UNREACH_NLRI attribute and additional NLRI data (CVE-2023-47234,
  bsc#1216897,https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf)
  [+ 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch]
- Apply upstream fix for attempts to read beyond the end of the
  stream during labeled unicast parsing (CVE-2023-38407,bsc#1216899,https://github.com/FRRouting/frr/pull/12956/commits/ab362eae68edec12c175d9bc488bcc3f8b73d36f)
  [+ 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch]
- Apply upstream fix for an nlri length of zero mishandling, aka
  "flowspec overflow" (CVE-2023-38406,bsc#1216900,https://github.com/FRRouting/frr/pull/12884/commits/0b999c886e241c52bd1f7ef0066700e4b618ebb3)
  [+ 0018-bgpd-Flowspec-overflow-issue.patch]</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build with RPM 4.19: a stray %-escape sequence was found in
  the files section.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1707393600">- Provide user/group symbol for user created during pre.</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1712750400">- add
  0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch:
  * Apply upstream fix on error handling when receiving BGP Prefix
    SID attribute (bsc#1222518,CVE-2024-31948,gh#FRRouting/frr#15628)</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1713960000">- Apply upstream fix solving crash in OSPF TE parsing (bsc#1220548,
  CVE-2024-27913, gh#FRRouting/frr#15431)
  [+ 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1717502400">- Apply upstream fix solving ospfd denial of service via get_edge()
  function returning a NULL pointer (CVE-2024-34088,bsc#1223786,
  gh#FRRouting/frr#16088).
  [+ 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in ospf_te_parse_ext_link for OSPF LSA packets during an attempt
  to read Segment Routing Adjacency SID subTLVs (CVE-2024-31951,
  bsc#1222528,gh#FRRouting/frr#16088).
  [+ 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in RI parsing with OSPF TE (CVE-2024-31950,bsc#1222526,
  gh#FRRouting/frr#16088).
  [+ 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch]</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722168000">- Update to version 10.0.1 from official sources.
  See https://frrouting.org/release/10.0.1/
- Clean slate: removing all previous patches.
- The following patches were obsoleted:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  - 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch
  - 0004-tools-remove-backslash-from-declare-check-regex.patch
  - 0005-root-ok-in-account-frr.pam.patch
  - 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch
  - 0007-bgpd-Ensure-stream-received-has-enough-data.patch
  - 0008-bgpd-Don-t-read-the-first-byte-of-ORF-header-if-we-a.patch
  - 0009-bgpd-Do-not-process-NLRIs-if-the-attribute-length-is.patch
  - 0010-bgpd-Use-treat-as-withdraw-for-tunnel-encapsulation-.patch
  - 0011-babeld-fix-11808-to-avoid-infinite-loops.patch
  - 0012-bgpd-Limit-flowspec-to-no-attribute-means-a-implicit.patch
  - 0013-bgpd-Check-mandatory-attributes-more-carefully-for-U.patch
  - 0014-bgpd-Handle-MP_REACH_NLRI-malformed-packets-with-ses.patch
  - 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch
  - 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch
  - 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch
  - 0018-bgpd-Flowspec-overflow-issue.patch
  - 0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch
  - 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch
  - 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch
  - 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch
  - 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1723204800">- Fixing Source URL/archive name.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1724328000">- Apply upstream fix for crash in bgp_attr_encap that were missing
  a check of the actual remaining stream length before taking the
  TLV value (CVE-2024-44070,bsc#1229438,gh#FRRouting/frr#16502):
  + 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch
- Re-added 0001-disable-zmq-test.patch to avoid (sporadic or arch
  specific, e.g. aarch64) "make check" test failures (bsc#1180217).
  + 0001-disable-zmq-test.patch
- Re-added hardening patch for systemd service(s) (bsc#1181400):
  + harden_frr.service.patch
- Cleanup unknown --enable-systemd and correct the --sysconfdir
  and --localstatedir configure options to not end in …/frr.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488000">- fixed bug/pull request references in frr.changes file</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488001">- add release notes url to 10.0.1 update</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1727697600">- Update to frr 10.0.2 release providing fix for CVE-2024-44070
  and other issues, see https://frrouting.org/release/10.0.2/
- Removed patch included in the sources:
  [- 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1736424000">- Update to frr 10.2.1 release providing fix for a Denial of Service
  scenario due to RIB revalidation (CVE-2024-55553,bsc#1235237) and
  other fixes, see https://frrouting.org/release/10.2.1/
  The 10.2 version provides new features and many enhancements, see
  https://frrouting.org/release/10.2/
- Add new fpm_listener daemon binary to rpm file lists.
- Remove --localstatedir configure parameter causing to use /run/lib
  instead of /var/lib prefix for the northbound databases and added
  the /var/lib/frr directory to the rpm file list.
- Adjust to set permissions in rpm attr macros (rpmlint suggestion)
  and use frr_group instead of frr_user in group parameter.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742558400">- build with pcre2</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1759233600">- Drop rcfrr service symlink (jsc#PED-266)
- Change to sysuser-tools and macros to create user+groups
- rpmlint: add su option to logrotate file definitions
- rpmlint: use python3_fix_shebang_path to adjust interpreter</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1759492800">- Adding updated copyright notice
- 0002-frr-logrotate.patch: rotating logfiles under the frr user</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770897600">- Apply upstream ospfd NULL Pointer Dereference fixes.
  The vulnerability allowed attackers to cause a Denial of Service
  (DoS) via crafted OSPF packets
  (bsc#1252838,bsc#1252829,bsc#1252833,bsc#1252835,bsc#1252810,
  bsc#1252811,bsc#1252761,bsc#1252812,bsc#1252813,CVE-2025-61099,
  CVE-2025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,
  CVE-2025-61104,CVE-2025-61105,CVE-2025-61106,CVE-2025-61107,
  https://github.com/FRRouting/frr/pull/19983)
  [+ 0003-ospfd-NULL-Pointer-Dereference-fixes.patch]
- Add -Wno-error=declaration-after-statement to avoid C90 errors;
  frr requires C11 compiler with atomic support and sets -std=gnu11</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770984000">- Switch to logrotate config correcting log file empty issue
  (gh#FRRouting/frr/issues/15818) depending if syslog or file
  logging is used in the frr.conf.
- Fix /var/run leftovers in logrotate config and service file,
  create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).
- Adjust rpm requires for service macros and log rotation (lsof).</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771070400">- Bumping version to 10.5.1.
- new module: PIM MLAG Active-Active support (mlab_pb0)
- removed module: zebra_irdp (replaced by dpdk)
- bgpd
  - Allow proper shutdown of bgp dynamic peers in rare case
  - Check length for dynamic capability (software version new encoding)
  - Correction in json output structure for no data case
  - Fix labeled unicast inbound policy lookup
  - Fix labeled-unicast output
  - Fix maximum-prefix session recovery for peers and peer-groups
  - Fix memory leak in bgp nhc tlv processing
  - Fix route node lock leak in nht resolved prefix marking
  - Fix srv6-only command defaulted when 'no segment-routing ipv6'
  - Send route-refresh and/or trigger soft reconfig on enforce-first-as
  - Try to handle software version capability with the new encoding format
- isisd
  - Use ipv6 mtid for srv6 locator tlvs when ipv6 mt is enabled
- pimd
  - Add pim_debug_pim_reg protection for pim register stop debug message
  - Crash while trying mroute_read when fd=-1
  - Df election on zebra peer down synced to the mlag peer
  - Fix for mc frame loss in a sequential traffic test
  - Fix pim mlag update peer zebra status upon local mlag connection restoration
  - Fix warnings for pimd
  - Crash when pimreg interface not present
  - Crashed because of indexing invalid index in an array
  - Prevent crash on interface removal
- vrrpd
  - vrrp interface delete fails to free connected route
- zebrad
  - Fix crash due to lack of control of received number of srv6 sid from netlink</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1772712000">- Add a factorydir build conditional to install the /etc/frr files in
  the /usr/share/factory and copy/link this initial/default config via
  tmpfiles.conf, enabled for suse versions &gt; 16.0 (jsc#PED-14796).
- Create the tmpfiles.conf in the spec file instead to sed rpm source.
- Move creation of config files from rpm install to the build section.
- Improve to use 0751 permissions for the /etc/frr directory to avoid
  permission denied warning for vtysh.conf in vtysh started as user.
- Change to frr.conf to use log syslog (journal) by default
- Do not install obsolete/unused system-v script and manual page
- Fix (include) file listed twice rpm warning in frr-devel package.</changelog>
</package>
<package pkgid="306af4f02db45880142c8b3494cfda5ee3236e5ab05ef1c02d5aba328420a92a3c1c625811534f8f2b8ba6545fd593208a73c7ebcfa95604e0985e8843d2add8" name="libfrr_pb0" arch="x86_64">
  <version epoch="0" ver="10.6.0" rel="4.23"/>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1701691200">- Apply upstream fix for a crash on malformed BGP UPDATE message
  with an EOR, because the presence of EOR does not lead to a
  treat-as-withdraw outcome (CVE-2023-47235,bsc#1216896,https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
  [+ 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch]
- Apply upstream fix for a crash on crafted BGP UPDATE message with
  a MP_UNREACH_NLRI attribute and additional NLRI data (CVE-2023-47234,
  bsc#1216897,https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf)
  [+ 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch]
- Apply upstream fix for attempts to read beyond the end of the
  stream during labeled unicast parsing (CVE-2023-38407,bsc#1216899,https://github.com/FRRouting/frr/pull/12956/commits/ab362eae68edec12c175d9bc488bcc3f8b73d36f)
  [+ 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch]
- Apply upstream fix for an nlri length of zero mishandling, aka
  "flowspec overflow" (CVE-2023-38406,bsc#1216900,https://github.com/FRRouting/frr/pull/12884/commits/0b999c886e241c52bd1f7ef0066700e4b618ebb3)
  [+ 0018-bgpd-Flowspec-overflow-issue.patch]</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build with RPM 4.19: a stray %-escape sequence was found in
  the files section.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1707393600">- Provide user/group symbol for user created during pre.</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1712750400">- add
  0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch:
  * Apply upstream fix on error handling when receiving BGP Prefix
    SID attribute (bsc#1222518,CVE-2024-31948,gh#FRRouting/frr#15628)</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1713960000">- Apply upstream fix solving crash in OSPF TE parsing (bsc#1220548,
  CVE-2024-27913, gh#FRRouting/frr#15431)
  [+ 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1717502400">- Apply upstream fix solving ospfd denial of service via get_edge()
  function returning a NULL pointer (CVE-2024-34088,bsc#1223786,
  gh#FRRouting/frr#16088).
  [+ 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in ospf_te_parse_ext_link for OSPF LSA packets during an attempt
  to read Segment Routing Adjacency SID subTLVs (CVE-2024-31951,
  bsc#1222528,gh#FRRouting/frr#16088).
  [+ 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in RI parsing with OSPF TE (CVE-2024-31950,bsc#1222526,
  gh#FRRouting/frr#16088).
  [+ 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch]</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722168000">- Update to version 10.0.1 from official sources.
  See https://frrouting.org/release/10.0.1/
- Clean slate: removing all previous patches.
- The following patches were obsoleted:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  - 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch
  - 0004-tools-remove-backslash-from-declare-check-regex.patch
  - 0005-root-ok-in-account-frr.pam.patch
  - 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch
  - 0007-bgpd-Ensure-stream-received-has-enough-data.patch
  - 0008-bgpd-Don-t-read-the-first-byte-of-ORF-header-if-we-a.patch
  - 0009-bgpd-Do-not-process-NLRIs-if-the-attribute-length-is.patch
  - 0010-bgpd-Use-treat-as-withdraw-for-tunnel-encapsulation-.patch
  - 0011-babeld-fix-11808-to-avoid-infinite-loops.patch
  - 0012-bgpd-Limit-flowspec-to-no-attribute-means-a-implicit.patch
  - 0013-bgpd-Check-mandatory-attributes-more-carefully-for-U.patch
  - 0014-bgpd-Handle-MP_REACH_NLRI-malformed-packets-with-ses.patch
  - 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch
  - 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch
  - 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch
  - 0018-bgpd-Flowspec-overflow-issue.patch
  - 0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch
  - 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch
  - 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch
  - 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch
  - 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1723204800">- Fixing Source URL/archive name.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1724328000">- Apply upstream fix for crash in bgp_attr_encap that were missing
  a check of the actual remaining stream length before taking the
  TLV value (CVE-2024-44070,bsc#1229438,gh#FRRouting/frr#16502):
  + 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch
- Re-added 0001-disable-zmq-test.patch to avoid (sporadic or arch
  specific, e.g. aarch64) "make check" test failures (bsc#1180217).
  + 0001-disable-zmq-test.patch
- Re-added hardening patch for systemd service(s) (bsc#1181400):
  + harden_frr.service.patch
- Cleanup unknown --enable-systemd and correct the --sysconfdir
  and --localstatedir configure options to not end in …/frr.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488000">- fixed bug/pull request references in frr.changes file</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488001">- add release notes url to 10.0.1 update</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1727697600">- Update to frr 10.0.2 release providing fix for CVE-2024-44070
  and other issues, see https://frrouting.org/release/10.0.2/
- Removed patch included in the sources:
  [- 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1736424000">- Update to frr 10.2.1 release providing fix for a Denial of Service
  scenario due to RIB revalidation (CVE-2024-55553,bsc#1235237) and
  other fixes, see https://frrouting.org/release/10.2.1/
  The 10.2 version provides new features and many enhancements, see
  https://frrouting.org/release/10.2/
- Add new fpm_listener daemon binary to rpm file lists.
- Remove --localstatedir configure parameter causing to use /run/lib
  instead of /var/lib prefix for the northbound databases and added
  the /var/lib/frr directory to the rpm file list.
- Adjust to set permissions in rpm attr macros (rpmlint suggestion)
  and use frr_group instead of frr_user in group parameter.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742558400">- build with pcre2</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1759233600">- Drop rcfrr service symlink (jsc#PED-266)
- Change to sysuser-tools and macros to create user+groups
- rpmlint: add su option to logrotate file definitions
- rpmlint: use python3_fix_shebang_path to adjust interpreter</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1759492800">- Adding updated copyright notice
- 0002-frr-logrotate.patch: rotating logfiles under the frr user</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770897600">- Apply upstream ospfd NULL Pointer Dereference fixes.
  The vulnerability allowed attackers to cause a Denial of Service
  (DoS) via crafted OSPF packets
  (bsc#1252838,bsc#1252829,bsc#1252833,bsc#1252835,bsc#1252810,
  bsc#1252811,bsc#1252761,bsc#1252812,bsc#1252813,CVE-2025-61099,
  CVE-2025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,
  CVE-2025-61104,CVE-2025-61105,CVE-2025-61106,CVE-2025-61107,
  https://github.com/FRRouting/frr/pull/19983)
  [+ 0003-ospfd-NULL-Pointer-Dereference-fixes.patch]
- Add -Wno-error=declaration-after-statement to avoid C90 errors;
  frr requires C11 compiler with atomic support and sets -std=gnu11</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770984000">- Switch to logrotate config correcting log file empty issue
  (gh#FRRouting/frr/issues/15818) depending if syslog or file
  logging is used in the frr.conf.
- Fix /var/run leftovers in logrotate config and service file,
  create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).
- Adjust rpm requires for service macros and log rotation (lsof).</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771070400">- Bumping version to 10.5.1.
- new module: PIM MLAG Active-Active support (mlab_pb0)
- removed module: zebra_irdp (replaced by dpdk)
- bgpd
  - Allow proper shutdown of bgp dynamic peers in rare case
  - Check length for dynamic capability (software version new encoding)
  - Correction in json output structure for no data case
  - Fix labeled unicast inbound policy lookup
  - Fix labeled-unicast output
  - Fix maximum-prefix session recovery for peers and peer-groups
  - Fix memory leak in bgp nhc tlv processing
  - Fix route node lock leak in nht resolved prefix marking
  - Fix srv6-only command defaulted when 'no segment-routing ipv6'
  - Send route-refresh and/or trigger soft reconfig on enforce-first-as
  - Try to handle software version capability with the new encoding format
- isisd
  - Use ipv6 mtid for srv6 locator tlvs when ipv6 mt is enabled
- pimd
  - Add pim_debug_pim_reg protection for pim register stop debug message
  - Crash while trying mroute_read when fd=-1
  - Df election on zebra peer down synced to the mlag peer
  - Fix for mc frame loss in a sequential traffic test
  - Fix pim mlag update peer zebra status upon local mlag connection restoration
  - Fix warnings for pimd
  - Crash when pimreg interface not present
  - Crashed because of indexing invalid index in an array
  - Prevent crash on interface removal
- vrrpd
  - vrrp interface delete fails to free connected route
- zebrad
  - Fix crash due to lack of control of received number of srv6 sid from netlink</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1772712000">- Add a factorydir build conditional to install the /etc/frr files in
  the /usr/share/factory and copy/link this initial/default config via
  tmpfiles.conf, enabled for suse versions &gt; 16.0 (jsc#PED-14796).
- Create the tmpfiles.conf in the spec file instead to sed rpm source.
- Move creation of config files from rpm install to the build section.
- Improve to use 0751 permissions for the /etc/frr directory to avoid
  permission denied warning for vtysh.conf in vtysh started as user.
- Change to frr.conf to use log syslog (journal) by default
- Do not install obsolete/unused system-v script and manual page
- Fix (include) file listed twice rpm warning in frr-devel package.</changelog>
</package>
<package pkgid="e04042647282e1976215316fd305a62fa32b8998490351586f04aea92578439ae29340d092a8ed9d40414a54810bd2d1c44bd1f43de3b560257f03001d779864" name="libfrrcares0" arch="x86_64">
  <version epoch="0" ver="10.6.0" rel="4.23"/>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1701691200">- Apply upstream fix for a crash on malformed BGP UPDATE message
  with an EOR, because the presence of EOR does not lead to a
  treat-as-withdraw outcome (CVE-2023-47235,bsc#1216896,https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
  [+ 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch]
- Apply upstream fix for a crash on crafted BGP UPDATE message with
  a MP_UNREACH_NLRI attribute and additional NLRI data (CVE-2023-47234,
  bsc#1216897,https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf)
  [+ 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch]
- Apply upstream fix for attempts to read beyond the end of the
  stream during labeled unicast parsing (CVE-2023-38407,bsc#1216899,https://github.com/FRRouting/frr/pull/12956/commits/ab362eae68edec12c175d9bc488bcc3f8b73d36f)
  [+ 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch]
- Apply upstream fix for an nlri length of zero mishandling, aka
  "flowspec overflow" (CVE-2023-38406,bsc#1216900,https://github.com/FRRouting/frr/pull/12884/commits/0b999c886e241c52bd1f7ef0066700e4b618ebb3)
  [+ 0018-bgpd-Flowspec-overflow-issue.patch]</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build with RPM 4.19: a stray %-escape sequence was found in
  the files section.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1707393600">- Provide user/group symbol for user created during pre.</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1712750400">- add
  0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch:
  * Apply upstream fix on error handling when receiving BGP Prefix
    SID attribute (bsc#1222518,CVE-2024-31948,gh#FRRouting/frr#15628)</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1713960000">- Apply upstream fix solving crash in OSPF TE parsing (bsc#1220548,
  CVE-2024-27913, gh#FRRouting/frr#15431)
  [+ 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1717502400">- Apply upstream fix solving ospfd denial of service via get_edge()
  function returning a NULL pointer (CVE-2024-34088,bsc#1223786,
  gh#FRRouting/frr#16088).
  [+ 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in ospf_te_parse_ext_link for OSPF LSA packets during an attempt
  to read Segment Routing Adjacency SID subTLVs (CVE-2024-31951,
  bsc#1222528,gh#FRRouting/frr#16088).
  [+ 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in RI parsing with OSPF TE (CVE-2024-31950,bsc#1222526,
  gh#FRRouting/frr#16088).
  [+ 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch]</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722168000">- Update to version 10.0.1 from official sources.
  See https://frrouting.org/release/10.0.1/
- Clean slate: removing all previous patches.
- The following patches were obsoleted:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  - 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch
  - 0004-tools-remove-backslash-from-declare-check-regex.patch
  - 0005-root-ok-in-account-frr.pam.patch
  - 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch
  - 0007-bgpd-Ensure-stream-received-has-enough-data.patch
  - 0008-bgpd-Don-t-read-the-first-byte-of-ORF-header-if-we-a.patch
  - 0009-bgpd-Do-not-process-NLRIs-if-the-attribute-length-is.patch
  - 0010-bgpd-Use-treat-as-withdraw-for-tunnel-encapsulation-.patch
  - 0011-babeld-fix-11808-to-avoid-infinite-loops.patch
  - 0012-bgpd-Limit-flowspec-to-no-attribute-means-a-implicit.patch
  - 0013-bgpd-Check-mandatory-attributes-more-carefully-for-U.patch
  - 0014-bgpd-Handle-MP_REACH_NLRI-malformed-packets-with-ses.patch
  - 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch
  - 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch
  - 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch
  - 0018-bgpd-Flowspec-overflow-issue.patch
  - 0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch
  - 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch
  - 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch
  - 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch
  - 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1723204800">- Fixing Source URL/archive name.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1724328000">- Apply upstream fix for crash in bgp_attr_encap that were missing
  a check of the actual remaining stream length before taking the
  TLV value (CVE-2024-44070,bsc#1229438,gh#FRRouting/frr#16502):
  + 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch
- Re-added 0001-disable-zmq-test.patch to avoid (sporadic or arch
  specific, e.g. aarch64) "make check" test failures (bsc#1180217).
  + 0001-disable-zmq-test.patch
- Re-added hardening patch for systemd service(s) (bsc#1181400):
  + harden_frr.service.patch
- Cleanup unknown --enable-systemd and correct the --sysconfdir
  and --localstatedir configure options to not end in …/frr.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488000">- fixed bug/pull request references in frr.changes file</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488001">- add release notes url to 10.0.1 update</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1727697600">- Update to frr 10.0.2 release providing fix for CVE-2024-44070
  and other issues, see https://frrouting.org/release/10.0.2/
- Removed patch included in the sources:
  [- 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1736424000">- Update to frr 10.2.1 release providing fix for a Denial of Service
  scenario due to RIB revalidation (CVE-2024-55553,bsc#1235237) and
  other fixes, see https://frrouting.org/release/10.2.1/
  The 10.2 version provides new features and many enhancements, see
  https://frrouting.org/release/10.2/
- Add new fpm_listener daemon binary to rpm file lists.
- Remove --localstatedir configure parameter causing to use /run/lib
  instead of /var/lib prefix for the northbound databases and added
  the /var/lib/frr directory to the rpm file list.
- Adjust to set permissions in rpm attr macros (rpmlint suggestion)
  and use frr_group instead of frr_user in group parameter.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742558400">- build with pcre2</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1759233600">- Drop rcfrr service symlink (jsc#PED-266)
- Change to sysuser-tools and macros to create user+groups
- rpmlint: add su option to logrotate file definitions
- rpmlint: use python3_fix_shebang_path to adjust interpreter</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1759492800">- Adding updated copyright notice
- 0002-frr-logrotate.patch: rotating logfiles under the frr user</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770897600">- Apply upstream ospfd NULL Pointer Dereference fixes.
  The vulnerability allowed attackers to cause a Denial of Service
  (DoS) via crafted OSPF packets
  (bsc#1252838,bsc#1252829,bsc#1252833,bsc#1252835,bsc#1252810,
  bsc#1252811,bsc#1252761,bsc#1252812,bsc#1252813,CVE-2025-61099,
  CVE-2025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,
  CVE-2025-61104,CVE-2025-61105,CVE-2025-61106,CVE-2025-61107,
  https://github.com/FRRouting/frr/pull/19983)
  [+ 0003-ospfd-NULL-Pointer-Dereference-fixes.patch]
- Add -Wno-error=declaration-after-statement to avoid C90 errors;
  frr requires C11 compiler with atomic support and sets -std=gnu11</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770984000">- Switch to logrotate config correcting log file empty issue
  (gh#FRRouting/frr/issues/15818) depending if syslog or file
  logging is used in the frr.conf.
- Fix /var/run leftovers in logrotate config and service file,
  create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).
- Adjust rpm requires for service macros and log rotation (lsof).</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771070400">- Bumping version to 10.5.1.
- new module: PIM MLAG Active-Active support (mlab_pb0)
- removed module: zebra_irdp (replaced by dpdk)
- bgpd
  - Allow proper shutdown of bgp dynamic peers in rare case
  - Check length for dynamic capability (software version new encoding)
  - Correction in json output structure for no data case
  - Fix labeled unicast inbound policy lookup
  - Fix labeled-unicast output
  - Fix maximum-prefix session recovery for peers and peer-groups
  - Fix memory leak in bgp nhc tlv processing
  - Fix route node lock leak in nht resolved prefix marking
  - Fix srv6-only command defaulted when 'no segment-routing ipv6'
  - Send route-refresh and/or trigger soft reconfig on enforce-first-as
  - Try to handle software version capability with the new encoding format
- isisd
  - Use ipv6 mtid for srv6 locator tlvs when ipv6 mt is enabled
- pimd
  - Add pim_debug_pim_reg protection for pim register stop debug message
  - Crash while trying mroute_read when fd=-1
  - Df election on zebra peer down synced to the mlag peer
  - Fix for mc frame loss in a sequential traffic test
  - Fix pim mlag update peer zebra status upon local mlag connection restoration
  - Fix warnings for pimd
  - Crash when pimreg interface not present
  - Crashed because of indexing invalid index in an array
  - Prevent crash on interface removal
- vrrpd
  - vrrp interface delete fails to free connected route
- zebrad
  - Fix crash due to lack of control of received number of srv6 sid from netlink</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1772712000">- Add a factorydir build conditional to install the /etc/frr files in
  the /usr/share/factory and copy/link this initial/default config via
  tmpfiles.conf, enabled for suse versions &gt; 16.0 (jsc#PED-14796).
- Create the tmpfiles.conf in the spec file instead to sed rpm source.
- Move creation of config files from rpm install to the build section.
- Improve to use 0751 permissions for the /etc/frr directory to avoid
  permission denied warning for vtysh.conf in vtysh started as user.
- Change to frr.conf to use log syslog (journal) by default
- Do not install obsolete/unused system-v script and manual page
- Fix (include) file listed twice rpm warning in frr-devel package.</changelog>
</package>
<package pkgid="b85a02f4766b8e492730c7d55c7b94988a4aa0dc7e94ecd90567fdf55abd9e18b8d2679a6eb6cb95d562cbcfbfa146e674933424a59766c7f73cad41b325cbef" name="libfrrfpm_pb0" arch="x86_64">
  <version epoch="0" ver="10.6.0" rel="4.23"/>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1701691200">- Apply upstream fix for a crash on malformed BGP UPDATE message
  with an EOR, because the presence of EOR does not lead to a
  treat-as-withdraw outcome (CVE-2023-47235,bsc#1216896,https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
  [+ 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch]
- Apply upstream fix for a crash on crafted BGP UPDATE message with
  a MP_UNREACH_NLRI attribute and additional NLRI data (CVE-2023-47234,
  bsc#1216897,https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf)
  [+ 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch]
- Apply upstream fix for attempts to read beyond the end of the
  stream during labeled unicast parsing (CVE-2023-38407,bsc#1216899,https://github.com/FRRouting/frr/pull/12956/commits/ab362eae68edec12c175d9bc488bcc3f8b73d36f)
  [+ 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch]
- Apply upstream fix for an nlri length of zero mishandling, aka
  "flowspec overflow" (CVE-2023-38406,bsc#1216900,https://github.com/FRRouting/frr/pull/12884/commits/0b999c886e241c52bd1f7ef0066700e4b618ebb3)
  [+ 0018-bgpd-Flowspec-overflow-issue.patch]</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build with RPM 4.19: a stray %-escape sequence was found in
  the files section.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1707393600">- Provide user/group symbol for user created during pre.</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1712750400">- add
  0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch:
  * Apply upstream fix on error handling when receiving BGP Prefix
    SID attribute (bsc#1222518,CVE-2024-31948,gh#FRRouting/frr#15628)</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1713960000">- Apply upstream fix solving crash in OSPF TE parsing (bsc#1220548,
  CVE-2024-27913, gh#FRRouting/frr#15431)
  [+ 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1717502400">- Apply upstream fix solving ospfd denial of service via get_edge()
  function returning a NULL pointer (CVE-2024-34088,bsc#1223786,
  gh#FRRouting/frr#16088).
  [+ 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in ospf_te_parse_ext_link for OSPF LSA packets during an attempt
  to read Segment Routing Adjacency SID subTLVs (CVE-2024-31951,
  bsc#1222528,gh#FRRouting/frr#16088).
  [+ 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in RI parsing with OSPF TE (CVE-2024-31950,bsc#1222526,
  gh#FRRouting/frr#16088).
  [+ 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch]</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722168000">- Update to version 10.0.1 from official sources.
  See https://frrouting.org/release/10.0.1/
- Clean slate: removing all previous patches.
- The following patches were obsoleted:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  - 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch
  - 0004-tools-remove-backslash-from-declare-check-regex.patch
  - 0005-root-ok-in-account-frr.pam.patch
  - 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch
  - 0007-bgpd-Ensure-stream-received-has-enough-data.patch
  - 0008-bgpd-Don-t-read-the-first-byte-of-ORF-header-if-we-a.patch
  - 0009-bgpd-Do-not-process-NLRIs-if-the-attribute-length-is.patch
  - 0010-bgpd-Use-treat-as-withdraw-for-tunnel-encapsulation-.patch
  - 0011-babeld-fix-11808-to-avoid-infinite-loops.patch
  - 0012-bgpd-Limit-flowspec-to-no-attribute-means-a-implicit.patch
  - 0013-bgpd-Check-mandatory-attributes-more-carefully-for-U.patch
  - 0014-bgpd-Handle-MP_REACH_NLRI-malformed-packets-with-ses.patch
  - 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch
  - 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch
  - 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch
  - 0018-bgpd-Flowspec-overflow-issue.patch
  - 0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch
  - 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch
  - 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch
  - 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch
  - 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1723204800">- Fixing Source URL/archive name.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1724328000">- Apply upstream fix for crash in bgp_attr_encap that were missing
  a check of the actual remaining stream length before taking the
  TLV value (CVE-2024-44070,bsc#1229438,gh#FRRouting/frr#16502):
  + 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch
- Re-added 0001-disable-zmq-test.patch to avoid (sporadic or arch
  specific, e.g. aarch64) "make check" test failures (bsc#1180217).
  + 0001-disable-zmq-test.patch
- Re-added hardening patch for systemd service(s) (bsc#1181400):
  + harden_frr.service.patch
- Cleanup unknown --enable-systemd and correct the --sysconfdir
  and --localstatedir configure options to not end in …/frr.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488000">- fixed bug/pull request references in frr.changes file</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488001">- add release notes url to 10.0.1 update</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1727697600">- Update to frr 10.0.2 release providing fix for CVE-2024-44070
  and other issues, see https://frrouting.org/release/10.0.2/
- Removed patch included in the sources:
  [- 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1736424000">- Update to frr 10.2.1 release providing fix for a Denial of Service
  scenario due to RIB revalidation (CVE-2024-55553,bsc#1235237) and
  other fixes, see https://frrouting.org/release/10.2.1/
  The 10.2 version provides new features and many enhancements, see
  https://frrouting.org/release/10.2/
- Add new fpm_listener daemon binary to rpm file lists.
- Remove --localstatedir configure parameter causing to use /run/lib
  instead of /var/lib prefix for the northbound databases and added
  the /var/lib/frr directory to the rpm file list.
- Adjust to set permissions in rpm attr macros (rpmlint suggestion)
  and use frr_group instead of frr_user in group parameter.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742558400">- build with pcre2</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1759233600">- Drop rcfrr service symlink (jsc#PED-266)
- Change to sysuser-tools and macros to create user+groups
- rpmlint: add su option to logrotate file definitions
- rpmlint: use python3_fix_shebang_path to adjust interpreter</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1759492800">- Adding updated copyright notice
- 0002-frr-logrotate.patch: rotating logfiles under the frr user</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770897600">- Apply upstream ospfd NULL Pointer Dereference fixes.
  The vulnerability allowed attackers to cause a Denial of Service
  (DoS) via crafted OSPF packets
  (bsc#1252838,bsc#1252829,bsc#1252833,bsc#1252835,bsc#1252810,
  bsc#1252811,bsc#1252761,bsc#1252812,bsc#1252813,CVE-2025-61099,
  CVE-2025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,
  CVE-2025-61104,CVE-2025-61105,CVE-2025-61106,CVE-2025-61107,
  https://github.com/FRRouting/frr/pull/19983)
  [+ 0003-ospfd-NULL-Pointer-Dereference-fixes.patch]
- Add -Wno-error=declaration-after-statement to avoid C90 errors;
  frr requires C11 compiler with atomic support and sets -std=gnu11</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770984000">- Switch to logrotate config correcting log file empty issue
  (gh#FRRouting/frr/issues/15818) depending if syslog or file
  logging is used in the frr.conf.
- Fix /var/run leftovers in logrotate config and service file,
  create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).
- Adjust rpm requires for service macros and log rotation (lsof).</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771070400">- Bumping version to 10.5.1.
- new module: PIM MLAG Active-Active support (mlab_pb0)
- removed module: zebra_irdp (replaced by dpdk)
- bgpd
  - Allow proper shutdown of bgp dynamic peers in rare case
  - Check length for dynamic capability (software version new encoding)
  - Correction in json output structure for no data case
  - Fix labeled unicast inbound policy lookup
  - Fix labeled-unicast output
  - Fix maximum-prefix session recovery for peers and peer-groups
  - Fix memory leak in bgp nhc tlv processing
  - Fix route node lock leak in nht resolved prefix marking
  - Fix srv6-only command defaulted when 'no segment-routing ipv6'
  - Send route-refresh and/or trigger soft reconfig on enforce-first-as
  - Try to handle software version capability with the new encoding format
- isisd
  - Use ipv6 mtid for srv6 locator tlvs when ipv6 mt is enabled
- pimd
  - Add pim_debug_pim_reg protection for pim register stop debug message
  - Crash while trying mroute_read when fd=-1
  - Df election on zebra peer down synced to the mlag peer
  - Fix for mc frame loss in a sequential traffic test
  - Fix pim mlag update peer zebra status upon local mlag connection restoration
  - Fix warnings for pimd
  - Crash when pimreg interface not present
  - Crashed because of indexing invalid index in an array
  - Prevent crash on interface removal
- vrrpd
  - vrrp interface delete fails to free connected route
- zebrad
  - Fix crash due to lack of control of received number of srv6 sid from netlink</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1772712000">- Add a factorydir build conditional to install the /etc/frr files in
  the /usr/share/factory and copy/link this initial/default config via
  tmpfiles.conf, enabled for suse versions &gt; 16.0 (jsc#PED-14796).
- Create the tmpfiles.conf in the spec file instead to sed rpm source.
- Move creation of config files from rpm install to the build section.
- Improve to use 0751 permissions for the /etc/frr directory to avoid
  permission denied warning for vtysh.conf in vtysh started as user.
- Change to frr.conf to use log syslog (journal) by default
- Do not install obsolete/unused system-v script and manual page
- Fix (include) file listed twice rpm warning in frr-devel package.</changelog>
</package>
<package pkgid="f3121cef291be8cc7f6b6fcd85338cb5416cd527f88dbbc0f8c4e7e075c5416a5f78ba450f05e61ed7d2574be9ade88f176547dbe01b14a67a588aa5eba49f14" name="libfrrospfapiclient0" arch="x86_64">
  <version epoch="0" ver="10.6.0" rel="4.23"/>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1701691200">- Apply upstream fix for a crash on malformed BGP UPDATE message
  with an EOR, because the presence of EOR does not lead to a
  treat-as-withdraw outcome (CVE-2023-47235,bsc#1216896,https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
  [+ 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch]
- Apply upstream fix for a crash on crafted BGP UPDATE message with
  a MP_UNREACH_NLRI attribute and additional NLRI data (CVE-2023-47234,
  bsc#1216897,https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf)
  [+ 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch]
- Apply upstream fix for attempts to read beyond the end of the
  stream during labeled unicast parsing (CVE-2023-38407,bsc#1216899,https://github.com/FRRouting/frr/pull/12956/commits/ab362eae68edec12c175d9bc488bcc3f8b73d36f)
  [+ 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch]
- Apply upstream fix for an nlri length of zero mishandling, aka
  "flowspec overflow" (CVE-2023-38406,bsc#1216900,https://github.com/FRRouting/frr/pull/12884/commits/0b999c886e241c52bd1f7ef0066700e4b618ebb3)
  [+ 0018-bgpd-Flowspec-overflow-issue.patch]</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build with RPM 4.19: a stray %-escape sequence was found in
  the files section.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1707393600">- Provide user/group symbol for user created during pre.</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1712750400">- add
  0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch:
  * Apply upstream fix on error handling when receiving BGP Prefix
    SID attribute (bsc#1222518,CVE-2024-31948,gh#FRRouting/frr#15628)</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1713960000">- Apply upstream fix solving crash in OSPF TE parsing (bsc#1220548,
  CVE-2024-27913, gh#FRRouting/frr#15431)
  [+ 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1717502400">- Apply upstream fix solving ospfd denial of service via get_edge()
  function returning a NULL pointer (CVE-2024-34088,bsc#1223786,
  gh#FRRouting/frr#16088).
  [+ 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in ospf_te_parse_ext_link for OSPF LSA packets during an attempt
  to read Segment Routing Adjacency SID subTLVs (CVE-2024-31951,
  bsc#1222528,gh#FRRouting/frr#16088).
  [+ 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in RI parsing with OSPF TE (CVE-2024-31950,bsc#1222526,
  gh#FRRouting/frr#16088).
  [+ 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch]</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722168000">- Update to version 10.0.1 from official sources.
  See https://frrouting.org/release/10.0.1/
- Clean slate: removing all previous patches.
- The following patches were obsoleted:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  - 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch
  - 0004-tools-remove-backslash-from-declare-check-regex.patch
  - 0005-root-ok-in-account-frr.pam.patch
  - 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch
  - 0007-bgpd-Ensure-stream-received-has-enough-data.patch
  - 0008-bgpd-Don-t-read-the-first-byte-of-ORF-header-if-we-a.patch
  - 0009-bgpd-Do-not-process-NLRIs-if-the-attribute-length-is.patch
  - 0010-bgpd-Use-treat-as-withdraw-for-tunnel-encapsulation-.patch
  - 0011-babeld-fix-11808-to-avoid-infinite-loops.patch
  - 0012-bgpd-Limit-flowspec-to-no-attribute-means-a-implicit.patch
  - 0013-bgpd-Check-mandatory-attributes-more-carefully-for-U.patch
  - 0014-bgpd-Handle-MP_REACH_NLRI-malformed-packets-with-ses.patch
  - 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch
  - 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch
  - 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch
  - 0018-bgpd-Flowspec-overflow-issue.patch
  - 0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch
  - 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch
  - 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch
  - 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch
  - 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1723204800">- Fixing Source URL/archive name.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1724328000">- Apply upstream fix for crash in bgp_attr_encap that were missing
  a check of the actual remaining stream length before taking the
  TLV value (CVE-2024-44070,bsc#1229438,gh#FRRouting/frr#16502):
  + 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch
- Re-added 0001-disable-zmq-test.patch to avoid (sporadic or arch
  specific, e.g. aarch64) "make check" test failures (bsc#1180217).
  + 0001-disable-zmq-test.patch
- Re-added hardening patch for systemd service(s) (bsc#1181400):
  + harden_frr.service.patch
- Cleanup unknown --enable-systemd and correct the --sysconfdir
  and --localstatedir configure options to not end in …/frr.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488000">- fixed bug/pull request references in frr.changes file</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488001">- add release notes url to 10.0.1 update</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1727697600">- Update to frr 10.0.2 release providing fix for CVE-2024-44070
  and other issues, see https://frrouting.org/release/10.0.2/
- Removed patch included in the sources:
  [- 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1736424000">- Update to frr 10.2.1 release providing fix for a Denial of Service
  scenario due to RIB revalidation (CVE-2024-55553,bsc#1235237) and
  other fixes, see https://frrouting.org/release/10.2.1/
  The 10.2 version provides new features and many enhancements, see
  https://frrouting.org/release/10.2/
- Add new fpm_listener daemon binary to rpm file lists.
- Remove --localstatedir configure parameter causing to use /run/lib
  instead of /var/lib prefix for the northbound databases and added
  the /var/lib/frr directory to the rpm file list.
- Adjust to set permissions in rpm attr macros (rpmlint suggestion)
  and use frr_group instead of frr_user in group parameter.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742558400">- build with pcre2</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1759233600">- Drop rcfrr service symlink (jsc#PED-266)
- Change to sysuser-tools and macros to create user+groups
- rpmlint: add su option to logrotate file definitions
- rpmlint: use python3_fix_shebang_path to adjust interpreter</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1759492800">- Adding updated copyright notice
- 0002-frr-logrotate.patch: rotating logfiles under the frr user</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770897600">- Apply upstream ospfd NULL Pointer Dereference fixes.
  The vulnerability allowed attackers to cause a Denial of Service
  (DoS) via crafted OSPF packets
  (bsc#1252838,bsc#1252829,bsc#1252833,bsc#1252835,bsc#1252810,
  bsc#1252811,bsc#1252761,bsc#1252812,bsc#1252813,CVE-2025-61099,
  CVE-2025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,
  CVE-2025-61104,CVE-2025-61105,CVE-2025-61106,CVE-2025-61107,
  https://github.com/FRRouting/frr/pull/19983)
  [+ 0003-ospfd-NULL-Pointer-Dereference-fixes.patch]
- Add -Wno-error=declaration-after-statement to avoid C90 errors;
  frr requires C11 compiler with atomic support and sets -std=gnu11</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770984000">- Switch to logrotate config correcting log file empty issue
  (gh#FRRouting/frr/issues/15818) depending if syslog or file
  logging is used in the frr.conf.
- Fix /var/run leftovers in logrotate config and service file,
  create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).
- Adjust rpm requires for service macros and log rotation (lsof).</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771070400">- Bumping version to 10.5.1.
- new module: PIM MLAG Active-Active support (mlab_pb0)
- removed module: zebra_irdp (replaced by dpdk)
- bgpd
  - Allow proper shutdown of bgp dynamic peers in rare case
  - Check length for dynamic capability (software version new encoding)
  - Correction in json output structure for no data case
  - Fix labeled unicast inbound policy lookup
  - Fix labeled-unicast output
  - Fix maximum-prefix session recovery for peers and peer-groups
  - Fix memory leak in bgp nhc tlv processing
  - Fix route node lock leak in nht resolved prefix marking
  - Fix srv6-only command defaulted when 'no segment-routing ipv6'
  - Send route-refresh and/or trigger soft reconfig on enforce-first-as
  - Try to handle software version capability with the new encoding format
- isisd
  - Use ipv6 mtid for srv6 locator tlvs when ipv6 mt is enabled
- pimd
  - Add pim_debug_pim_reg protection for pim register stop debug message
  - Crash while trying mroute_read when fd=-1
  - Df election on zebra peer down synced to the mlag peer
  - Fix for mc frame loss in a sequential traffic test
  - Fix pim mlag update peer zebra status upon local mlag connection restoration
  - Fix warnings for pimd
  - Crash when pimreg interface not present
  - Crashed because of indexing invalid index in an array
  - Prevent crash on interface removal
- vrrpd
  - vrrp interface delete fails to free connected route
- zebrad
  - Fix crash due to lack of control of received number of srv6 sid from netlink</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1772712000">- Add a factorydir build conditional to install the /etc/frr files in
  the /usr/share/factory and copy/link this initial/default config via
  tmpfiles.conf, enabled for suse versions &gt; 16.0 (jsc#PED-14796).
- Create the tmpfiles.conf in the spec file instead to sed rpm source.
- Move creation of config files from rpm install to the build section.
- Improve to use 0751 permissions for the /etc/frr directory to avoid
  permission denied warning for vtysh.conf in vtysh started as user.
- Change to frr.conf to use log syslog (journal) by default
- Do not install obsolete/unused system-v script and manual page
- Fix (include) file listed twice rpm warning in frr-devel package.</changelog>
</package>
<package pkgid="b412a604e688cb472b8f10a8837d594f7ce0a0f8e160e7e1674491f6009adb8363c835e7c190ff2471f4ffa2aea2720d14ca1c148b4887d4fe6ad476c59e5a4f" name="libfrrsnmp0" arch="x86_64">
  <version epoch="0" ver="10.6.0" rel="4.23"/>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1701691200">- Apply upstream fix for a crash on malformed BGP UPDATE message
  with an EOR, because the presence of EOR does not lead to a
  treat-as-withdraw outcome (CVE-2023-47235,bsc#1216896,https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
  [+ 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch]
- Apply upstream fix for a crash on crafted BGP UPDATE message with
  a MP_UNREACH_NLRI attribute and additional NLRI data (CVE-2023-47234,
  bsc#1216897,https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf)
  [+ 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch]
- Apply upstream fix for attempts to read beyond the end of the
  stream during labeled unicast parsing (CVE-2023-38407,bsc#1216899,https://github.com/FRRouting/frr/pull/12956/commits/ab362eae68edec12c175d9bc488bcc3f8b73d36f)
  [+ 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch]
- Apply upstream fix for an nlri length of zero mishandling, aka
  "flowspec overflow" (CVE-2023-38406,bsc#1216900,https://github.com/FRRouting/frr/pull/12884/commits/0b999c886e241c52bd1f7ef0066700e4b618ebb3)
  [+ 0018-bgpd-Flowspec-overflow-issue.patch]</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build with RPM 4.19: a stray %-escape sequence was found in
  the files section.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1707393600">- Provide user/group symbol for user created during pre.</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1712750400">- add
  0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch:
  * Apply upstream fix on error handling when receiving BGP Prefix
    SID attribute (bsc#1222518,CVE-2024-31948,gh#FRRouting/frr#15628)</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1713960000">- Apply upstream fix solving crash in OSPF TE parsing (bsc#1220548,
  CVE-2024-27913, gh#FRRouting/frr#15431)
  [+ 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1717502400">- Apply upstream fix solving ospfd denial of service via get_edge()
  function returning a NULL pointer (CVE-2024-34088,bsc#1223786,
  gh#FRRouting/frr#16088).
  [+ 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in ospf_te_parse_ext_link for OSPF LSA packets during an attempt
  to read Segment Routing Adjacency SID subTLVs (CVE-2024-31951,
  bsc#1222528,gh#FRRouting/frr#16088).
  [+ 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in RI parsing with OSPF TE (CVE-2024-31950,bsc#1222526,
  gh#FRRouting/frr#16088).
  [+ 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch]</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722168000">- Update to version 10.0.1 from official sources.
  See https://frrouting.org/release/10.0.1/
- Clean slate: removing all previous patches.
- The following patches were obsoleted:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  - 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch
  - 0004-tools-remove-backslash-from-declare-check-regex.patch
  - 0005-root-ok-in-account-frr.pam.patch
  - 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch
  - 0007-bgpd-Ensure-stream-received-has-enough-data.patch
  - 0008-bgpd-Don-t-read-the-first-byte-of-ORF-header-if-we-a.patch
  - 0009-bgpd-Do-not-process-NLRIs-if-the-attribute-length-is.patch
  - 0010-bgpd-Use-treat-as-withdraw-for-tunnel-encapsulation-.patch
  - 0011-babeld-fix-11808-to-avoid-infinite-loops.patch
  - 0012-bgpd-Limit-flowspec-to-no-attribute-means-a-implicit.patch
  - 0013-bgpd-Check-mandatory-attributes-more-carefully-for-U.patch
  - 0014-bgpd-Handle-MP_REACH_NLRI-malformed-packets-with-ses.patch
  - 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch
  - 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch
  - 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch
  - 0018-bgpd-Flowspec-overflow-issue.patch
  - 0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch
  - 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch
  - 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch
  - 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch
  - 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1723204800">- Fixing Source URL/archive name.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1724328000">- Apply upstream fix for crash in bgp_attr_encap that were missing
  a check of the actual remaining stream length before taking the
  TLV value (CVE-2024-44070,bsc#1229438,gh#FRRouting/frr#16502):
  + 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch
- Re-added 0001-disable-zmq-test.patch to avoid (sporadic or arch
  specific, e.g. aarch64) "make check" test failures (bsc#1180217).
  + 0001-disable-zmq-test.patch
- Re-added hardening patch for systemd service(s) (bsc#1181400):
  + harden_frr.service.patch
- Cleanup unknown --enable-systemd and correct the --sysconfdir
  and --localstatedir configure options to not end in …/frr.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488000">- fixed bug/pull request references in frr.changes file</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488001">- add release notes url to 10.0.1 update</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1727697600">- Update to frr 10.0.2 release providing fix for CVE-2024-44070
  and other issues, see https://frrouting.org/release/10.0.2/
- Removed patch included in the sources:
  [- 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1736424000">- Update to frr 10.2.1 release providing fix for a Denial of Service
  scenario due to RIB revalidation (CVE-2024-55553,bsc#1235237) and
  other fixes, see https://frrouting.org/release/10.2.1/
  The 10.2 version provides new features and many enhancements, see
  https://frrouting.org/release/10.2/
- Add new fpm_listener daemon binary to rpm file lists.
- Remove --localstatedir configure parameter causing to use /run/lib
  instead of /var/lib prefix for the northbound databases and added
  the /var/lib/frr directory to the rpm file list.
- Adjust to set permissions in rpm attr macros (rpmlint suggestion)
  and use frr_group instead of frr_user in group parameter.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742558400">- build with pcre2</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1759233600">- Drop rcfrr service symlink (jsc#PED-266)
- Change to sysuser-tools and macros to create user+groups
- rpmlint: add su option to logrotate file definitions
- rpmlint: use python3_fix_shebang_path to adjust interpreter</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1759492800">- Adding updated copyright notice
- 0002-frr-logrotate.patch: rotating logfiles under the frr user</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770897600">- Apply upstream ospfd NULL Pointer Dereference fixes.
  The vulnerability allowed attackers to cause a Denial of Service
  (DoS) via crafted OSPF packets
  (bsc#1252838,bsc#1252829,bsc#1252833,bsc#1252835,bsc#1252810,
  bsc#1252811,bsc#1252761,bsc#1252812,bsc#1252813,CVE-2025-61099,
  CVE-2025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,
  CVE-2025-61104,CVE-2025-61105,CVE-2025-61106,CVE-2025-61107,
  https://github.com/FRRouting/frr/pull/19983)
  [+ 0003-ospfd-NULL-Pointer-Dereference-fixes.patch]
- Add -Wno-error=declaration-after-statement to avoid C90 errors;
  frr requires C11 compiler with atomic support and sets -std=gnu11</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770984000">- Switch to logrotate config correcting log file empty issue
  (gh#FRRouting/frr/issues/15818) depending if syslog or file
  logging is used in the frr.conf.
- Fix /var/run leftovers in logrotate config and service file,
  create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).
- Adjust rpm requires for service macros and log rotation (lsof).</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771070400">- Bumping version to 10.5.1.
- new module: PIM MLAG Active-Active support (mlab_pb0)
- removed module: zebra_irdp (replaced by dpdk)
- bgpd
  - Allow proper shutdown of bgp dynamic peers in rare case
  - Check length for dynamic capability (software version new encoding)
  - Correction in json output structure for no data case
  - Fix labeled unicast inbound policy lookup
  - Fix labeled-unicast output
  - Fix maximum-prefix session recovery for peers and peer-groups
  - Fix memory leak in bgp nhc tlv processing
  - Fix route node lock leak in nht resolved prefix marking
  - Fix srv6-only command defaulted when 'no segment-routing ipv6'
  - Send route-refresh and/or trigger soft reconfig on enforce-first-as
  - Try to handle software version capability with the new encoding format
- isisd
  - Use ipv6 mtid for srv6 locator tlvs when ipv6 mt is enabled
- pimd
  - Add pim_debug_pim_reg protection for pim register stop debug message
  - Crash while trying mroute_read when fd=-1
  - Df election on zebra peer down synced to the mlag peer
  - Fix for mc frame loss in a sequential traffic test
  - Fix pim mlag update peer zebra status upon local mlag connection restoration
  - Fix warnings for pimd
  - Crash when pimreg interface not present
  - Crashed because of indexing invalid index in an array
  - Prevent crash on interface removal
- vrrpd
  - vrrp interface delete fails to free connected route
- zebrad
  - Fix crash due to lack of control of received number of srv6 sid from netlink</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1772712000">- Add a factorydir build conditional to install the /etc/frr files in
  the /usr/share/factory and copy/link this initial/default config via
  tmpfiles.conf, enabled for suse versions &gt; 16.0 (jsc#PED-14796).
- Create the tmpfiles.conf in the spec file instead to sed rpm source.
- Move creation of config files from rpm install to the build section.
- Improve to use 0751 permissions for the /etc/frr directory to avoid
  permission denied warning for vtysh.conf in vtysh started as user.
- Change to frr.conf to use log syslog (journal) by default
- Do not install obsolete/unused system-v script and manual page
- Fix (include) file listed twice rpm warning in frr-devel package.</changelog>
</package>
<package pkgid="b4b3a300dd366c873c2c099c80a113974d7ed90b0cbd4db01232aee2a5c23926cbf55e79bdb001db2c34d05859be5b39aae0af56969844860c96f13e085515f9" name="libfrrzmq0" arch="x86_64">
  <version epoch="0" ver="10.6.0" rel="4.23"/>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1701691200">- Apply upstream fix for a crash on malformed BGP UPDATE message
  with an EOR, because the presence of EOR does not lead to a
  treat-as-withdraw outcome (CVE-2023-47235,bsc#1216896,https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
  [+ 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch]
- Apply upstream fix for a crash on crafted BGP UPDATE message with
  a MP_UNREACH_NLRI attribute and additional NLRI data (CVE-2023-47234,
  bsc#1216897,https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf)
  [+ 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch]
- Apply upstream fix for attempts to read beyond the end of the
  stream during labeled unicast parsing (CVE-2023-38407,bsc#1216899,https://github.com/FRRouting/frr/pull/12956/commits/ab362eae68edec12c175d9bc488bcc3f8b73d36f)
  [+ 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch]
- Apply upstream fix for an nlri length of zero mishandling, aka
  "flowspec overflow" (CVE-2023-38406,bsc#1216900,https://github.com/FRRouting/frr/pull/12884/commits/0b999c886e241c52bd1f7ef0066700e4b618ebb3)
  [+ 0018-bgpd-Flowspec-overflow-issue.patch]</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build with RPM 4.19: a stray %-escape sequence was found in
  the files section.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1707393600">- Provide user/group symbol for user created during pre.</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1712750400">- add
  0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch:
  * Apply upstream fix on error handling when receiving BGP Prefix
    SID attribute (bsc#1222518,CVE-2024-31948,gh#FRRouting/frr#15628)</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1713960000">- Apply upstream fix solving crash in OSPF TE parsing (bsc#1220548,
  CVE-2024-27913, gh#FRRouting/frr#15431)
  [+ 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1717502400">- Apply upstream fix solving ospfd denial of service via get_edge()
  function returning a NULL pointer (CVE-2024-34088,bsc#1223786,
  gh#FRRouting/frr#16088).
  [+ 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in ospf_te_parse_ext_link for OSPF LSA packets during an attempt
  to read Segment Routing Adjacency SID subTLVs (CVE-2024-31951,
  bsc#1222528,gh#FRRouting/frr#16088).
  [+ 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in RI parsing with OSPF TE (CVE-2024-31950,bsc#1222526,
  gh#FRRouting/frr#16088).
  [+ 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch]</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722168000">- Update to version 10.0.1 from official sources.
  See https://frrouting.org/release/10.0.1/
- Clean slate: removing all previous patches.
- The following patches were obsoleted:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  - 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch
  - 0004-tools-remove-backslash-from-declare-check-regex.patch
  - 0005-root-ok-in-account-frr.pam.patch
  - 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch
  - 0007-bgpd-Ensure-stream-received-has-enough-data.patch
  - 0008-bgpd-Don-t-read-the-first-byte-of-ORF-header-if-we-a.patch
  - 0009-bgpd-Do-not-process-NLRIs-if-the-attribute-length-is.patch
  - 0010-bgpd-Use-treat-as-withdraw-for-tunnel-encapsulation-.patch
  - 0011-babeld-fix-11808-to-avoid-infinite-loops.patch
  - 0012-bgpd-Limit-flowspec-to-no-attribute-means-a-implicit.patch
  - 0013-bgpd-Check-mandatory-attributes-more-carefully-for-U.patch
  - 0014-bgpd-Handle-MP_REACH_NLRI-malformed-packets-with-ses.patch
  - 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch
  - 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch
  - 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch
  - 0018-bgpd-Flowspec-overflow-issue.patch
  - 0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch
  - 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch
  - 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch
  - 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch
  - 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1723204800">- Fixing Source URL/archive name.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1724328000">- Apply upstream fix for crash in bgp_attr_encap that were missing
  a check of the actual remaining stream length before taking the
  TLV value (CVE-2024-44070,bsc#1229438,gh#FRRouting/frr#16502):
  + 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch
- Re-added 0001-disable-zmq-test.patch to avoid (sporadic or arch
  specific, e.g. aarch64) "make check" test failures (bsc#1180217).
  + 0001-disable-zmq-test.patch
- Re-added hardening patch for systemd service(s) (bsc#1181400):
  + harden_frr.service.patch
- Cleanup unknown --enable-systemd and correct the --sysconfdir
  and --localstatedir configure options to not end in …/frr.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488000">- fixed bug/pull request references in frr.changes file</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488001">- add release notes url to 10.0.1 update</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1727697600">- Update to frr 10.0.2 release providing fix for CVE-2024-44070
  and other issues, see https://frrouting.org/release/10.0.2/
- Removed patch included in the sources:
  [- 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1736424000">- Update to frr 10.2.1 release providing fix for a Denial of Service
  scenario due to RIB revalidation (CVE-2024-55553,bsc#1235237) and
  other fixes, see https://frrouting.org/release/10.2.1/
  The 10.2 version provides new features and many enhancements, see
  https://frrouting.org/release/10.2/
- Add new fpm_listener daemon binary to rpm file lists.
- Remove --localstatedir configure parameter causing to use /run/lib
  instead of /var/lib prefix for the northbound databases and added
  the /var/lib/frr directory to the rpm file list.
- Adjust to set permissions in rpm attr macros (rpmlint suggestion)
  and use frr_group instead of frr_user in group parameter.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742558400">- build with pcre2</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1759233600">- Drop rcfrr service symlink (jsc#PED-266)
- Change to sysuser-tools and macros to create user+groups
- rpmlint: add su option to logrotate file definitions
- rpmlint: use python3_fix_shebang_path to adjust interpreter</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1759492800">- Adding updated copyright notice
- 0002-frr-logrotate.patch: rotating logfiles under the frr user</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770897600">- Apply upstream ospfd NULL Pointer Dereference fixes.
  The vulnerability allowed attackers to cause a Denial of Service
  (DoS) via crafted OSPF packets
  (bsc#1252838,bsc#1252829,bsc#1252833,bsc#1252835,bsc#1252810,
  bsc#1252811,bsc#1252761,bsc#1252812,bsc#1252813,CVE-2025-61099,
  CVE-2025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,
  CVE-2025-61104,CVE-2025-61105,CVE-2025-61106,CVE-2025-61107,
  https://github.com/FRRouting/frr/pull/19983)
  [+ 0003-ospfd-NULL-Pointer-Dereference-fixes.patch]
- Add -Wno-error=declaration-after-statement to avoid C90 errors;
  frr requires C11 compiler with atomic support and sets -std=gnu11</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770984000">- Switch to logrotate config correcting log file empty issue
  (gh#FRRouting/frr/issues/15818) depending if syslog or file
  logging is used in the frr.conf.
- Fix /var/run leftovers in logrotate config and service file,
  create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).
- Adjust rpm requires for service macros and log rotation (lsof).</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771070400">- Bumping version to 10.5.1.
- new module: PIM MLAG Active-Active support (mlab_pb0)
- removed module: zebra_irdp (replaced by dpdk)
- bgpd
  - Allow proper shutdown of bgp dynamic peers in rare case
  - Check length for dynamic capability (software version new encoding)
  - Correction in json output structure for no data case
  - Fix labeled unicast inbound policy lookup
  - Fix labeled-unicast output
  - Fix maximum-prefix session recovery for peers and peer-groups
  - Fix memory leak in bgp nhc tlv processing
  - Fix route node lock leak in nht resolved prefix marking
  - Fix srv6-only command defaulted when 'no segment-routing ipv6'
  - Send route-refresh and/or trigger soft reconfig on enforce-first-as
  - Try to handle software version capability with the new encoding format
- isisd
  - Use ipv6 mtid for srv6 locator tlvs when ipv6 mt is enabled
- pimd
  - Add pim_debug_pim_reg protection for pim register stop debug message
  - Crash while trying mroute_read when fd=-1
  - Df election on zebra peer down synced to the mlag peer
  - Fix for mc frame loss in a sequential traffic test
  - Fix pim mlag update peer zebra status upon local mlag connection restoration
  - Fix warnings for pimd
  - Crash when pimreg interface not present
  - Crashed because of indexing invalid index in an array
  - Prevent crash on interface removal
- vrrpd
  - vrrp interface delete fails to free connected route
- zebrad
  - Fix crash due to lack of control of received number of srv6 sid from netlink</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1772712000">- Add a factorydir build conditional to install the /etc/frr files in
  the /usr/share/factory and copy/link this initial/default config via
  tmpfiles.conf, enabled for suse versions &gt; 16.0 (jsc#PED-14796).
- Create the tmpfiles.conf in the spec file instead to sed rpm source.
- Move creation of config files from rpm install to the build section.
- Improve to use 0751 permissions for the /etc/frr directory to avoid
  permission denied warning for vtysh.conf in vtysh started as user.
- Change to frr.conf to use log syslog (journal) by default
- Do not install obsolete/unused system-v script and manual page
- Fix (include) file listed twice rpm warning in frr-devel package.</changelog>
</package>
<package pkgid="d3c97076172980452d9c75802895e4ec563e326e4e768d96912eff1745a28a0a27150296b1aa174e9c9367753b581d5118f857f3d378f50586c2ef16e7d369ee" name="libldb-devel" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="9bfb5d8a5378816ab9b618df480891b8bd88a7bb92bfa9f97adeaa509f27359a73d5ded375c7d485a25670fc7d02ba53cf06c99fd08e91c8421e30b8588e1c67" name="libldb2" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="034c0ca2a40b8f48d9ea1c64c5313104a34c49cf0c59eb1eddc6b1975a620eefe8d9c2de2e9b542ecf871f975a5c9af6957fb07e768320501a71c72a3c5a84b1" name="libmgmt_be_nb0" arch="x86_64">
  <version epoch="0" ver="10.6.0" rel="4.23"/>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1701691200">- Apply upstream fix for a crash on malformed BGP UPDATE message
  with an EOR, because the presence of EOR does not lead to a
  treat-as-withdraw outcome (CVE-2023-47235,bsc#1216896,https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
  [+ 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch]
- Apply upstream fix for a crash on crafted BGP UPDATE message with
  a MP_UNREACH_NLRI attribute and additional NLRI data (CVE-2023-47234,
  bsc#1216897,https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf)
  [+ 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch]
- Apply upstream fix for attempts to read beyond the end of the
  stream during labeled unicast parsing (CVE-2023-38407,bsc#1216899,https://github.com/FRRouting/frr/pull/12956/commits/ab362eae68edec12c175d9bc488bcc3f8b73d36f)
  [+ 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch]
- Apply upstream fix for an nlri length of zero mishandling, aka
  "flowspec overflow" (CVE-2023-38406,bsc#1216900,https://github.com/FRRouting/frr/pull/12884/commits/0b999c886e241c52bd1f7ef0066700e4b618ebb3)
  [+ 0018-bgpd-Flowspec-overflow-issue.patch]</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build with RPM 4.19: a stray %-escape sequence was found in
  the files section.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1707393600">- Provide user/group symbol for user created during pre.</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1712750400">- add
  0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch:
  * Apply upstream fix on error handling when receiving BGP Prefix
    SID attribute (bsc#1222518,CVE-2024-31948,gh#FRRouting/frr#15628)</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1713960000">- Apply upstream fix solving crash in OSPF TE parsing (bsc#1220548,
  CVE-2024-27913, gh#FRRouting/frr#15431)
  [+ 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1717502400">- Apply upstream fix solving ospfd denial of service via get_edge()
  function returning a NULL pointer (CVE-2024-34088,bsc#1223786,
  gh#FRRouting/frr#16088).
  [+ 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in ospf_te_parse_ext_link for OSPF LSA packets during an attempt
  to read Segment Routing Adjacency SID subTLVs (CVE-2024-31951,
  bsc#1222528,gh#FRRouting/frr#16088).
  [+ 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in RI parsing with OSPF TE (CVE-2024-31950,bsc#1222526,
  gh#FRRouting/frr#16088).
  [+ 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch]</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722168000">- Update to version 10.0.1 from official sources.
  See https://frrouting.org/release/10.0.1/
- Clean slate: removing all previous patches.
- The following patches were obsoleted:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  - 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch
  - 0004-tools-remove-backslash-from-declare-check-regex.patch
  - 0005-root-ok-in-account-frr.pam.patch
  - 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch
  - 0007-bgpd-Ensure-stream-received-has-enough-data.patch
  - 0008-bgpd-Don-t-read-the-first-byte-of-ORF-header-if-we-a.patch
  - 0009-bgpd-Do-not-process-NLRIs-if-the-attribute-length-is.patch
  - 0010-bgpd-Use-treat-as-withdraw-for-tunnel-encapsulation-.patch
  - 0011-babeld-fix-11808-to-avoid-infinite-loops.patch
  - 0012-bgpd-Limit-flowspec-to-no-attribute-means-a-implicit.patch
  - 0013-bgpd-Check-mandatory-attributes-more-carefully-for-U.patch
  - 0014-bgpd-Handle-MP_REACH_NLRI-malformed-packets-with-ses.patch
  - 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch
  - 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch
  - 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch
  - 0018-bgpd-Flowspec-overflow-issue.patch
  - 0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch
  - 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch
  - 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch
  - 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch
  - 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1723204800">- Fixing Source URL/archive name.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1724328000">- Apply upstream fix for crash in bgp_attr_encap that were missing
  a check of the actual remaining stream length before taking the
  TLV value (CVE-2024-44070,bsc#1229438,gh#FRRouting/frr#16502):
  + 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch
- Re-added 0001-disable-zmq-test.patch to avoid (sporadic or arch
  specific, e.g. aarch64) "make check" test failures (bsc#1180217).
  + 0001-disable-zmq-test.patch
- Re-added hardening patch for systemd service(s) (bsc#1181400):
  + harden_frr.service.patch
- Cleanup unknown --enable-systemd and correct the --sysconfdir
  and --localstatedir configure options to not end in …/frr.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488000">- fixed bug/pull request references in frr.changes file</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488001">- add release notes url to 10.0.1 update</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1727697600">- Update to frr 10.0.2 release providing fix for CVE-2024-44070
  and other issues, see https://frrouting.org/release/10.0.2/
- Removed patch included in the sources:
  [- 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1736424000">- Update to frr 10.2.1 release providing fix for a Denial of Service
  scenario due to RIB revalidation (CVE-2024-55553,bsc#1235237) and
  other fixes, see https://frrouting.org/release/10.2.1/
  The 10.2 version provides new features and many enhancements, see
  https://frrouting.org/release/10.2/
- Add new fpm_listener daemon binary to rpm file lists.
- Remove --localstatedir configure parameter causing to use /run/lib
  instead of /var/lib prefix for the northbound databases and added
  the /var/lib/frr directory to the rpm file list.
- Adjust to set permissions in rpm attr macros (rpmlint suggestion)
  and use frr_group instead of frr_user in group parameter.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742558400">- build with pcre2</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1759233600">- Drop rcfrr service symlink (jsc#PED-266)
- Change to sysuser-tools and macros to create user+groups
- rpmlint: add su option to logrotate file definitions
- rpmlint: use python3_fix_shebang_path to adjust interpreter</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1759492800">- Adding updated copyright notice
- 0002-frr-logrotate.patch: rotating logfiles under the frr user</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770897600">- Apply upstream ospfd NULL Pointer Dereference fixes.
  The vulnerability allowed attackers to cause a Denial of Service
  (DoS) via crafted OSPF packets
  (bsc#1252838,bsc#1252829,bsc#1252833,bsc#1252835,bsc#1252810,
  bsc#1252811,bsc#1252761,bsc#1252812,bsc#1252813,CVE-2025-61099,
  CVE-2025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,
  CVE-2025-61104,CVE-2025-61105,CVE-2025-61106,CVE-2025-61107,
  https://github.com/FRRouting/frr/pull/19983)
  [+ 0003-ospfd-NULL-Pointer-Dereference-fixes.patch]
- Add -Wno-error=declaration-after-statement to avoid C90 errors;
  frr requires C11 compiler with atomic support and sets -std=gnu11</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770984000">- Switch to logrotate config correcting log file empty issue
  (gh#FRRouting/frr/issues/15818) depending if syslog or file
  logging is used in the frr.conf.
- Fix /var/run leftovers in logrotate config and service file,
  create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).
- Adjust rpm requires for service macros and log rotation (lsof).</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771070400">- Bumping version to 10.5.1.
- new module: PIM MLAG Active-Active support (mlab_pb0)
- removed module: zebra_irdp (replaced by dpdk)
- bgpd
  - Allow proper shutdown of bgp dynamic peers in rare case
  - Check length for dynamic capability (software version new encoding)
  - Correction in json output structure for no data case
  - Fix labeled unicast inbound policy lookup
  - Fix labeled-unicast output
  - Fix maximum-prefix session recovery for peers and peer-groups
  - Fix memory leak in bgp nhc tlv processing
  - Fix route node lock leak in nht resolved prefix marking
  - Fix srv6-only command defaulted when 'no segment-routing ipv6'
  - Send route-refresh and/or trigger soft reconfig on enforce-first-as
  - Try to handle software version capability with the new encoding format
- isisd
  - Use ipv6 mtid for srv6 locator tlvs when ipv6 mt is enabled
- pimd
  - Add pim_debug_pim_reg protection for pim register stop debug message
  - Crash while trying mroute_read when fd=-1
  - Df election on zebra peer down synced to the mlag peer
  - Fix for mc frame loss in a sequential traffic test
  - Fix pim mlag update peer zebra status upon local mlag connection restoration
  - Fix warnings for pimd
  - Crash when pimreg interface not present
  - Crashed because of indexing invalid index in an array
  - Prevent crash on interface removal
- vrrpd
  - vrrp interface delete fails to free connected route
- zebrad
  - Fix crash due to lack of control of received number of srv6 sid from netlink</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1772712000">- Add a factorydir build conditional to install the /etc/frr files in
  the /usr/share/factory and copy/link this initial/default config via
  tmpfiles.conf, enabled for suse versions &gt; 16.0 (jsc#PED-14796).
- Create the tmpfiles.conf in the spec file instead to sed rpm source.
- Move creation of config files from rpm install to the build section.
- Improve to use 0751 permissions for the /etc/frr directory to avoid
  permission denied warning for vtysh.conf in vtysh started as user.
- Change to frr.conf to use log syslog (journal) by default
- Do not install obsolete/unused system-v script and manual page
- Fix (include) file listed twice rpm warning in frr-devel package.</changelog>
</package>
<package pkgid="54bfb6d50c8cdca8de159225a601b92e0d6c5b85d26b2340b18222bafb3e6bb39260c94874643212634aa435fa47ec35148a1a15b6845755f9ffab5b5aebc9fc" name="libmlag_pb0" arch="x86_64">
  <version epoch="0" ver="10.6.0" rel="4.23"/>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1701691200">- Apply upstream fix for a crash on malformed BGP UPDATE message
  with an EOR, because the presence of EOR does not lead to a
  treat-as-withdraw outcome (CVE-2023-47235,bsc#1216896,https://github.com/FRRouting/frr/pull/14716/commits/6814f2e0138a6ea5e1f83bdd9085d9a77999900b)
  [+ 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch]
- Apply upstream fix for a crash on crafted BGP UPDATE message with
  a MP_UNREACH_NLRI attribute and additional NLRI data (CVE-2023-47234,
  bsc#1216897,https://github.com/FRRouting/frr/pull/14716/commits/c37119df45bbf4ef713bc10475af2ee06e12f3bf)
  [+ 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch]
- Apply upstream fix for attempts to read beyond the end of the
  stream during labeled unicast parsing (CVE-2023-38407,bsc#1216899,https://github.com/FRRouting/frr/pull/12956/commits/ab362eae68edec12c175d9bc488bcc3f8b73d36f)
  [+ 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch]
- Apply upstream fix for an nlri length of zero mishandling, aka
  "flowspec overflow" (CVE-2023-38406,bsc#1216900,https://github.com/FRRouting/frr/pull/12884/commits/0b999c886e241c52bd1f7ef0066700e4b618ebb3)
  [+ 0018-bgpd-Flowspec-overflow-issue.patch]</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build with RPM 4.19: a stray %-escape sequence was found in
  the files section.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1707393600">- Provide user/group symbol for user created during pre.</changelog>
  <changelog author="Clemens Famulla-Conrad &lt;cfamullaconrad@suse.com&gt;" date="1712750400">- add
  0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch:
  * Apply upstream fix on error handling when receiving BGP Prefix
    SID attribute (bsc#1222518,CVE-2024-31948,gh#FRRouting/frr#15628)</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1713960000">- Apply upstream fix solving crash in OSPF TE parsing (bsc#1220548,
  CVE-2024-27913, gh#FRRouting/frr#15431)
  [+ 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1717502400">- Apply upstream fix solving ospfd denial of service via get_edge()
  function returning a NULL pointer (CVE-2024-34088,bsc#1223786,
  gh#FRRouting/frr#16088).
  [+ 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in ospf_te_parse_ext_link for OSPF LSA packets during an attempt
  to read Segment Routing Adjacency SID subTLVs (CVE-2024-31951,
  bsc#1222528,gh#FRRouting/frr#16088).
  [+ 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch]
- Apply upstream fix solving ospfd buffer overflow and daemon crash
  in RI parsing with OSPF TE (CVE-2024-31950,bsc#1222526,
  gh#FRRouting/frr#16088).
  [+ 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch]</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722168000">- Update to version 10.0.1 from official sources.
  See https://frrouting.org/release/10.0.1/
- Clean slate: removing all previous patches.
- The following patches were obsoleted:
  - 0001-disable-zmq-test.patch
  - harden_frr.service.patch
  - 0003-tools-Run-as-FRR_USER-install-chown-commands-to-avoi.patch
  - 0004-tools-remove-backslash-from-declare-check-regex.patch
  - 0005-root-ok-in-account-frr.pam.patch
  - 0006-bgpd-Check-7-bytes-for-Long-lived-Graceful-Restart-c.patch
  - 0007-bgpd-Ensure-stream-received-has-enough-data.patch
  - 0008-bgpd-Don-t-read-the-first-byte-of-ORF-header-if-we-a.patch
  - 0009-bgpd-Do-not-process-NLRIs-if-the-attribute-length-is.patch
  - 0010-bgpd-Use-treat-as-withdraw-for-tunnel-encapsulation-.patch
  - 0011-babeld-fix-11808-to-avoid-infinite-loops.patch
  - 0012-bgpd-Limit-flowspec-to-no-attribute-means-a-implicit.patch
  - 0013-bgpd-Check-mandatory-attributes-more-carefully-for-U.patch
  - 0014-bgpd-Handle-MP_REACH_NLRI-malformed-packets-with-ses.patch
  - 0015-bgpd-Treat-EOR-as-withdrawn-to-avoid-unwanted-handli.patch
  - 0016-bgpd-Ignore-handling-NLRIs-if-we-received-MP_UNREACH.patch
  - 0017-bgpd-Fix-use-beyond-end-of-stream-of-labeled-unicast.patch
  - 0018-bgpd-Flowspec-overflow-issue.patch
  - 0019-bgpd-fix-error-handling-when-receiving-BGP-Prefix-SID-attribute.patch
  - 0020-ospfd-Solved-crash-in-OSPF-TE-parsing.patch
  - 0021-ospfd-Solved-crash-in-RI-parsing-with-OSPF-TE.patch
  - 0022-ospfd-Correct-Opaque-LSA-Extended-parser.patch
  - 0023-ospfd-protect-call-to-get_edge-in-ospf_te.c.patch</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1723204800">- Fixing Source URL/archive name.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1724328000">- Apply upstream fix for crash in bgp_attr_encap that were missing
  a check of the actual remaining stream length before taking the
  TLV value (CVE-2024-44070,bsc#1229438,gh#FRRouting/frr#16502):
  + 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch
- Re-added 0001-disable-zmq-test.patch to avoid (sporadic or arch
  specific, e.g. aarch64) "make check" test failures (bsc#1180217).
  + 0001-disable-zmq-test.patch
- Re-added hardening patch for systemd service(s) (bsc#1181400):
  + harden_frr.service.patch
- Cleanup unknown --enable-systemd and correct the --sysconfdir
  and --localstatedir configure options to not end in …/frr.</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488000">- fixed bug/pull request references in frr.changes file</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1726488001">- add release notes url to 10.0.1 update</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1727697600">- Update to frr 10.0.2 release providing fix for CVE-2024-44070
  and other issues, see https://frrouting.org/release/10.0.2/
- Removed patch included in the sources:
  [- 0002-bgpd-Check-the-actual-remaining-stream-length-before.patch]</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1736424000">- Update to frr 10.2.1 release providing fix for a Denial of Service
  scenario due to RIB revalidation (CVE-2024-55553,bsc#1235237) and
  other fixes, see https://frrouting.org/release/10.2.1/
  The 10.2 version provides new features and many enhancements, see
  https://frrouting.org/release/10.2/
- Add new fpm_listener daemon binary to rpm file lists.
- Remove --localstatedir configure parameter causing to use /run/lib
  instead of /var/lib prefix for the northbound databases and added
  the /var/lib/frr directory to the rpm file list.
- Adjust to set permissions in rpm attr macros (rpmlint suggestion)
  and use frr_group instead of frr_user in group parameter.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742558400">- build with pcre2</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1759233600">- Drop rcfrr service symlink (jsc#PED-266)
- Change to sysuser-tools and macros to create user+groups
- rpmlint: add su option to logrotate file definitions
- rpmlint: use python3_fix_shebang_path to adjust interpreter</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1759492800">- Adding updated copyright notice
- 0002-frr-logrotate.patch: rotating logfiles under the frr user</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770897600">- Apply upstream ospfd NULL Pointer Dereference fixes.
  The vulnerability allowed attackers to cause a Denial of Service
  (DoS) via crafted OSPF packets
  (bsc#1252838,bsc#1252829,bsc#1252833,bsc#1252835,bsc#1252810,
  bsc#1252811,bsc#1252761,bsc#1252812,bsc#1252813,CVE-2025-61099,
  CVE-2025-61100,CVE-2025-61101,CVE-2025-61102,CVE-2025-61103,
  CVE-2025-61104,CVE-2025-61105,CVE-2025-61106,CVE-2025-61107,
  https://github.com/FRRouting/frr/pull/19983)
  [+ 0003-ospfd-NULL-Pointer-Dereference-fixes.patch]
- Add -Wno-error=declaration-after-statement to avoid C90 errors;
  frr requires C11 compiler with atomic support and sets -std=gnu11</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1770984000">- Switch to logrotate config correcting log file empty issue
  (gh#FRRouting/frr/issues/15818) depending if syslog or file
  logging is used in the frr.conf.
- Fix /var/run leftovers in logrotate config and service file,
  create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).
- Adjust rpm requires for service macros and log rotation (lsof).</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771070400">- Bumping version to 10.5.1.
- new module: PIM MLAG Active-Active support (mlab_pb0)
- removed module: zebra_irdp (replaced by dpdk)
- bgpd
  - Allow proper shutdown of bgp dynamic peers in rare case
  - Check length for dynamic capability (software version new encoding)
  - Correction in json output structure for no data case
  - Fix labeled unicast inbound policy lookup
  - Fix labeled-unicast output
  - Fix maximum-prefix session recovery for peers and peer-groups
  - Fix memory leak in bgp nhc tlv processing
  - Fix route node lock leak in nht resolved prefix marking
  - Fix srv6-only command defaulted when 'no segment-routing ipv6'
  - Send route-refresh and/or trigger soft reconfig on enforce-first-as
  - Try to handle software version capability with the new encoding format
- isisd
  - Use ipv6 mtid for srv6 locator tlvs when ipv6 mt is enabled
- pimd
  - Add pim_debug_pim_reg protection for pim register stop debug message
  - Crash while trying mroute_read when fd=-1
  - Df election on zebra peer down synced to the mlag peer
  - Fix for mc frame loss in a sequential traffic test
  - Fix pim mlag update peer zebra status upon local mlag connection restoration
  - Fix warnings for pimd
  - Crash when pimreg interface not present
  - Crashed because of indexing invalid index in an array
  - Prevent crash on interface removal
- vrrpd
  - vrrp interface delete fails to free connected route
- zebrad
  - Fix crash due to lack of control of received number of srv6 sid from netlink</changelog>
  <changelog author="Marius Tomaschewski &lt;mt@suse.com&gt;" date="1772712000">- Add a factorydir build conditional to install the /etc/frr files in
  the /usr/share/factory and copy/link this initial/default config via
  tmpfiles.conf, enabled for suse versions &gt; 16.0 (jsc#PED-14796).
- Create the tmpfiles.conf in the spec file instead to sed rpm source.
- Move creation of config files from rpm install to the build section.
- Improve to use 0751 permissions for the /etc/frr directory to avoid
  permission denied warning for vtysh.conf in vtysh started as user.
- Change to frr.conf to use log syslog (journal) by default
- Do not install obsolete/unused system-v script and manual page
- Fix (include) file listed twice rpm warning in frr-devel package.</changelog>
</package>
<package pkgid="c818e2359168e2ef0c1e96b4c533878bdcadf2bec7a5e7ebca38af3cbadfc7c227e99de3303ef27cf6cf6fe5c05621162572463e102186eba748df3a79f791a0" name="libspectrum" arch="src">
  <version epoch="0" ver="1.4.4" rel="4.16"/>
  <changelog author="nmarques@opensuse.org" date="1317729600">- Update to version 1.0.0
- Several spec fixes</changelog>
  <changelog author="serbalgi@gmail.com" date="1379332800">- Update to version 1.1.1
  * Decreased libtool version to allow binaries built against
    libspectrum 1.0.0 to run with libspectrum 1.1.1.
  * Support for Spectranet in snapshots (Philip Kendall).
  * Support for Cheetah SpecDrum in snapshots (Fredrick Meunier).
  * Support reading PZX files (Fredrick Meunier).
  * Support for the TZX set signal level block (Fredrick Meunier).
- Add libbz2-devel BuildRequires to enable reading from compressed files
- Modernize package license</changelog>
  <changelog author="serbalgi@gmail.com" date="1465300800">- Update to version 1.2.0
  * Allow finalising RZX recordings (Sergio Baldoví).
  * Support for Didaktik D80 disk class (Gergely Szasz).
  * Use SZX format for interspersed snapshots in RZX recordings (Sergio
    Baldoví).
  * Add libspectrum_{new,new0,renew}(), libspectrum_{m,re}alloc_n()
    memory macros (Stuart Brady).
  * Rename libspectrum_calloc() to libspectrum_malloc0_n() (Stuart Brady).
  * Various minor bug fixes/improvements.
- Move devel to Development/Libraries/C and C++ group.
- Fix the build on RHEL_7 and SLE_11_SP3.
- Distribute COPYING file.
- Several spec fixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1471867200">- Update to version 1.2.2
  * Support for reading zip files (Patrik Rak and Sergio Baldoví).
  * Support for converting PZX data blocks with asymmetric pulses to TZX
    GDB blocks (Fredrick Meunier).
  * Various minor bug fixes/improvements:</changelog>
  <changelog author="serbalgi@gmail.com" date="1481371200">- Update to version 1.3.2
  * Make glib replacement protect global data structures against
    modification from multiple threads (BogDan Vatra).</changelog>
  <changelog author="serbalgi@gmail.com" date="1493553600">- Update to version 1.3.3
  * Silently skip PLTT blocks in SZX snapshots.
  * Validate "used bits in last byte" field in TZX tapes.
  * Fix the load of PZX tapes with malformed strings.
  * Various minor bug fixes/improvements.</changelog>
  <changelog author="serbalgi@gmail.com" date="1499688000">- Update to version 1.3.5
  * Add Multiface One/128/3 support.
  * Add self-inflating buffer for writing binary files.
  * Add class recognition for SCR files.
  * Fix crash when saving CSW tapes.
  * Work around invalid "used bits in last byte" field in TZX tapes.
  * Save SpecDrum level as unsigned in SZX snapshots.
  * Add support for storing Covox interface state.</changelog>
  <changelog author="serbalgi@gmail.com" date="1507809600">- Update to version 1.4.1
  * Add support for MMC / SD card emulation in SPI mode.
  * Add class recognition for MLT files.</changelog>
  <changelog author="serbalgi@gmail.com" date="1525176000">- Update to version 1.4.2
  * RZX files containing a snapshot which cannot be compressed are now
    written correctly.</changelog>
  <changelog author="serbalgi@gmail.com" date="1530878400">- Update to version 1.4.4
  * Fix memory allocation in g_array_set_size().
  * Fix TC2048 and TC2068 timings regression.
  * Add peek block function for tape iterators.</changelog>
</package>
<package pkgid="f70b8ab659759ee3fce369cd456ab400f7ca67948b28f4f50aa9e965f055ec568fd3fb16b572007eac9a051d072ba9b833d360363ae849a0f4ef7bb7c2413e2a" name="libspectrum-devel" arch="i586">
  <version epoch="0" ver="1.4.4" rel="4.16"/>
  <changelog author="nmarques@opensuse.org" date="1317729600">- Update to version 1.0.0
- Several spec fixes</changelog>
  <changelog author="serbalgi@gmail.com" date="1379332800">- Update to version 1.1.1
  * Decreased libtool version to allow binaries built against
    libspectrum 1.0.0 to run with libspectrum 1.1.1.
  * Support for Spectranet in snapshots (Philip Kendall).
  * Support for Cheetah SpecDrum in snapshots (Fredrick Meunier).
  * Support reading PZX files (Fredrick Meunier).
  * Support for the TZX set signal level block (Fredrick Meunier).
- Add libbz2-devel BuildRequires to enable reading from compressed files
- Modernize package license</changelog>
  <changelog author="serbalgi@gmail.com" date="1465300800">- Update to version 1.2.0
  * Allow finalising RZX recordings (Sergio Baldoví).
  * Support for Didaktik D80 disk class (Gergely Szasz).
  * Use SZX format for interspersed snapshots in RZX recordings (Sergio
    Baldoví).
  * Add libspectrum_{new,new0,renew}(), libspectrum_{m,re}alloc_n()
    memory macros (Stuart Brady).
  * Rename libspectrum_calloc() to libspectrum_malloc0_n() (Stuart Brady).
  * Various minor bug fixes/improvements.
- Move devel to Development/Libraries/C and C++ group.
- Fix the build on RHEL_7 and SLE_11_SP3.
- Distribute COPYING file.
- Several spec fixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1471867200">- Update to version 1.2.2
  * Support for reading zip files (Patrik Rak and Sergio Baldoví).
  * Support for converting PZX data blocks with asymmetric pulses to TZX
    GDB blocks (Fredrick Meunier).
  * Various minor bug fixes/improvements:</changelog>
  <changelog author="serbalgi@gmail.com" date="1481371200">- Update to version 1.3.2
  * Make glib replacement protect global data structures against
    modification from multiple threads (BogDan Vatra).</changelog>
  <changelog author="serbalgi@gmail.com" date="1493553600">- Update to version 1.3.3
  * Silently skip PLTT blocks in SZX snapshots.
  * Validate "used bits in last byte" field in TZX tapes.
  * Fix the load of PZX tapes with malformed strings.
  * Various minor bug fixes/improvements.</changelog>
  <changelog author="serbalgi@gmail.com" date="1499688000">- Update to version 1.3.5
  * Add Multiface One/128/3 support.
  * Add self-inflating buffer for writing binary files.
  * Add class recognition for SCR files.
  * Fix crash when saving CSW tapes.
  * Work around invalid "used bits in last byte" field in TZX tapes.
  * Save SpecDrum level as unsigned in SZX snapshots.
  * Add support for storing Covox interface state.</changelog>
  <changelog author="serbalgi@gmail.com" date="1507809600">- Update to version 1.4.1
  * Add support for MMC / SD card emulation in SPI mode.
  * Add class recognition for MLT files.</changelog>
  <changelog author="serbalgi@gmail.com" date="1525176000">- Update to version 1.4.2
  * RZX files containing a snapshot which cannot be compressed are now
    written correctly.</changelog>
  <changelog author="serbalgi@gmail.com" date="1530878400">- Update to version 1.4.4
  * Fix memory allocation in g_array_set_size().
  * Fix TC2048 and TC2068 timings regression.
  * Add peek block function for tape iterators.</changelog>
</package>
<package pkgid="42fccc38aa23566bf0966693523c4efc88fb8f87a22d03ff749fab532172f48100659d2ba70b923d862970ae287c1991f3e46803099855568b806384802c8120" name="libspectrum8" arch="i586">
  <version epoch="0" ver="1.4.4" rel="4.16"/>
  <changelog author="nmarques@opensuse.org" date="1317729600">- Update to version 1.0.0
- Several spec fixes</changelog>
  <changelog author="serbalgi@gmail.com" date="1379332800">- Update to version 1.1.1
  * Decreased libtool version to allow binaries built against
    libspectrum 1.0.0 to run with libspectrum 1.1.1.
  * Support for Spectranet in snapshots (Philip Kendall).
  * Support for Cheetah SpecDrum in snapshots (Fredrick Meunier).
  * Support reading PZX files (Fredrick Meunier).
  * Support for the TZX set signal level block (Fredrick Meunier).
- Add libbz2-devel BuildRequires to enable reading from compressed files
- Modernize package license</changelog>
  <changelog author="serbalgi@gmail.com" date="1465300800">- Update to version 1.2.0
  * Allow finalising RZX recordings (Sergio Baldoví).
  * Support for Didaktik D80 disk class (Gergely Szasz).
  * Use SZX format for interspersed snapshots in RZX recordings (Sergio
    Baldoví).
  * Add libspectrum_{new,new0,renew}(), libspectrum_{m,re}alloc_n()
    memory macros (Stuart Brady).
  * Rename libspectrum_calloc() to libspectrum_malloc0_n() (Stuart Brady).
  * Various minor bug fixes/improvements.
- Move devel to Development/Libraries/C and C++ group.
- Fix the build on RHEL_7 and SLE_11_SP3.
- Distribute COPYING file.
- Several spec fixes.</changelog>
  <changelog author="serbalgi@gmail.com" date="1471867200">- Update to version 1.2.2
  * Support for reading zip files (Patrik Rak and Sergio Baldoví).
  * Support for converting PZX data blocks with asymmetric pulses to TZX
    GDB blocks (Fredrick Meunier).
  * Various minor bug fixes/improvements:</changelog>
  <changelog author="serbalgi@gmail.com" date="1481371200">- Update to version 1.3.2
  * Make glib replacement protect global data structures against
    modification from multiple threads (BogDan Vatra).</changelog>
  <changelog author="serbalgi@gmail.com" date="1493553600">- Update to version 1.3.3
  * Silently skip PLTT blocks in SZX snapshots.
  * Validate "used bits in last byte" field in TZX tapes.
  * Fix the load of PZX tapes with malformed strings.
  * Various minor bug fixes/improvements.</changelog>
  <changelog author="serbalgi@gmail.com" date="1499688000">- Update to version 1.3.5
  * Add Multiface One/128/3 support.
  * Add self-inflating buffer for writing binary files.
  * Add class recognition for SCR files.
  * Fix crash when saving CSW tapes.
  * Work around invalid "used bits in last byte" field in TZX tapes.
  * Save SpecDrum level as unsigned in SZX snapshots.
  * Add support for storing Covox interface state.</changelog>
  <changelog author="serbalgi@gmail.com" date="1507809600">- Update to version 1.4.1
  * Add support for MMC / SD card emulation in SPI mode.
  * Add class recognition for MLT files.</changelog>
  <changelog author="serbalgi@gmail.com" date="1525176000">- Update to version 1.4.2
  * RZX files containing a snapshot which cannot be compressed are now
    written correctly.</changelog>
  <changelog author="serbalgi@gmail.com" date="1530878400">- Update to version 1.4.4
  * Fix memory allocation in g_array_set_size().
  * Fix TC2048 and TC2068 timings regression.
  * Add peek block function for tape iterators.</changelog>
</package>
<package pkgid="00b98cd842e8c3a576af83cc865403db89afcaaec4a673f952c0f347ed22182df408c3918aeaad2b52d66b3ca65a8e421b31d08ff5635fad856d261635da17be" name="nemu" arch="src">
  <version epoch="0" ver="3.3.1" rel="10.11"/>
  <changelog author="alex.xopc@gmail.com" date="1630324800">- initial package (version 2.6.0) for openSUSE</changelog>
  <changelog author="alex.xopc@gmail.com" date="1630411200">- update to nEMU 3.0.0</changelog>
  <changelog author="alex.xopc@gmail.com" date="1736424000">- update to nEMU 3.3.1</changelog>
</package>
<package pkgid="b4c656ce4f4e2332f4a3dce27175a8156ae710eb562739bc0e734839ff820e69463b2794cafb9738cdbbe569fbb66820b6ff2368b1307570f7992a5b3c293e58" name="nemu" arch="x86_64">
  <version epoch="0" ver="3.3.1" rel="10.11"/>
  <changelog author="alex.xopc@gmail.com" date="1630324800">- initial package (version 2.6.0) for openSUSE</changelog>
  <changelog author="alex.xopc@gmail.com" date="1630411200">- update to nEMU 3.0.0</changelog>
  <changelog author="alex.xopc@gmail.com" date="1736424000">- update to nEMU 3.3.1</changelog>
</package>
<package pkgid="1d0b6c33d25d8dd8e1ab7f452bd1f8bb8967b0c7d3eaa71b0937ffe7d580f7e91dbcc09ce7ae2b11718d336ae52a1321ddb0d08803c5d567d7eaa106f0d34f20" name="nemu-bash-completion" arch="noarch">
  <version epoch="0" ver="3.3.1" rel="10.11"/>
  <changelog author="alex.xopc@gmail.com" date="1630324800">- initial package (version 2.6.0) for openSUSE</changelog>
  <changelog author="alex.xopc@gmail.com" date="1630411200">- update to nEMU 3.0.0</changelog>
  <changelog author="alex.xopc@gmail.com" date="1736424000">- update to nEMU 3.3.1</changelog>
</package>
<package pkgid="32cce29a222fb8ff5700e403a3f56327fd3783719a9bb1f497e2377e45158eb4a8dc2514ae0f0458934a3d700f405254a5a297c82bc91b6f93e33d7d284c2f98" name="nemu-lang" arch="noarch">
  <version epoch="0" ver="3.3.1" rel="10.11"/>
  <changelog author="alex.xopc@gmail.com" date="1630324800">- initial package (version 2.6.0) for openSUSE</changelog>
  <changelog author="alex.xopc@gmail.com" date="1630411200">- update to nEMU 3.0.0</changelog>
  <changelog author="alex.xopc@gmail.com" date="1736424000">- update to nEMU 3.3.1</changelog>
</package>
<package pkgid="92cb9e37c413b6e94be7b42a6f22ef8498ea36a0ebc2d5fcbd9aa6e11cb7e22a6942f7a8730f44b8ef0aa4bb9e8ef3932a3170f8360ce6b167c0a1f629b2853c" name="nemu-zsh-completion" arch="noarch">
  <version epoch="0" ver="3.3.1" rel="10.11"/>
  <changelog author="alex.xopc@gmail.com" date="1630324800">- initial package (version 2.6.0) for openSUSE</changelog>
  <changelog author="alex.xopc@gmail.com" date="1630411200">- update to nEMU 3.0.0</changelog>
  <changelog author="alex.xopc@gmail.com" date="1736424000">- update to nEMU 3.3.1</changelog>
</package>
<package pkgid="621a9be4de6a621cedecaea59b40551d6c29716eeb848400ad34d8e3284c270d56355ae4906ad7d3bc612f2053ce53bdd1a511eb3efee45dc49595b8aaab485e" name="ppp" arch="i586">
  <version epoch="0" ver="2.4.9" rel="207.76"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1583236800">- Add pam_keyinit to /etc/pam.d/ppp (bsc#1144055).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1587902400">- add upstream signing keyring and verify source signature</changelog>
  <changelog author="pgajdos@suse.com" date="1588852800">- /usr/lib/systemd instead %{_libexecdir}/systemd</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1589889600">- Fixup previous fix: use the defined macro %_unitdir for the
  systemd unit.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1596456000">- New version 2.4.8.
  * New pppd options have been added:
  * ifname, to set the name for the PPP interface device
  * defaultroute-metric, to set the metric for the default route
  * defaultroute6, to add an IPv6 default route (with
    nodefaultroute6 to prevent adding an IPv6 default route).
  * up_sdnotify, to have pppd notify systemd when the link is up.
  * The rp-pppoe plugin has new options:
  * host-uniq, to set the Host-Uniq value to send
  * pppoe-padi-timeout, to set the timeout for discovery packets
  * pppoe-padi-attempts, to set the number of discovery attempts.
  * Added the CLASS attribute in radius packets.
  * Fixed warnings and issues found by static analysis.
- Obsoleted patches:
  * ppp-2.4.3-pppoatm.diff
  * ppp-2.4.4-strncatfix.patch
  * ppp-2.4.6-ifname.diff
  * ppp-2.4.7-DES-openssl.patch
  * ppp-2.4.7.tar.gz.asc
  * ppp-send-padt.patch
- Patches that got renamed, because they needed rediffing:
  * ppp-2.4.1-higher-speeds.diff -&gt; ppp-higher-speeds.patch
  * ppp-2.4.1-higher-speeds.diff -&gt; ppp-higher-speeds.patch
  * ppp-2.4.2-__P.diff -&gt; ppp-__P.patch
  * ppp-2.4.2-cifdefroute.diff -&gt; ppp-cifdefroute.patch
  * ppp-2.4.2-pie.patch -&gt; ppp-pie.patch
  * ppp-2.4.2-smpppd.diff -&gt; ppp-smpppd.patch
  * ppp-2.4.3-filter.diff -&gt; ppp-filter.patch
  * ppp-2.4.3-fork-fix.diff -&gt; ppp-fork-fix.patch
  * ppp-2.4.4-var_run_resolv_conf.patch -&gt; ppp-var_run_resolv_conf.patch
  * ppp-2.4.6-lib64.patch -&gt; ppp-lib64.patch
  * ppp-2.4.6-make.diff -&gt; ppp-make.patch
  * ppp-2.4.6-misc.diff -&gt; ppp-misc.patch
  * ppp-2.4.7-fix-bashisms.patch -&gt; ppp-fix-bashisms.patch
- bsc#1172916: Fix an outdated comment for lcp-echo-interval.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244800">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  lib64 == lib64.</changelog>
  <changelog author="&#x418;&#x43B;&#x44C;&#x44F; &#x418;&#x43D;&#x434;&#x438;&#x433;&#x43E; &lt;ilya@ilya.cf&gt;" date="1604923200">- Refresh spec-file via spec-cleaner and manual optimizations.
  * Removed obsolete constructs (creating dialout group via shadow).</changelog>
  <changelog author="&#x418;&#x43B;&#x44C;&#x44F; &#x418;&#x43D;&#x434;&#x438;&#x433;&#x43E; &lt;ilya@ilya.cf&gt;" date="1646913600">- Removed Wants=network.target from modem@.service (bsc#1196359).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1653307200">- Update to version 2.4.9
  * Support for new EAP (Extensible Authentication Protocol) methods
  * Support for EAP-TLS
  * Support for EAP-MSCHAPv2
  * New pppd options:
  * chap-timeout
  * chapms-strip-domain
  * replacedefaultroute
  * noreplacedefaultroute
  * ipv6cp-accept-remote
  * lcp-echo-adaptive
  * ip-up-script
  * ip-down-script
  * ca
  * capath
  * cert
  * key
  * crl-dir
  * crl
  * max-tls-version
  * need-peer-eap
  * Fixes for CVE-2020-8597 and CVE-2015-3310.
  * The rp-pppoe plugin has been renamed to pppoe, to distinguish it
    from the upstream rp-pppoe code.  Its options have changed names,
    but the old names are kept as aliases.
  * Many bug fixes and cleanups.
- Drop upstream fixed patches
  * ppp-2.4.3-winbind-setuidfix.patch
  * fix-header-conflict.patch
  * ppp-CVE-2015-3310.patch
  * ppp-CVE-2020-8597.patch
  * ppp-cifdefroute.patch
  * ppp-higher-speeds.patch
  * ppp-2.4.3-strip.diff
  * ppp-filter.patch
  * ppp-__P.patch
- Drop upstream resolved ppp-make.patch use `--cflags` configure
  switch instead</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1653566400">- Add ppp-compiling-with-clang-encounters-an-error-in-eap-tls..patch
  that fixed the following rpmlint error:
  executable-stack (Badness: 10000) /usr/sbin/pppd</changelog>
</package>
<package pkgid="465d9990ad32ca2868341c9bb457ea59b2e069e48554a87239b1313089ef1762f2b398be17efc8b21a452618e39d1754aeae77dd3ed6316e05bcdf5e7c9845f8" name="ppp" arch="src">
  <version epoch="0" ver="2.4.9" rel="207.76"/>
  <changelog author="Led &lt;ledest@gmail.com&gt;" date="1416398400">- fix bashisms in redialer script
- add patches:
  * ppp-2.4.7-fix-bashisms.patch</changelog>
  <changelog author="max@suse.com" date="1447416000">- Added ppp-CVE-2015-3310.patch:
  Fix for bnc#927841, CVE-2015-3310: Fix buffer overflow in radius
  plug-in's rc_mksid().</changelog>
  <changelog author="schwab@suse.de" date="1476705600">- fix-header-conflict.patch: avoid conflict with kernel headers</changelog>
  <changelog author="max@suse.com" date="1481284800">- Use system-wide libatm instead of local copy (boo#1013567).</changelog>
  <changelog author="meissner@suse.com" date="1497096000">- ppp-2.4.2-pie.patch: also enable PIE for /usr/sbin/pppstats</changelog>
  <changelog author="kukuk@suse.com" date="1497355200">- Add /etc/ppp, this directory is no longer part of filesystem.
  Most likely requiring sysconfig would be necessary.</changelog>
  <changelog author="ilya@ilya.cf" date="1511438400">- Add Requires group(dialout) (boo#1067511).</changelog>
  <changelog author="ilya@ilya.cf" date="1511524800">- Refresh spec-file via spec-cleaner.
- Add ppp-modem package for automatic redial to mobile provider.</changelog>
  <changelog author="schwab@suse.de" date="1538654400">- ppp-2.4.7-DES-openssl.patch: Use openssl instead of libcrypt for DES</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1581076800">- CVE-2020-8597, bsc#1162610, ppp-CVE-2020-8597.patch: rhostname
  buffer overflow in the  eap_request and eap_response functions.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1583236800">- Add pam_keyinit to /etc/pam.d/ppp (bsc#1144055).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1587902400">- add upstream signing keyring and verify source signature</changelog>
  <changelog author="pgajdos@suse.com" date="1588852800">- /usr/lib/systemd instead %{_libexecdir}/systemd</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1589889600">- Fixup previous fix: use the defined macro %_unitdir for the
  systemd unit.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1596456000">- New version 2.4.8.
  * New pppd options have been added:
  * ifname, to set the name for the PPP interface device
  * defaultroute-metric, to set the metric for the default route
  * defaultroute6, to add an IPv6 default route (with
    nodefaultroute6 to prevent adding an IPv6 default route).
  * up_sdnotify, to have pppd notify systemd when the link is up.
  * The rp-pppoe plugin has new options:
  * host-uniq, to set the Host-Uniq value to send
  * pppoe-padi-timeout, to set the timeout for discovery packets
  * pppoe-padi-attempts, to set the number of discovery attempts.
  * Added the CLASS attribute in radius packets.
  * Fixed warnings and issues found by static analysis.
- Obsoleted patches:
  * ppp-2.4.3-pppoatm.diff
  * ppp-2.4.4-strncatfix.patch
  * ppp-2.4.6-ifname.diff
  * ppp-2.4.7-DES-openssl.patch
  * ppp-2.4.7.tar.gz.asc
  * ppp-send-padt.patch
- Patches that got renamed, because they needed rediffing:
  * ppp-2.4.1-higher-speeds.diff -&gt; ppp-higher-speeds.patch
  * ppp-2.4.1-higher-speeds.diff -&gt; ppp-higher-speeds.patch
  * ppp-2.4.2-__P.diff -&gt; ppp-__P.patch
  * ppp-2.4.2-cifdefroute.diff -&gt; ppp-cifdefroute.patch
  * ppp-2.4.2-pie.patch -&gt; ppp-pie.patch
  * ppp-2.4.2-smpppd.diff -&gt; ppp-smpppd.patch
  * ppp-2.4.3-filter.diff -&gt; ppp-filter.patch
  * ppp-2.4.3-fork-fix.diff -&gt; ppp-fork-fix.patch
  * ppp-2.4.4-var_run_resolv_conf.patch -&gt; ppp-var_run_resolv_conf.patch
  * ppp-2.4.6-lib64.patch -&gt; ppp-lib64.patch
  * ppp-2.4.6-make.diff -&gt; ppp-make.patch
  * ppp-2.4.6-misc.diff -&gt; ppp-misc.patch
  * ppp-2.4.7-fix-bashisms.patch -&gt; ppp-fix-bashisms.patch
- bsc#1172916: Fix an outdated comment for lcp-echo-interval.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244800">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  lib64 == lib64.</changelog>
  <changelog author="&#x418;&#x43B;&#x44C;&#x44F; &#x418;&#x43D;&#x434;&#x438;&#x433;&#x43E; &lt;ilya@ilya.cf&gt;" date="1604923200">- Refresh spec-file via spec-cleaner and manual optimizations.
  * Removed obsolete constructs (creating dialout group via shadow).</changelog>
  <changelog author="&#x418;&#x43B;&#x44C;&#x44F; &#x418;&#x43D;&#x434;&#x438;&#x433;&#x43E; &lt;ilya@ilya.cf&gt;" date="1646913600">- Removed Wants=network.target from modem@.service (bsc#1196359).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1653307200">- Update to version 2.4.9
  * Support for new EAP (Extensible Authentication Protocol) methods
  * Support for EAP-TLS
  * Support for EAP-MSCHAPv2
  * New pppd options:
  * chap-timeout
  * chapms-strip-domain
  * replacedefaultroute
  * noreplacedefaultroute
  * ipv6cp-accept-remote
  * lcp-echo-adaptive
  * ip-up-script
  * ip-down-script
  * ca
  * capath
  * cert
  * key
  * crl-dir
  * crl
  * max-tls-version
  * need-peer-eap
  * Fixes for CVE-2020-8597 and CVE-2015-3310.
  * The rp-pppoe plugin has been renamed to pppoe, to distinguish it
    from the upstream rp-pppoe code.  Its options have changed names,
    but the old names are kept as aliases.
  * Many bug fixes and cleanups.
- Drop upstream fixed patches
  * ppp-2.4.3-winbind-setuidfix.patch
  * fix-header-conflict.patch
  * ppp-CVE-2015-3310.patch
  * ppp-CVE-2020-8597.patch
  * ppp-cifdefroute.patch
  * ppp-higher-speeds.patch
  * ppp-2.4.3-strip.diff
  * ppp-filter.patch
  * ppp-__P.patch
- Drop upstream resolved ppp-make.patch use `--cflags` configure
  switch instead</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1653566400">- Add ppp-compiling-with-clang-encounters-an-error-in-eap-tls..patch
  that fixed the following rpmlint error:
  executable-stack (Badness: 10000) /usr/sbin/pppd</changelog>
</package>
<package pkgid="42e95b10ab88645a658b423116ce1db563ed4de75776e2135b46b6dd4193d1736e9f00d3d0ea0fef42339d022c5f6606cdb3ac7489fad6dac17294a0e3390c21" name="ppp" arch="x86_64">
  <version epoch="0" ver="2.4.9" rel="207.76"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1583236800">- Add pam_keyinit to /etc/pam.d/ppp (bsc#1144055).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1587902400">- add upstream signing keyring and verify source signature</changelog>
  <changelog author="pgajdos@suse.com" date="1588852800">- /usr/lib/systemd instead %{_libexecdir}/systemd</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1589889600">- Fixup previous fix: use the defined macro %_unitdir for the
  systemd unit.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1596456000">- New version 2.4.8.
  * New pppd options have been added:
  * ifname, to set the name for the PPP interface device
  * defaultroute-metric, to set the metric for the default route
  * defaultroute6, to add an IPv6 default route (with
    nodefaultroute6 to prevent adding an IPv6 default route).
  * up_sdnotify, to have pppd notify systemd when the link is up.
  * The rp-pppoe plugin has new options:
  * host-uniq, to set the Host-Uniq value to send
  * pppoe-padi-timeout, to set the timeout for discovery packets
  * pppoe-padi-attempts, to set the number of discovery attempts.
  * Added the CLASS attribute in radius packets.
  * Fixed warnings and issues found by static analysis.
- Obsoleted patches:
  * ppp-2.4.3-pppoatm.diff
  * ppp-2.4.4-strncatfix.patch
  * ppp-2.4.6-ifname.diff
  * ppp-2.4.7-DES-openssl.patch
  * ppp-2.4.7.tar.gz.asc
  * ppp-send-padt.patch
- Patches that got renamed, because they needed rediffing:
  * ppp-2.4.1-higher-speeds.diff -&gt; ppp-higher-speeds.patch
  * ppp-2.4.1-higher-speeds.diff -&gt; ppp-higher-speeds.patch
  * ppp-2.4.2-__P.diff -&gt; ppp-__P.patch
  * ppp-2.4.2-cifdefroute.diff -&gt; ppp-cifdefroute.patch
  * ppp-2.4.2-pie.patch -&gt; ppp-pie.patch
  * ppp-2.4.2-smpppd.diff -&gt; ppp-smpppd.patch
  * ppp-2.4.3-filter.diff -&gt; ppp-filter.patch
  * ppp-2.4.3-fork-fix.diff -&gt; ppp-fork-fix.patch
  * ppp-2.4.4-var_run_resolv_conf.patch -&gt; ppp-var_run_resolv_conf.patch
  * ppp-2.4.6-lib64.patch -&gt; ppp-lib64.patch
  * ppp-2.4.6-make.diff -&gt; ppp-make.patch
  * ppp-2.4.6-misc.diff -&gt; ppp-misc.patch
  * ppp-2.4.7-fix-bashisms.patch -&gt; ppp-fix-bashisms.patch
- bsc#1172916: Fix an outdated comment for lcp-echo-interval.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244800">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  lib64 == lib64.</changelog>
  <changelog author="&#x418;&#x43B;&#x44C;&#x44F; &#x418;&#x43D;&#x434;&#x438;&#x433;&#x43E; &lt;ilya@ilya.cf&gt;" date="1604923200">- Refresh spec-file via spec-cleaner and manual optimizations.
  * Removed obsolete constructs (creating dialout group via shadow).</changelog>
  <changelog author="&#x418;&#x43B;&#x44C;&#x44F; &#x418;&#x43D;&#x434;&#x438;&#x433;&#x43E; &lt;ilya@ilya.cf&gt;" date="1646913600">- Removed Wants=network.target from modem@.service (bsc#1196359).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1653307200">- Update to version 2.4.9
  * Support for new EAP (Extensible Authentication Protocol) methods
  * Support for EAP-TLS
  * Support for EAP-MSCHAPv2
  * New pppd options:
  * chap-timeout
  * chapms-strip-domain
  * replacedefaultroute
  * noreplacedefaultroute
  * ipv6cp-accept-remote
  * lcp-echo-adaptive
  * ip-up-script
  * ip-down-script
  * ca
  * capath
  * cert
  * key
  * crl-dir
  * crl
  * max-tls-version
  * need-peer-eap
  * Fixes for CVE-2020-8597 and CVE-2015-3310.
  * The rp-pppoe plugin has been renamed to pppoe, to distinguish it
    from the upstream rp-pppoe code.  Its options have changed names,
    but the old names are kept as aliases.
  * Many bug fixes and cleanups.
- Drop upstream fixed patches
  * ppp-2.4.3-winbind-setuidfix.patch
  * fix-header-conflict.patch
  * ppp-CVE-2015-3310.patch
  * ppp-CVE-2020-8597.patch
  * ppp-cifdefroute.patch
  * ppp-higher-speeds.patch
  * ppp-2.4.3-strip.diff
  * ppp-filter.patch
  * ppp-__P.patch
- Drop upstream resolved ppp-make.patch use `--cflags` configure
  switch instead</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1653566400">- Add ppp-compiling-with-clang-encounters-an-error-in-eap-tls..patch
  that fixed the following rpmlint error:
  executable-stack (Badness: 10000) /usr/sbin/pppd</changelog>
</package>
<package pkgid="bc817b3800cde33b6254d286ed1275a38a8d7833ca2bceae92eb664204af7bcc3e3054b024e7de42c26085eb554c830e2e661210a4d42913bb9420460f7dbab0" name="ppp-devel" arch="i586">
  <version epoch="0" ver="2.4.9" rel="207.76"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1583236800">- Add pam_keyinit to /etc/pam.d/ppp (bsc#1144055).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1587902400">- add upstream signing keyring and verify source signature</changelog>
  <changelog author="pgajdos@suse.com" date="1588852800">- /usr/lib/systemd instead %{_libexecdir}/systemd</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1589889600">- Fixup previous fix: use the defined macro %_unitdir for the
  systemd unit.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1596456000">- New version 2.4.8.
  * New pppd options have been added:
  * ifname, to set the name for the PPP interface device
  * defaultroute-metric, to set the metric for the default route
  * defaultroute6, to add an IPv6 default route (with
    nodefaultroute6 to prevent adding an IPv6 default route).
  * up_sdnotify, to have pppd notify systemd when the link is up.
  * The rp-pppoe plugin has new options:
  * host-uniq, to set the Host-Uniq value to send
  * pppoe-padi-timeout, to set the timeout for discovery packets
  * pppoe-padi-attempts, to set the number of discovery attempts.
  * Added the CLASS attribute in radius packets.
  * Fixed warnings and issues found by static analysis.
- Obsoleted patches:
  * ppp-2.4.3-pppoatm.diff
  * ppp-2.4.4-strncatfix.patch
  * ppp-2.4.6-ifname.diff
  * ppp-2.4.7-DES-openssl.patch
  * ppp-2.4.7.tar.gz.asc
  * ppp-send-padt.patch
- Patches that got renamed, because they needed rediffing:
  * ppp-2.4.1-higher-speeds.diff -&gt; ppp-higher-speeds.patch
  * ppp-2.4.1-higher-speeds.diff -&gt; ppp-higher-speeds.patch
  * ppp-2.4.2-__P.diff -&gt; ppp-__P.patch
  * ppp-2.4.2-cifdefroute.diff -&gt; ppp-cifdefroute.patch
  * ppp-2.4.2-pie.patch -&gt; ppp-pie.patch
  * ppp-2.4.2-smpppd.diff -&gt; ppp-smpppd.patch
  * ppp-2.4.3-filter.diff -&gt; ppp-filter.patch
  * ppp-2.4.3-fork-fix.diff -&gt; ppp-fork-fix.patch
  * ppp-2.4.4-var_run_resolv_conf.patch -&gt; ppp-var_run_resolv_conf.patch
  * ppp-2.4.6-lib64.patch -&gt; ppp-lib64.patch
  * ppp-2.4.6-make.diff -&gt; ppp-make.patch
  * ppp-2.4.6-misc.diff -&gt; ppp-misc.patch
  * ppp-2.4.7-fix-bashisms.patch -&gt; ppp-fix-bashisms.patch
- bsc#1172916: Fix an outdated comment for lcp-echo-interval.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244800">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  lib64 == lib64.</changelog>
  <changelog author="&#x418;&#x43B;&#x44C;&#x44F; &#x418;&#x43D;&#x434;&#x438;&#x433;&#x43E; &lt;ilya@ilya.cf&gt;" date="1604923200">- Refresh spec-file via spec-cleaner and manual optimizations.
  * Removed obsolete constructs (creating dialout group via shadow).</changelog>
  <changelog author="&#x418;&#x43B;&#x44C;&#x44F; &#x418;&#x43D;&#x434;&#x438;&#x433;&#x43E; &lt;ilya@ilya.cf&gt;" date="1646913600">- Removed Wants=network.target from modem@.service (bsc#1196359).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1653307200">- Update to version 2.4.9
  * Support for new EAP (Extensible Authentication Protocol) methods
  * Support for EAP-TLS
  * Support for EAP-MSCHAPv2
  * New pppd options:
  * chap-timeout
  * chapms-strip-domain
  * replacedefaultroute
  * noreplacedefaultroute
  * ipv6cp-accept-remote
  * lcp-echo-adaptive
  * ip-up-script
  * ip-down-script
  * ca
  * capath
  * cert
  * key
  * crl-dir
  * crl
  * max-tls-version
  * need-peer-eap
  * Fixes for CVE-2020-8597 and CVE-2015-3310.
  * The rp-pppoe plugin has been renamed to pppoe, to distinguish it
    from the upstream rp-pppoe code.  Its options have changed names,
    but the old names are kept as aliases.
  * Many bug fixes and cleanups.
- Drop upstream fixed patches
  * ppp-2.4.3-winbind-setuidfix.patch
  * fix-header-conflict.patch
  * ppp-CVE-2015-3310.patch
  * ppp-CVE-2020-8597.patch
  * ppp-cifdefroute.patch
  * ppp-higher-speeds.patch
  * ppp-2.4.3-strip.diff
  * ppp-filter.patch
  * ppp-__P.patch
- Drop upstream resolved ppp-make.patch use `--cflags` configure
  switch instead</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1653566400">- Add ppp-compiling-with-clang-encounters-an-error-in-eap-tls..patch
  that fixed the following rpmlint error:
  executable-stack (Badness: 10000) /usr/sbin/pppd</changelog>
</package>
<package pkgid="9c3d0172f0e2da99c08a50fc80e3a4433b7d97643571d0a7a7caa64757bd195586a675c628a9dedaa0e64a2e0cda25d164ba256087aa1c2f0727c1d06396b30e" name="ppp-devel" arch="x86_64">
  <version epoch="0" ver="2.4.9" rel="207.76"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1583236800">- Add pam_keyinit to /etc/pam.d/ppp (bsc#1144055).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1587902400">- add upstream signing keyring and verify source signature</changelog>
  <changelog author="pgajdos@suse.com" date="1588852800">- /usr/lib/systemd instead %{_libexecdir}/systemd</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1589889600">- Fixup previous fix: use the defined macro %_unitdir for the
  systemd unit.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1596456000">- New version 2.4.8.
  * New pppd options have been added:
  * ifname, to set the name for the PPP interface device
  * defaultroute-metric, to set the metric for the default route
  * defaultroute6, to add an IPv6 default route (with
    nodefaultroute6 to prevent adding an IPv6 default route).
  * up_sdnotify, to have pppd notify systemd when the link is up.
  * The rp-pppoe plugin has new options:
  * host-uniq, to set the Host-Uniq value to send
  * pppoe-padi-timeout, to set the timeout for discovery packets
  * pppoe-padi-attempts, to set the number of discovery attempts.
  * Added the CLASS attribute in radius packets.
  * Fixed warnings and issues found by static analysis.
- Obsoleted patches:
  * ppp-2.4.3-pppoatm.diff
  * ppp-2.4.4-strncatfix.patch
  * ppp-2.4.6-ifname.diff
  * ppp-2.4.7-DES-openssl.patch
  * ppp-2.4.7.tar.gz.asc
  * ppp-send-padt.patch
- Patches that got renamed, because they needed rediffing:
  * ppp-2.4.1-higher-speeds.diff -&gt; ppp-higher-speeds.patch
  * ppp-2.4.1-higher-speeds.diff -&gt; ppp-higher-speeds.patch
  * ppp-2.4.2-__P.diff -&gt; ppp-__P.patch
  * ppp-2.4.2-cifdefroute.diff -&gt; ppp-cifdefroute.patch
  * ppp-2.4.2-pie.patch -&gt; ppp-pie.patch
  * ppp-2.4.2-smpppd.diff -&gt; ppp-smpppd.patch
  * ppp-2.4.3-filter.diff -&gt; ppp-filter.patch
  * ppp-2.4.3-fork-fix.diff -&gt; ppp-fork-fix.patch
  * ppp-2.4.4-var_run_resolv_conf.patch -&gt; ppp-var_run_resolv_conf.patch
  * ppp-2.4.6-lib64.patch -&gt; ppp-lib64.patch
  * ppp-2.4.6-make.diff -&gt; ppp-make.patch
  * ppp-2.4.6-misc.diff -&gt; ppp-misc.patch
  * ppp-2.4.7-fix-bashisms.patch -&gt; ppp-fix-bashisms.patch
- bsc#1172916: Fix an outdated comment for lcp-echo-interval.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244800">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  lib64 == lib64.</changelog>
  <changelog author="&#x418;&#x43B;&#x44C;&#x44F; &#x418;&#x43D;&#x434;&#x438;&#x433;&#x43E; &lt;ilya@ilya.cf&gt;" date="1604923200">- Refresh spec-file via spec-cleaner and manual optimizations.
  * Removed obsolete constructs (creating dialout group via shadow).</changelog>
  <changelog author="&#x418;&#x43B;&#x44C;&#x44F; &#x418;&#x43D;&#x434;&#x438;&#x433;&#x43E; &lt;ilya@ilya.cf&gt;" date="1646913600">- Removed Wants=network.target from modem@.service (bsc#1196359).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1653307200">- Update to version 2.4.9
  * Support for new EAP (Extensible Authentication Protocol) methods
  * Support for EAP-TLS
  * Support for EAP-MSCHAPv2
  * New pppd options:
  * chap-timeout
  * chapms-strip-domain
  * replacedefaultroute
  * noreplacedefaultroute
  * ipv6cp-accept-remote
  * lcp-echo-adaptive
  * ip-up-script
  * ip-down-script
  * ca
  * capath
  * cert
  * key
  * crl-dir
  * crl
  * max-tls-version
  * need-peer-eap
  * Fixes for CVE-2020-8597 and CVE-2015-3310.
  * The rp-pppoe plugin has been renamed to pppoe, to distinguish it
    from the upstream rp-pppoe code.  Its options have changed names,
    but the old names are kept as aliases.
  * Many bug fixes and cleanups.
- Drop upstream fixed patches
  * ppp-2.4.3-winbind-setuidfix.patch
  * fix-header-conflict.patch
  * ppp-CVE-2015-3310.patch
  * ppp-CVE-2020-8597.patch
  * ppp-cifdefroute.patch
  * ppp-higher-speeds.patch
  * ppp-2.4.3-strip.diff
  * ppp-filter.patch
  * ppp-__P.patch
- Drop upstream resolved ppp-make.patch use `--cflags` configure
  switch instead</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1653566400">- Add ppp-compiling-with-clang-encounters-an-error-in-eap-tls..patch
  that fixed the following rpmlint error:
  executable-stack (Badness: 10000) /usr/sbin/pppd</changelog>
</package>
<package pkgid="e679c90ca541537dc73c30a519349686aca43dcf2bdbb188d421cd8ce1dc74f3d7d4186946108945fb7d79f163613cf1bc12b6cfb88189e62aa2f20301847bb5" name="ppp-modem" arch="noarch">
  <version epoch="0" ver="2.4.9" rel="207.76"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1583236800">- Add pam_keyinit to /etc/pam.d/ppp (bsc#1144055).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1587902400">- add upstream signing keyring and verify source signature</changelog>
  <changelog author="pgajdos@suse.com" date="1588852800">- /usr/lib/systemd instead %{_libexecdir}/systemd</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1589889600">- Fixup previous fix: use the defined macro %_unitdir for the
  systemd unit.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1596456000">- New version 2.4.8.
  * New pppd options have been added:
  * ifname, to set the name for the PPP interface device
  * defaultroute-metric, to set the metric for the default route
  * defaultroute6, to add an IPv6 default route (with
    nodefaultroute6 to prevent adding an IPv6 default route).
  * up_sdnotify, to have pppd notify systemd when the link is up.
  * The rp-pppoe plugin has new options:
  * host-uniq, to set the Host-Uniq value to send
  * pppoe-padi-timeout, to set the timeout for discovery packets
  * pppoe-padi-attempts, to set the number of discovery attempts.
  * Added the CLASS attribute in radius packets.
  * Fixed warnings and issues found by static analysis.
- Obsoleted patches:
  * ppp-2.4.3-pppoatm.diff
  * ppp-2.4.4-strncatfix.patch
  * ppp-2.4.6-ifname.diff
  * ppp-2.4.7-DES-openssl.patch
  * ppp-2.4.7.tar.gz.asc
  * ppp-send-padt.patch
- Patches that got renamed, because they needed rediffing:
  * ppp-2.4.1-higher-speeds.diff -&gt; ppp-higher-speeds.patch
  * ppp-2.4.1-higher-speeds.diff -&gt; ppp-higher-speeds.patch
  * ppp-2.4.2-__P.diff -&gt; ppp-__P.patch
  * ppp-2.4.2-cifdefroute.diff -&gt; ppp-cifdefroute.patch
  * ppp-2.4.2-pie.patch -&gt; ppp-pie.patch
  * ppp-2.4.2-smpppd.diff -&gt; ppp-smpppd.patch
  * ppp-2.4.3-filter.diff -&gt; ppp-filter.patch
  * ppp-2.4.3-fork-fix.diff -&gt; ppp-fork-fix.patch
  * ppp-2.4.4-var_run_resolv_conf.patch -&gt; ppp-var_run_resolv_conf.patch
  * ppp-2.4.6-lib64.patch -&gt; ppp-lib64.patch
  * ppp-2.4.6-make.diff -&gt; ppp-make.patch
  * ppp-2.4.6-misc.diff -&gt; ppp-misc.patch
  * ppp-2.4.7-fix-bashisms.patch -&gt; ppp-fix-bashisms.patch
- bsc#1172916: Fix an outdated comment for lcp-echo-interval.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244800">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  lib64 == lib64.</changelog>
  <changelog author="&#x418;&#x43B;&#x44C;&#x44F; &#x418;&#x43D;&#x434;&#x438;&#x433;&#x43E; &lt;ilya@ilya.cf&gt;" date="1604923200">- Refresh spec-file via spec-cleaner and manual optimizations.
  * Removed obsolete constructs (creating dialout group via shadow).</changelog>
  <changelog author="&#x418;&#x43B;&#x44C;&#x44F; &#x418;&#x43D;&#x434;&#x438;&#x433;&#x43E; &lt;ilya@ilya.cf&gt;" date="1646913600">- Removed Wants=network.target from modem@.service (bsc#1196359).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1653307200">- Update to version 2.4.9
  * Support for new EAP (Extensible Authentication Protocol) methods
  * Support for EAP-TLS
  * Support for EAP-MSCHAPv2
  * New pppd options:
  * chap-timeout
  * chapms-strip-domain
  * replacedefaultroute
  * noreplacedefaultroute
  * ipv6cp-accept-remote
  * lcp-echo-adaptive
  * ip-up-script
  * ip-down-script
  * ca
  * capath
  * cert
  * key
  * crl-dir
  * crl
  * max-tls-version
  * need-peer-eap
  * Fixes for CVE-2020-8597 and CVE-2015-3310.
  * The rp-pppoe plugin has been renamed to pppoe, to distinguish it
    from the upstream rp-pppoe code.  Its options have changed names,
    but the old names are kept as aliases.
  * Many bug fixes and cleanups.
- Drop upstream fixed patches
  * ppp-2.4.3-winbind-setuidfix.patch
  * fix-header-conflict.patch
  * ppp-CVE-2015-3310.patch
  * ppp-CVE-2020-8597.patch
  * ppp-cifdefroute.patch
  * ppp-higher-speeds.patch
  * ppp-2.4.3-strip.diff
  * ppp-filter.patch
  * ppp-__P.patch
- Drop upstream resolved ppp-make.patch use `--cflags` configure
  switch instead</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1653566400">- Add ppp-compiling-with-clang-encounters-an-error-in-eap-tls..patch
  that fixed the following rpmlint error:
  executable-stack (Badness: 10000) /usr/sbin/pppd</changelog>
</package>
<package pkgid="df7f760e6627c9efead5b3010c2a05eca6345611b1e224c966140447575725070a3d179f194eb71af4ab7899ea68e0e97d9c8bad136d112acf2c4ff920c8351e" name="python3-ldb" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="a646cd08a68aa927d24c44a4cbaecdadf3d4345fb5ec50bbca9c90160d8e5e3a7110f86a2dc70e9f0df1f25da5c7209e7812961417aacffef05b73f1af640082" name="samba" arch="src">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="7f8654ac8f7a6da82c5a4eafdfcdf2835aff637b0692039bfcf48d8063c38755a2a2ce28671c84b1536b79692309ea71fefa204c5b79d8e7d8e57755a4df8e77" name="samba" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="6fd05cad65d54bb7cb0ed435428db882881c998a0b8259fc3c480038014ea7f8c0a1b1c1abb6370174378d9fc690d8d8b4b47d105bf253bb641932d89bf66c3b" name="samba-ad-dc" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="9a315c283262f10b6d4bca5fd253f794968ded23450f090f3e821376d9ab7759e91fc0b4a4631fafd8f76105e3957b7a3895ccb0d1e8791ed4088e6905802c78" name="samba-ad-dc-libs" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="380b9d0ca34983ae21a625b638406a50d21c733bdf35c1a817ae49ff3a9f29b9fd51570b8910654407538c2664c40d4f1ab453e9e1ba5442b5a1f398658076a8" name="samba-ceph" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="5cc6735fd9443069ce9db382ea5b3d41119d1beb6e29ce8781cca29f041857c78380495af295e61e91611e95f5c8fb062e1957c12f9cd1c4d91eecb17f3fda16" name="samba-client" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="72cc3665482d00f7ead1679604fcc6cd064fc914010aa60e79144691361632748fcec58e17b4e82748e86bea84e459f348d85825ff905455bcc6c72486cb5b64" name="samba-client-lang" arch="noarch">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="e6ff544324cc0ce2ec0139850bb3c23d7a35f8398b896449d4e3be446e26de44ba0abf5a37cba274344c3d8177a545cf97b7cdf3d8b32e9c5c79a5b3b5bfbffe" name="samba-client-libs" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="3f8cbe5052436f862545bc0f39bf00ebed4c329e305e9a03b15dee4b2f85068bea62b35f3c051109ea8d728034f96fbd7edab88b9bf6bbde1c60cf50ea5541d2" name="samba-dcerpc" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="2204eb757c32e267b82f2784a38bf96028ebee0a6f9b9367ac88bd323e729f142452069d742263f12ed3a7bf1d1fc3a95e310c22c391a51bb98494c6a9ee2664" name="samba-devel" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="e6418b040884b5a9802d85691660eef07644bef88c6fd8db9e5d66d9587c2d9ee6824f754cb7dd87a35034920c00701369b49e3f67a7a3b11ca954692a6c4070" name="samba-doc" arch="noarch">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="115cfeb2034c115caa63a1e40cc8d0e1d54e38ddfa86ad9871318fc6664c7832cce66bad9083844e879f740cf902465b886933c85f1c844d57937027d7c57ea2" name="samba-dsdb-modules" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="7f71b5d4fb4875dc9a02be5921a244ee9122d0aebd557142d5f4c6a4e201663f63072b780507761ea7ee14dd98644747d65ff80f28a588d965f1dddf66bcb759" name="samba-gpupdate" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="f9f87086045b1343d677e5c4d75e95c4bda8046495d821394cc667e1831e95862799db75c4fd7821c5d1d9672961371a3e312d1a11dc38589597b82e9ba9db49" name="samba-ldb-ldap" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="dfc40767a3ddebcb3b275bc352695218d4e7e9ff769e046750061c63941a16793ca8173f0c3ed9384fabb48cb50636ef1e79c02ce7d3bb4138ba5d4d5ad1c330" name="samba-libs" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="71f4a18a80378a5c112cfc25b52e2025a7da33122b8ce81e39747f07c7ecbef98fcfcaa638e777bdd46a67c634d736fe3d58dfd5f82d3b6ace1560a91f48fab1" name="samba-libs-python3" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="d962bbadffc0665ad48c2f4741576a6819074a9ed04e292d7ea2005ae48949286e4cf52af727111d58b06e96444185e7b317b3ff1cd6b5a3f67ed26d88644b67" name="samba-python3" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="b98746cbf8fcb6e49367e62d8a2299336cb8fc536877656a0155fe985a68a287eec357cd1e2c0da2d8fa1b68aa8a25132839c33cf0ff7cb698b0adf2075f5c77" name="samba-test" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="62e8f96d7025d5e5b4d226c3144bb1b87d57a29801a6b454ee873defae44a0e38538c3c8bb5c0b2706db7cdb1f25f9d12abfef9a15bb4ab43c9e34c9e8d2e7a9" name="samba-tool" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="edb04bb78a8a49749930da19e91f5aeb1fd5e5867fb6d8110fa51e3f92f616e594b7bc56804b05ef748914f78426892d706712a64eac6887d4581e60bc18ecd8" name="samba-winbind" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="50b67347e6a634d0b03b033c2aeaeebec687f06ac8e7a6c3bcb8e23e5c3a9061af0e1ac6a67e38ff92890905e24e7599ec79591577a7506c5d63d50401b42df6" name="samba-winbind-libs" arch="x86_64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="7e560e96b6caef2de21536bf8cca932ea363ed572d4f5929dc018ef89c3a6725284e6a6e4fb2f0a0344d99b2b3b02aef355c81dbb3ca8705741e4a32e76bfdb9" name="samba-winbind-libs-lang" arch="noarch">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="91.4"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="c6c5be4c95e4c67ed660472c82b488fcecc543e8068c6b101b4d12dce7559b050fb65cfe96657239c93f417b976fc1053a29640852cf9b9098b9225e641e2e14" name="vice" arch="i586">
  <version epoch="0" ver="3.4" rel="13.19"/>
</package>
<package pkgid="23454178dc202a9e6967ed87980f46a035e2f7a1bb8a563282aa8998ee869262550b74ac58a173c0f88ad1fd2d7033ff055ce9e0f2fad3bf5cb976e32dcf2fbb" name="vice" arch="src">
  <version epoch="0" ver="3.4" rel="13.19"/>
</package>
<package pkgid="13ff70680688e20ac88b1cbea48a3d8bd377306010c92144db107612ce8c56077994009958cc3584812b8e7739243c10755965eb968163b692def2dc266bfe8c" name="vice" arch="src">
  <version epoch="0" ver="3.5" rel="24.148"/>
  <changelog author="Karol S&#x142;awi&#x144;ski &lt;karol_slawinski@wp.pl&gt;" date="1585224000">* Changes in Vice 3.4
  =====================
  * * General
----------
- Remove support for Syllable OS, SCO, QNX4, QNX6, SGI, AIX, OpenStep/NextStep/
  Rhapsody, Solaris/OpenIndiana and remaining traces of Minix, NeXT, SKYOS,
  UNIXWARE, Sortix
- Remove remaining traces of support for WATCOM, MSVC, OpenWatcom
- Remove aRts support
- Remove YUV rendering
- Remove generation of .chm, .hlp and .info files. Please use the .pdf or .html
- skip building x64 unless --enable-x64 is passed to configure
- do not use the new/experimental 8580 filters unless --enable-new8580filter
  is passed to configure
- update pattern generator for uninitialized ram. changed defaults so all
  raminitpattern tests pass.
- remove block device disk image (rawdrive) "support". in linux it was never
  needed (just use the device file) and on windows it was never implemented.
- added support for the IP232 protocol that was used by the long lost VICE1.19
  hack, and which is supported by tcpser for emulating DTR/DCD (carrier detect)
- various userport rs232 fixes
- always save gifs as gif89
- added a couple shift flags to keyboard maps to support virtual cbm/ctrl and
  mandatory pressed host modifiers. not all keymaps have been updated yet.
- ACIA IRQ fix
- create empty half tracks when mounting d64. fixes skew.d64
- new headless port that can be enabled by passing --enable-headlessui to
  configure. this can be used to build an emulator without video output, which
  may be useful for scripting.
  * * Autostart fixes
- Implemented autostart for tapecart images (.tcrt)
- Automatically change drive type when autostarting disk images that do not
  work with the currently active drive.
- Make AutostartRunWithColon default
- fixed autostart when memory hacks are enabled (plus60k, plus256k, plus4)
- make auto-starting from tape also respect the 'basicload' option, loading
  absolute by default
- when using a disk image to autostart .prg files, remove the .prg extension
  from the temporary file name
- many detail fixes that make autostart work as expected in all emulators and
  in all configurations (eg C128 in 80 columns or C64 mode)
  * * Snapshot fixes
- More strict checking and more explizit error reporting
  * * 6510 fixes
-------------
- Accurate emulation of ANE#imm and LAX#imm "magic constant" dependency on RDY.
  All occurrences of unstable use are being logged now. LAX#imm "magic constant"
  changed to 0xEF, which makes the problem cases "spectipede" and "turrican 3"
  work.
- fix: reset should set the I flag
  * * VIC-II fixes
- Accurate emulation of the "VSP bug". Warnings about possible VSP related
  memory corruption are always logged, actual memory corruption is still
  optional.
- Fixed changing more than one colour register via monitor
  * * VIC fixes
------------
- new noise LFSR as reverse engineered by Lance Ewing.
  * * SID fixes
------------
- use model dependent floating output ttl values like in residfp
  * * Monitor
----------
- Support full expressions in the monitor conditional breakpoints.
- When deleting checkpoints, reset the index to 1 when there are no more
  checkpoints left
- Added 'RL' for rasterline and 'CY' for cycle in line to list of conditionals
  that can be used for breakpoints.
- in mc/ms commands show asterisk for 1s and dots for 0s, not the other way
  around
- adjust number of disassembled lines so the top line does not scroll out of
  the window when labels are used.
- Added "log" and "logname" commands to control logging to a file
  * * vdrive
---------
- added rudimentary support for CMD-style reading of the RTC
- respect error info in disk images (only when reading right now). Should trick
  some simple protections.
- report 65535 blocks free rather than 0 so that applications that query
  available disk space before saving work as expected, e.g. some BBSs
  * * C-64 fixes
-------------
- added support for MAX Basic cartridge, new CRTID 61
- added clockport device for rrnet mk3
- fixed reading of 'open' clockport, fixed io dump for clockport devices
- implemented support for cartridge hardware revision in the crt format
- When attaching an Easyflash cartridge image, replace the EAPI driver with the
  one for the flash chip VICE supports. This way EF images that contain a
  different driver (for whatever reason) will still work.
- various keymaps added and/or fixed/updated.
  * * C-128 fixes
- added proper C128D model type.
- various MMU fixes
- fixed broken memory mapping in C64 mode
- Completely rewritten VDC vertical handling code. VDC101 demo with it's
  vdc-split technique is now fully emulated. This rewrite attempts to emulate
  more how the VDC works internally, and how the video signal/screen react, so
  the border height etc is now more naturally handled.
- Various misc VDC fixes, e.g. show blank lines with certain register combinations
  * * Gtk3 UI
----------
- Implemented "restore display" (Alt+r). Resets the active window to its
  minimal/natural size. Handy when stretching the window and then not knowing
  you can make the window smaller again with resizing that same window until
  it doesn't get smaller.
- Change double-clicking images in smart/diskattach dialogs to 'open' instead
  of autostarting
- added options to select rendering backend and filter
- fixed opening files with UTF8 encoded filenames
- Make the (VTE) monitor display on top of the emulated machine window when in
  fullscreen
- copy only used icons into the distribution, which drastically reduced its size
- Added keyboard debugging to the statusbar
- Added * (all files) filter to the fliplist attach dialog. This will allow
  people to use Pi1541 *.lst files at their own peril.
- Add proper statusbar messages when using the fliplist.
- Add howto about creating a Gtk3-Windows cross-compiler on Debian with Fedora
  packages (aka FrankenVICE)
- only show the host keyboard mappings in the list for which we have a valid
  mapping, grey out symbolic/positional depending on what keymaps are actually
  available
- Move joystick settings to the joystick widget on the statusbar.
- Windows: add icons to binaries
- allow better control of the filter settings by removing tick marks
  of the sliders and adding spinboxes (6581+ReSID only)
- Fix the 'media recording' dialog to not show empty widgets when FFMPEG support
  is missing, show hint on compiling in FFMPEG instead.
  * * SDL fixes
------------
- make hotkeys only check left alt, which makes right alt (alt-gr) work in
  keyboard mappings.
  * * macOS fixes
- make open-gl work
- binary distributions, font support, GTK3 dock icon
- fix missing icon theme, fixed pdf manual generation, improved build
  instructions
- fixed macOS make bindist when building out of tree
- Added instructions for building and debugging using Xcode</changelog>
  <changelog author="Wolfgang Bauer &lt;wbauer@tmo.at&gt;" date="1587384000">- Set VICEDIR during compilation as well so that the programs
  actually find the data files
- Enable building "x64" for slower systems
- Don't use "install-strip" to fix the creation of debug packages
- Fix filelist
- Correct License tag
- Run %install_info(_delete) in %post/%postun
- Add missing pkgconfig(libswscale) BuildRequires to really enable
  ffmpeg support
- Add giflib-devel and libjpeg-devel BuildRequires to enable GIF
  and JPEG support
- Add libmp3lame-devel BuildRequires to enable MP3 encoding support
- Remove unused libSDL_sound-devel BuildRequires</changelog>
  <changelog author="Karol S&#x142;awi&#x144;ski &lt;karol_slawinski@wp.pl&gt;" date="1587729600">- Fix changes file text formating</changelog>
  <changelog author="Karol S&#x142;awi&#x144;ski &lt;karol_slawinski@wp.pl&gt;" date="1608984000">-- Changes in Vice 3.5
  =======================
  This release completes the transition to the new GTK3 based GUI and fixes a
  bunch of long standing issues (see below).
  We are looking for someone who can provide stable automatic nightly builds - for
  this will work best on a Windows machine, or perhaps a Fedora server. We tried
  our best to come up with a solution for Debian, but that didn't work out as
  intended. If you think you can help in this area - please get in touch.
  We welcome to the team:
  empathicqubit - who wrote the new remote monitor binary interface
  Roberto Muscedere aka OldWoman37 - who contributed the new Lt.Kernal, CMD-HD and
  RAMlink emulations (C64 only)
-- general
----------
- Remove explicit support for OS/2, AmigaOS. These platforms should be able to
  use the SDL port.
- VICE used to store its ROMs, keymaps etc into $PREFIX/lib[64]/vice, which
  isn't correct. Now VICE installs its data into $PREFIX/share/vice, which
  makes a lot more sense. The documentation location has changed as well, now
  the documentation is installed in $PREFIX/share/doc/vice.
  On Windows, the binaries and DLLs have been moved into /bin, according to the
  requirements of GTK/GDK.
- Emulator timing is now directly driven by the host system audio device.
  If sound emulation is disabled, timing is synchronized with the host clock.
  As part of this change, the choice of sound synchronization method has been
  removed.
- Emulation now occurs in blocks of time directly related to the sound fragment
  size. Previously, emulation of an entire frame happened as quickly as possible
  and then the host system would sleep until it is time to emulate the next
  entire frame. This means that user input is now visible to the emulated
  software with lower latency than before.
- Audio latency is much lower on all platforms, and new lower latency defaults
  have been set. Users are encouraged to try using smaller fragment sizes and
  experiment with finding the lowest stable buffer size on their system.
- Support for changing the emulator timing to target generating a specific number
  of video frames per second. Useful for smooth PAL scrolling on a 50Hz CRT, and
  also fun for playing games at 60fps to match a typical LCD screen refresh.
- The default behaviour on CPU JAM was changed to "continue" to better match
  the behaviour of the real machines. Additionally a "CPU JAM" message will
  be displayed in the status bar.
- A "quit emulator" option was added to the CPU JAM dialog
- The CPU JAM dialog now shows the number of the device whose CPU has crashed.
- Proper support for dual drives has been added
- Relative file support on the filesystem device
- Autostarting works from any drive (select the drive in the attach disk dialog)
- Added support for 2nd and 3rd joystick button (potx/poty), currently only via
  keyboard and via unix joystick driver.
- Added mapping for the THEC64 joystick
- New LT.Kernal emulation
- New CMD-HD emulation
- New CMD RAM-Link emulation
- New D9090/60 emulation
- New icons for the applications.
- We now use proper binary prefixes for memory sizes.
  Welcome in the 21st century!
- Recalculate the palette parameters when the videochip type changes, now we can
  actually see the subtle color differences :)
- Emulate a switch present on some compatible datasettes (not the Commodore
  ones). Turning the switch on makes the sound recorded on the tape audible.
- Fixed/improved "native" screenshots. It will now work with all videochips and
  always generate "best effort" results.
- The emulators will look for the config file at an alternative location first,
  before looking at the system wide location.
  - for windows that is the location of the .exe files
  - for Linux that is ~/.vicerc
- Fixed lightgun/pen emulation
  - use poty instead of potx for trigger for magnum lightphaser and inkwell
    lightpen
  - tweak lightphaser offset against a bunch of games
- Handling of settings and resources was improved a bit:
  - always reset resources to default before loading a settings file
  - new "-addconfig" option (or "load additional settings") loads additional
    resources from a file without resetting to defaults before. this can be used
    to keep custom setups separate from the regular settings.
- Fixed sysfile search path order.
  The order now is $HOME/.local -&gt; path-of-binary -&gt; VICE_DATADIR
- Fixed a bug in .tap file handling that caused some .tap files to not work in
  the preview widget(s)
- A bunch of files have been removed from the source tree because they didn't
  really belong there and/or contained outdated info:
  - hardware-sids.txt, the old info is now at
    https://vice-emu.pokefinder.org/index.php/Hardware_SID_Status
  - SDL-support.txt, the old info is now at
    https://vice-emu.pokefinder.org/index.php/SDL_Status
  - ffmpeg-support.txt, the old info is now at
    https://vice-emu.pokefinder.org/index.php/FFMPEG_Status
- Another bunch of files were removed because their content was hopelessly
  outdated and/or could be moved to other files:
  - removed ancient CHANGELOG files. Read NEWS for the recent changes. Refer to
    the SVN log for the gory details.
  - moved contents from FEEDBACK to README
  - removed INSTALL, AUTHORS, FEEDBACK
  - removed the MAN pages. Read the html or pdf manual instead.
-- build system
  Many changes and simplifications were made in the build system, to make
  it more reproducible and match the expected standard behaviour:
- Add --disable-optimization (default=no) to make the buildsystem use -O0 for
  debugging.
- 'make dist' no longer needs '--enable-static-ffmpeg' to generate a working
  tarball.
- Fixed support for the â€”disable-silent-rules/â€”enable-silent-rules configure
  arguments.
- Added --enable-sandbox-mode switch. This switch will tell GTK3 to use
  'native dialogs' so we can properly support Flatpak and similar containers.
- Added -â€”enable-cmake to automatically generate cmake CMakelists.txt files for
  in-tree configured builds. Generating Xcode projects works, and this may
  allow generation of MSVC project files in the future.
- Add --enable-desktop-files for creating and installing .desktop files on Unix.
- Added --enable/disable-html-docs
- Added --with/without-mpg123 (default=yes), makes MP3-decoding support optional
- Added --with/without-ogg-vorbis
- Added --with/without-flac (default=yes)
- Update --with[out]-lame, make no default
- Make jpeg and gif support default to no
- Make using libpng the default, fail unless explicitly disabled
- Make ALSA and Pulse default to enabled, make OSS default to disabled
- Make MIDI support disabled by default
- Make new 8580 filter default
- Removed --disable-hwscale, always check for OpenGL with GTK3, error out when
  - -disable-hwscale is used with SDL2
  Properly report missing tools to generate docs:
- Fail on missing pdftex when PDF docs requested
- Checks for makeinfo and texi2dvi (from the texinfo package) and warns in the
  configure output at the end if they are missing, but will still build VICE.
  Check presence of other tools instead of silently not using them:
- Made dos2unix mandatory to avoid surprises
- Fail if building for Windows and `icotool` is missing. It can be obtained by
  installing the `icoutils` package.
  Some features have been deprecated and are now disabled by default:
- Added --enable-x64-image option to enable X64 image support, which is now
  disabled by default.
- Added --with/without-fastsid switch to enable/disable the fastSID engine
  (default is off).
  * * Monitor
----------
- Completely new binary remote protocol for debuggers. The older hack was
  removed - see the documentation for details.
- -moncommands finally work as originally intended and supports all monitor
  commands now. That means there are subtle differences in how certain things
  work. one important thing is that by default it will use an initial break
  point just after "reset".
- "-initbreak ready" can be used to place an initial wait for "ready", like
  autostart does, or "-initbreak reset" to break just after reset.
  For more details, read the documentation.
- â€˜stopâ€™ is no more ending up in recorded monitor command playback files
- Support `cd ~` to change cwd to $HOME
- Added 'mkdir' command
- Aadded 'rmdir' command
- Aadded "verify" and "bverify" commands to compare memory with a file
- Aadded optional address to the `screen` command
- `chis` shows the cycle count as well now
- Aadded option to configure the number of lines used for chis
- Aadded option to change the size of the scrollback buffer
- Added "dummy" command to enable or disable whether break- and watchpoints
  trigger at dummy accesses or not.
- Check watchpoints in the order they were added, that makes the output in the
  monitor less confusing when more than one watchpoint triggers at a time
- Show rasterline and cycle in both decimal and hex
- Add 'q' as a shorthand for 'quit'
- Improvements to the char/sprite display - use # over * for more contrast,
  show the memory value(s) alongside binary view and fix bug showing multiple
  sprites
- "list", "load" and "save" do now work with the filesystem device
- Drive numbers are now expected to be decimal
- Add monitor dump function to m6821 core
- Added info on head position/status to VIA io dump
- The display now (optionally) refreshes after each monitor command. this is not
  cycle exact right now (only per scanline).
- Fixed accessing cartridge memory
- Improve expansion port mode status output
- Fix io command to shows IO space in address order
-- vdrive
---------
- The filesystem device now uses shortened filenames by default to increase
  compatibility.
- Disallow to silently overwrite existing files (optional, default is "no")
- Implemented "save @" to overwrite files (but do not simulate the well known
  related bugs)
- Basic support for REL files in the File System Device. (Using P00 format, or
  rather R00, is recommended)
- Fix some BAM track allocation issues in 8050/8250 disk images
- Avoid DISK FULL with 27 blocks free on .D80 / .D82.
- For D80/D82 images, when reading the directory, use the correct block to fetch
  the disk's name from. This corrects a bad disk name in directory listings when
  using a vdrive.
- Added proper creation of d1m, d2m and d4m images, the resulting image has 1
  native partition spanning the entire disk.
- When formatting or validating an 8050 or 8250 image, the header sector wasn't
  flagged as allocated. This resulted in VICE hanging when creating more than 80
  files on the disk.
-- True drive emulation
- More realistic modelling of the floppy drive wobble
- Changed lower limit for drive RPM to 260 and upper limit to 340 (ie +/- 40).
  This is slightly more than possible with a real 1541.
-- CPU fixes
------------
- Prevent IRQ/NMI from being served by the CPU when it has JAMed
- Perform all "dummy" accesses also in the non "sc" core
- Changed magic constant for LAX#imm to 0xEE as required(!) by wizball
-- VDC fixes
------------
- Emulate VDC's internal buffer, issues with RFOVDC plasma part are fixed
- Several fixes for interlace, now vdcmodemania interlace parts all work and
  soci VDC test #5 works
- Improved VDC-FLI handling, 3 byte attribute offset doesn't always apply,
  fixes vdc-mcm demo and vdcmodemania fli part
- Fix issue with wrap around of VDC ram affecting vdcmodemania fli part
- Fixed VDC reg #28 bit #4, it sets the addressing mode, it does not actually
  reflect the amount of ram installed.
- Correct aspect ratio for PAL or NTSC
- Screen is resized automatically on PAL/NTSC change
- Corrected size of saved screenshots or videos
- Correct handling of unused bits in some registers
- Corrections and enhancements to monitor "io d600" dump
-- SID fixes
------------
- Fixed the filter saturation
- Noise writeback fixes
- Envelope regression fix
- Fix the coefficients for the resid external filter
- Rough implementation of the shift register and waveform zero bitfade
- Added 4 possible additional SID chips for a total of 8 (x64*/xscpu64/x128 only)
-- C64 fixes
------------
- Enable/disable datasette/tapecart as needed on autostart
- Several new cartridge types added:
  - The 'ZIPP-CODE 48' cartridge
  - The polish 'blackbox v8' cartridge
  - The polish 'Blackbox V3' cartridge
  - The polish 'Blackbox V4' cartridge
  - The polish 'Blackbox V9' cartridge
  - The 'REX RAM-Floppy' cartridge
  - The czech 'BIS-Plus' cartridges (2,4,8kb variants)
  - The polish 'SD-BOX' cartridge
  - The 'MultiMAX' cartridge
  - The argentinian HERO bootleg cartridge
  - The "GMod3" cartridge
- Action Replay fixes:
  - When reading from IO1 area when AR5 is enabled, the value currently on the
    bus will get written to the register, causing the famous bug/crash
  - Handle the broken mode 0x22 and emit a warning on potentially problematic
    reads
- Retroreplay fixes:
  - Allow reading back the status of the freeze button
  - Fix reads from IO1 when the clockport is not active.
  - Handle the somewhat broken mode 0x22 like on real retro replay
- Nordic Power fixes:
  - Fix writing to cartridge ram in mode 0x22
-- C128 fixes
-------------
- FD2000/4000 work again, including burst mode
-- VIC20 fixes
- Added handling for 32k cartridge files that contain blocks 1,2,3 and 5.
- Fixed megacart nvram addressing
- External audio filter fix
-- PET fixes
------------
- Teach VICE where BASIC 1 keeps the current screen line address, so that
  Autostart works.
- Made the UK business keyboard the default and moved it to the top of the list
  of keyboards. This makes the default setup work with the keymaps and editor
  ROM we have in VICE.
- For CRTC-less PETs, use screen setup values that work out to 60 Hz refresh.
- Tuned the display timing values for non-CRTC PETs
- Renamed PET ROMs to include their part number (in line with Zimmers). This
  should make it more clear which editor ROMs exist.
- The 4032B model used a wrong Editor ROM
-- SDL fixes
------------
- Implemented mouse pointer auto-hiding
- Remember last position in the main menu
- Several Keyboard mapping fixes:
  - Fix (some) plus4 keymaps
  - Some pet keymap fixes
  - Updated/fixed symbolic mapping for italian keyboard
  - Some tweaks to symbolic keymap for german layout (plus4)
  - Added keymap from/for BMC64 (c64)
-- GTK3 fixes
-------------
- Almost all causes of stuttering / audio glitches when interacting with the UI
  have been resolved.
- Cairo is completely gone, all major platforms use their native rendering
  backend
- Added hotkey "pause" to generate a screenshot from current canvas using a
  generated filename in the current working directory
- Rearranged cartridge/io settings around a bit. not perfect yet, but probably
  better than before
- Add optional hiding of VDC display
- Make double-clicking on the emulated screen switch fullscreen mode
- Alt+Enter will now also toggle fullscreen mode
- Added option to pause the emulation when settings dialog is open
- Remember not only the last directory but also the last file in file dialogs
- Show "Use Alt+M to disable mouse grab" in window title if mouse grab is
  active
- Support 'StartMinimized'/-minimized
- Added 'restore window geometry' to UI and commandline to allow users to apply/
  ignore the last position/size of the window(s) stored in vicerc/vice.ini.
- Allow for 8 'analog' controllers on Linux
- Added Alt+Shift+F12 VICII to switch border mode in x64sc
- Moved the netplay settings from the 'File' menu to the settings dialog
- Added 'Host' root node in the settings UI, move Autostart, Monitor, Netplay,
  Snapshot/Event/Media recording directory and start-mode under that.
- Also move Host-&gt;Machine settings (CWD and JAM-action) under Host, remove the
  Host-&gt;Machine node.
- Use workaround for GTKFileChooser's "Select" button not being active when
  selecting/creating a directory.
- Several Keyboard mapping fixes:
  - Added keymaps for THE64 keyboard
  - Updated keymaps for pet graphical keyboard
  - Fix shift+z/y in german positional mapping (c64)
  - Some tweaks to symbolic keymap for german layout (plus4)
  - Some tweaks to symbolic keymap for german layout (c64)
  - Fix (some) plus4 keymaps
  - Added positional keymap for Swedish keyboard
  - Fix ctrl and cbm mapping (c128)
-- macOS fixes
- VICE GTK performance on macOS is now excellent and we finally now recommend
  the GTK build over the SDL build.
- macOS bindist now relies on macports rather than homebrew. With macports itâ€™s
  possible to build deps from source while targeting an older macOS version,
  which allows us to continue to support macOS 10.9+.
- Re-enabled the bafflingly disabled working macOS joystick code
- Actual macOS game controller device names are now listed instead of 6x â€œAnalog
  joystick nâ€
-- c1541 fixes
- Added some REL file support
  - support for REL files to the c1541 COPY subcommand
- Add subcommand to show dir entry of a file, and all side sectors.
- Add support for SEQ and USR files for the -extract command
- Renamed `zcreate` command to `unzip`. 'unzip' (dissolve a zipcode archive)
  sounds more logical than 'zcreate'. When we decide to also support creating
  zipcode archives, a proper name for that could be 'zip' or 'zipcode'.
-- petcat fixes
- Added missing basic v4 tokens for cbmII</changelog>
  <changelog author="Karol S&#x142;awi&#x144;ski &lt;karol_slawinski@wp.pl&gt;" date="1609243200">- Adding support for libieee1284
- Adding libmpg123 and yasm to build process</changelog>
  <changelog author="Wolfgang Bauer &lt;wbauer@tmo.at&gt;" date="1610452800">- Explicitly enable fastsid, x64-image, mp3, flac, gif, jpeg,
  vorbis and midi support, these are disabled by default now
- No longer necessary to set VICE_DIR, it defaults to
  /usr/share/vice/ on Linux now
- Remove duplicate libmpg123 BuildRequires again
- Remove yasm BuildRequires again, it's not used
- Remove unnecessary dependencies related to the info files (which
  are not built/installed anymore)
- Remove some other BuildRequires too that are not needed/used
  anymore
- Add NEWS and COPYING
- Install docs to %{_docdir} instead of %{_datadir}/doc/</changelog>
</package>
<package pkgid="09c2add8529c10495e06814cbf9dad5b431f3063356ed211ab9d901beeefc385c3f687e8ee64e747288014bf1f1947af7c8d13fc9e2e058e58b4895200044fcc" name="vice" arch="x86_64">
  <version epoch="0" ver="3.5" rel="24.148"/>
  <changelog author="Karol S&#x142;awi&#x144;ski &lt;karol_slawinski@wp.pl&gt;" date="1585224000">* Changes in Vice 3.4
  =====================
  * * General
----------
- Remove support for Syllable OS, SCO, QNX4, QNX6, SGI, AIX, OpenStep/NextStep/
  Rhapsody, Solaris/OpenIndiana and remaining traces of Minix, NeXT, SKYOS,
  UNIXWARE, Sortix
- Remove remaining traces of support for WATCOM, MSVC, OpenWatcom
- Remove aRts support
- Remove YUV rendering
- Remove generation of .chm, .hlp and .info files. Please use the .pdf or .html
- skip building x64 unless --enable-x64 is passed to configure
- do not use the new/experimental 8580 filters unless --enable-new8580filter
  is passed to configure
- update pattern generator for uninitialized ram. changed defaults so all
  raminitpattern tests pass.
- remove block device disk image (rawdrive) "support". in linux it was never
  needed (just use the device file) and on windows it was never implemented.
- added support for the IP232 protocol that was used by the long lost VICE1.19
  hack, and which is supported by tcpser for emulating DTR/DCD (carrier detect)
- various userport rs232 fixes
- always save gifs as gif89
- added a couple shift flags to keyboard maps to support virtual cbm/ctrl and
  mandatory pressed host modifiers. not all keymaps have been updated yet.
- ACIA IRQ fix
- create empty half tracks when mounting d64. fixes skew.d64
- new headless port that can be enabled by passing --enable-headlessui to
  configure. this can be used to build an emulator without video output, which
  may be useful for scripting.
  * * Autostart fixes
- Implemented autostart for tapecart images (.tcrt)
- Automatically change drive type when autostarting disk images that do not
  work with the currently active drive.
- Make AutostartRunWithColon default
- fixed autostart when memory hacks are enabled (plus60k, plus256k, plus4)
- make auto-starting from tape also respect the 'basicload' option, loading
  absolute by default
- when using a disk image to autostart .prg files, remove the .prg extension
  from the temporary file name
- many detail fixes that make autostart work as expected in all emulators and
  in all configurations (eg C128 in 80 columns or C64 mode)
  * * Snapshot fixes
- More strict checking and more explizit error reporting
  * * 6510 fixes
-------------
- Accurate emulation of ANE#imm and LAX#imm "magic constant" dependency on RDY.
  All occurrences of unstable use are being logged now. LAX#imm "magic constant"
  changed to 0xEF, which makes the problem cases "spectipede" and "turrican 3"
  work.
- fix: reset should set the I flag
  * * VIC-II fixes
- Accurate emulation of the "VSP bug". Warnings about possible VSP related
  memory corruption are always logged, actual memory corruption is still
  optional.
- Fixed changing more than one colour register via monitor
  * * VIC fixes
------------
- new noise LFSR as reverse engineered by Lance Ewing.
  * * SID fixes
------------
- use model dependent floating output ttl values like in residfp
  * * Monitor
----------
- Support full expressions in the monitor conditional breakpoints.
- When deleting checkpoints, reset the index to 1 when there are no more
  checkpoints left
- Added 'RL' for rasterline and 'CY' for cycle in line to list of conditionals
  that can be used for breakpoints.
- in mc/ms commands show asterisk for 1s and dots for 0s, not the other way
  around
- adjust number of disassembled lines so the top line does not scroll out of
  the window when labels are used.
- Added "log" and "logname" commands to control logging to a file
  * * vdrive
---------
- added rudimentary support for CMD-style reading of the RTC
- respect error info in disk images (only when reading right now). Should trick
  some simple protections.
- report 65535 blocks free rather than 0 so that applications that query
  available disk space before saving work as expected, e.g. some BBSs
  * * C-64 fixes
-------------
- added support for MAX Basic cartridge, new CRTID 61
- added clockport device for rrnet mk3
- fixed reading of 'open' clockport, fixed io dump for clockport devices
- implemented support for cartridge hardware revision in the crt format
- When attaching an Easyflash cartridge image, replace the EAPI driver with the
  one for the flash chip VICE supports. This way EF images that contain a
  different driver (for whatever reason) will still work.
- various keymaps added and/or fixed/updated.
  * * C-128 fixes
- added proper C128D model type.
- various MMU fixes
- fixed broken memory mapping in C64 mode
- Completely rewritten VDC vertical handling code. VDC101 demo with it's
  vdc-split technique is now fully emulated. This rewrite attempts to emulate
  more how the VDC works internally, and how the video signal/screen react, so
  the border height etc is now more naturally handled.
- Various misc VDC fixes, e.g. show blank lines with certain register combinations
  * * Gtk3 UI
----------
- Implemented "restore display" (Alt+r). Resets the active window to its
  minimal/natural size. Handy when stretching the window and then not knowing
  you can make the window smaller again with resizing that same window until
  it doesn't get smaller.
- Change double-clicking images in smart/diskattach dialogs to 'open' instead
  of autostarting
- added options to select rendering backend and filter
- fixed opening files with UTF8 encoded filenames
- Make the (VTE) monitor display on top of the emulated machine window when in
  fullscreen
- copy only used icons into the distribution, which drastically reduced its size
- Added keyboard debugging to the statusbar
- Added * (all files) filter to the fliplist attach dialog. This will allow
  people to use Pi1541 *.lst files at their own peril.
- Add proper statusbar messages when using the fliplist.
- Add howto about creating a Gtk3-Windows cross-compiler on Debian with Fedora
  packages (aka FrankenVICE)
- only show the host keyboard mappings in the list for which we have a valid
  mapping, grey out symbolic/positional depending on what keymaps are actually
  available
- Move joystick settings to the joystick widget on the statusbar.
- Windows: add icons to binaries
- allow better control of the filter settings by removing tick marks
  of the sliders and adding spinboxes (6581+ReSID only)
- Fix the 'media recording' dialog to not show empty widgets when FFMPEG support
  is missing, show hint on compiling in FFMPEG instead.
  * * SDL fixes
------------
- make hotkeys only check left alt, which makes right alt (alt-gr) work in
  keyboard mappings.
  * * macOS fixes
- make open-gl work
- binary distributions, font support, GTK3 dock icon
- fix missing icon theme, fixed pdf manual generation, improved build
  instructions
- fixed macOS make bindist when building out of tree
- Added instructions for building and debugging using Xcode</changelog>
  <changelog author="Wolfgang Bauer &lt;wbauer@tmo.at&gt;" date="1587384000">- Set VICEDIR during compilation as well so that the programs
  actually find the data files
- Enable building "x64" for slower systems
- Don't use "install-strip" to fix the creation of debug packages
- Fix filelist
- Correct License tag
- Run %install_info(_delete) in %post/%postun
- Add missing pkgconfig(libswscale) BuildRequires to really enable
  ffmpeg support
- Add giflib-devel and libjpeg-devel BuildRequires to enable GIF
  and JPEG support
- Add libmp3lame-devel BuildRequires to enable MP3 encoding support
- Remove unused libSDL_sound-devel BuildRequires</changelog>
  <changelog author="Karol S&#x142;awi&#x144;ski &lt;karol_slawinski@wp.pl&gt;" date="1587729600">- Fix changes file text formating</changelog>
  <changelog author="Karol S&#x142;awi&#x144;ski &lt;karol_slawinski@wp.pl&gt;" date="1608984000">-- Changes in Vice 3.5
  =======================
  This release completes the transition to the new GTK3 based GUI and fixes a
  bunch of long standing issues (see below).
  We are looking for someone who can provide stable automatic nightly builds - for
  this will work best on a Windows machine, or perhaps a Fedora server. We tried
  our best to come up with a solution for Debian, but that didn't work out as
  intended. If you think you can help in this area - please get in touch.
  We welcome to the team:
  empathicqubit - who wrote the new remote monitor binary interface
  Roberto Muscedere aka OldWoman37 - who contributed the new Lt.Kernal, CMD-HD and
  RAMlink emulations (C64 only)
-- general
----------
- Remove explicit support for OS/2, AmigaOS. These platforms should be able to
  use the SDL port.
- VICE used to store its ROMs, keymaps etc into $PREFIX/lib[64]/vice, which
  isn't correct. Now VICE installs its data into $PREFIX/share/vice, which
  makes a lot more sense. The documentation location has changed as well, now
  the documentation is installed in $PREFIX/share/doc/vice.
  On Windows, the binaries and DLLs have been moved into /bin, according to the
  requirements of GTK/GDK.
- Emulator timing is now directly driven by the host system audio device.
  If sound emulation is disabled, timing is synchronized with the host clock.
  As part of this change, the choice of sound synchronization method has been
  removed.
- Emulation now occurs in blocks of time directly related to the sound fragment
  size. Previously, emulation of an entire frame happened as quickly as possible
  and then the host system would sleep until it is time to emulate the next
  entire frame. This means that user input is now visible to the emulated
  software with lower latency than before.
- Audio latency is much lower on all platforms, and new lower latency defaults
  have been set. Users are encouraged to try using smaller fragment sizes and
  experiment with finding the lowest stable buffer size on their system.
- Support for changing the emulator timing to target generating a specific number
  of video frames per second. Useful for smooth PAL scrolling on a 50Hz CRT, and
  also fun for playing games at 60fps to match a typical LCD screen refresh.
- The default behaviour on CPU JAM was changed to "continue" to better match
  the behaviour of the real machines. Additionally a "CPU JAM" message will
  be displayed in the status bar.
- A "quit emulator" option was added to the CPU JAM dialog
- The CPU JAM dialog now shows the number of the device whose CPU has crashed.
- Proper support for dual drives has been added
- Relative file support on the filesystem device
- Autostarting works from any drive (select the drive in the attach disk dialog)
- Added support for 2nd and 3rd joystick button (potx/poty), currently only via
  keyboard and via unix joystick driver.
- Added mapping for the THEC64 joystick
- New LT.Kernal emulation
- New CMD-HD emulation
- New CMD RAM-Link emulation
- New D9090/60 emulation
- New icons for the applications.
- We now use proper binary prefixes for memory sizes.
  Welcome in the 21st century!
- Recalculate the palette parameters when the videochip type changes, now we can
  actually see the subtle color differences :)
- Emulate a switch present on some compatible datasettes (not the Commodore
  ones). Turning the switch on makes the sound recorded on the tape audible.
- Fixed/improved "native" screenshots. It will now work with all videochips and
  always generate "best effort" results.
- The emulators will look for the config file at an alternative location first,
  before looking at the system wide location.
  - for windows that is the location of the .exe files
  - for Linux that is ~/.vicerc
- Fixed lightgun/pen emulation
  - use poty instead of potx for trigger for magnum lightphaser and inkwell
    lightpen
  - tweak lightphaser offset against a bunch of games
- Handling of settings and resources was improved a bit:
  - always reset resources to default before loading a settings file
  - new "-addconfig" option (or "load additional settings") loads additional
    resources from a file without resetting to defaults before. this can be used
    to keep custom setups separate from the regular settings.
- Fixed sysfile search path order.
  The order now is $HOME/.local -&gt; path-of-binary -&gt; VICE_DATADIR
- Fixed a bug in .tap file handling that caused some .tap files to not work in
  the preview widget(s)
- A bunch of files have been removed from the source tree because they didn't
  really belong there and/or contained outdated info:
  - hardware-sids.txt, the old info is now at
    https://vice-emu.pokefinder.org/index.php/Hardware_SID_Status
  - SDL-support.txt, the old info is now at
    https://vice-emu.pokefinder.org/index.php/SDL_Status
  - ffmpeg-support.txt, the old info is now at
    https://vice-emu.pokefinder.org/index.php/FFMPEG_Status
- Another bunch of files were removed because their content was hopelessly
  outdated and/or could be moved to other files:
  - removed ancient CHANGELOG files. Read NEWS for the recent changes. Refer to
    the SVN log for the gory details.
  - moved contents from FEEDBACK to README
  - removed INSTALL, AUTHORS, FEEDBACK
  - removed the MAN pages. Read the html or pdf manual instead.
-- build system
  Many changes and simplifications were made in the build system, to make
  it more reproducible and match the expected standard behaviour:
- Add --disable-optimization (default=no) to make the buildsystem use -O0 for
  debugging.
- 'make dist' no longer needs '--enable-static-ffmpeg' to generate a working
  tarball.
- Fixed support for the â€”disable-silent-rules/â€”enable-silent-rules configure
  arguments.
- Added --enable-sandbox-mode switch. This switch will tell GTK3 to use
  'native dialogs' so we can properly support Flatpak and similar containers.
- Added -â€”enable-cmake to automatically generate cmake CMakelists.txt files for
  in-tree configured builds. Generating Xcode projects works, and this may
  allow generation of MSVC project files in the future.
- Add --enable-desktop-files for creating and installing .desktop files on Unix.
- Added --enable/disable-html-docs
- Added --with/without-mpg123 (default=yes), makes MP3-decoding support optional
- Added --with/without-ogg-vorbis
- Added --with/without-flac (default=yes)
- Update --with[out]-lame, make no default
- Make jpeg and gif support default to no
- Make using libpng the default, fail unless explicitly disabled
- Make ALSA and Pulse default to enabled, make OSS default to disabled
- Make MIDI support disabled by default
- Make new 8580 filter default
- Removed --disable-hwscale, always check for OpenGL with GTK3, error out when
  - -disable-hwscale is used with SDL2
  Properly report missing tools to generate docs:
- Fail on missing pdftex when PDF docs requested
- Checks for makeinfo and texi2dvi (from the texinfo package) and warns in the
  configure output at the end if they are missing, but will still build VICE.
  Check presence of other tools instead of silently not using them:
- Made dos2unix mandatory to avoid surprises
- Fail if building for Windows and `icotool` is missing. It can be obtained by
  installing the `icoutils` package.
  Some features have been deprecated and are now disabled by default:
- Added --enable-x64-image option to enable X64 image support, which is now
  disabled by default.
- Added --with/without-fastsid switch to enable/disable the fastSID engine
  (default is off).
  * * Monitor
----------
- Completely new binary remote protocol for debuggers. The older hack was
  removed - see the documentation for details.
- -moncommands finally work as originally intended and supports all monitor
  commands now. That means there are subtle differences in how certain things
  work. one important thing is that by default it will use an initial break
  point just after "reset".
- "-initbreak ready" can be used to place an initial wait for "ready", like
  autostart does, or "-initbreak reset" to break just after reset.
  For more details, read the documentation.
- â€˜stopâ€™ is no more ending up in recorded monitor command playback files
- Support `cd ~` to change cwd to $HOME
- Added 'mkdir' command
- Aadded 'rmdir' command
- Aadded "verify" and "bverify" commands to compare memory with a file
- Aadded optional address to the `screen` command
- `chis` shows the cycle count as well now
- Aadded option to configure the number of lines used for chis
- Aadded option to change the size of the scrollback buffer
- Added "dummy" command to enable or disable whether break- and watchpoints
  trigger at dummy accesses or not.
- Check watchpoints in the order they were added, that makes the output in the
  monitor less confusing when more than one watchpoint triggers at a time
- Show rasterline and cycle in both decimal and hex
- Add 'q' as a shorthand for 'quit'
- Improvements to the char/sprite display - use # over * for more contrast,
  show the memory value(s) alongside binary view and fix bug showing multiple
  sprites
- "list", "load" and "save" do now work with the filesystem device
- Drive numbers are now expected to be decimal
- Add monitor dump function to m6821 core
- Added info on head position/status to VIA io dump
- The display now (optionally) refreshes after each monitor command. this is not
  cycle exact right now (only per scanline).
- Fixed accessing cartridge memory
- Improve expansion port mode status output
- Fix io command to shows IO space in address order
-- vdrive
---------
- The filesystem device now uses shortened filenames by default to increase
  compatibility.
- Disallow to silently overwrite existing files (optional, default is "no")
- Implemented "save @" to overwrite files (but do not simulate the well known
  related bugs)
- Basic support for REL files in the File System Device. (Using P00 format, or
  rather R00, is recommended)
- Fix some BAM track allocation issues in 8050/8250 disk images
- Avoid DISK FULL with 27 blocks free on .D80 / .D82.
- For D80/D82 images, when reading the directory, use the correct block to fetch
  the disk's name from. This corrects a bad disk name in directory listings when
  using a vdrive.
- Added proper creation of d1m, d2m and d4m images, the resulting image has 1
  native partition spanning the entire disk.
- When formatting or validating an 8050 or 8250 image, the header sector wasn't
  flagged as allocated. This resulted in VICE hanging when creating more than 80
  files on the disk.
-- True drive emulation
- More realistic modelling of the floppy drive wobble
- Changed lower limit for drive RPM to 260 and upper limit to 340 (ie +/- 40).
  This is slightly more than possible with a real 1541.
-- CPU fixes
------------
- Prevent IRQ/NMI from being served by the CPU when it has JAMed
- Perform all "dummy" accesses also in the non "sc" core
- Changed magic constant for LAX#imm to 0xEE as required(!) by wizball
-- VDC fixes
------------
- Emulate VDC's internal buffer, issues with RFOVDC plasma part are fixed
- Several fixes for interlace, now vdcmodemania interlace parts all work and
  soci VDC test #5 works
- Improved VDC-FLI handling, 3 byte attribute offset doesn't always apply,
  fixes vdc-mcm demo and vdcmodemania fli part
- Fix issue with wrap around of VDC ram affecting vdcmodemania fli part
- Fixed VDC reg #28 bit #4, it sets the addressing mode, it does not actually
  reflect the amount of ram installed.
- Correct aspect ratio for PAL or NTSC
- Screen is resized automatically on PAL/NTSC change
- Corrected size of saved screenshots or videos
- Correct handling of unused bits in some registers
- Corrections and enhancements to monitor "io d600" dump
-- SID fixes
------------
- Fixed the filter saturation
- Noise writeback fixes
- Envelope regression fix
- Fix the coefficients for the resid external filter
- Rough implementation of the shift register and waveform zero bitfade
- Added 4 possible additional SID chips for a total of 8 (x64*/xscpu64/x128 only)
-- C64 fixes
------------
- Enable/disable datasette/tapecart as needed on autostart
- Several new cartridge types added:
  - The 'ZIPP-CODE 48' cartridge
  - The polish 'blackbox v8' cartridge
  - The polish 'Blackbox V3' cartridge
  - The polish 'Blackbox V4' cartridge
  - The polish 'Blackbox V9' cartridge
  - The 'REX RAM-Floppy' cartridge
  - The czech 'BIS-Plus' cartridges (2,4,8kb variants)
  - The polish 'SD-BOX' cartridge
  - The 'MultiMAX' cartridge
  - The argentinian HERO bootleg cartridge
  - The "GMod3" cartridge
- Action Replay fixes:
  - When reading from IO1 area when AR5 is enabled, the value currently on the
    bus will get written to the register, causing the famous bug/crash
  - Handle the broken mode 0x22 and emit a warning on potentially problematic
    reads
- Retroreplay fixes:
  - Allow reading back the status of the freeze button
  - Fix reads from IO1 when the clockport is not active.
  - Handle the somewhat broken mode 0x22 like on real retro replay
- Nordic Power fixes:
  - Fix writing to cartridge ram in mode 0x22
-- C128 fixes
-------------
- FD2000/4000 work again, including burst mode
-- VIC20 fixes
- Added handling for 32k cartridge files that contain blocks 1,2,3 and 5.
- Fixed megacart nvram addressing
- External audio filter fix
-- PET fixes
------------
- Teach VICE where BASIC 1 keeps the current screen line address, so that
  Autostart works.
- Made the UK business keyboard the default and moved it to the top of the list
  of keyboards. This makes the default setup work with the keymaps and editor
  ROM we have in VICE.
- For CRTC-less PETs, use screen setup values that work out to 60 Hz refresh.
- Tuned the display timing values for non-CRTC PETs
- Renamed PET ROMs to include their part number (in line with Zimmers). This
  should make it more clear which editor ROMs exist.
- The 4032B model used a wrong Editor ROM
-- SDL fixes
------------
- Implemented mouse pointer auto-hiding
- Remember last position in the main menu
- Several Keyboard mapping fixes:
  - Fix (some) plus4 keymaps
  - Some pet keymap fixes
  - Updated/fixed symbolic mapping for italian keyboard
  - Some tweaks to symbolic keymap for german layout (plus4)
  - Added keymap from/for BMC64 (c64)
-- GTK3 fixes
-------------
- Almost all causes of stuttering / audio glitches when interacting with the UI
  have been resolved.
- Cairo is completely gone, all major platforms use their native rendering
  backend
- Added hotkey "pause" to generate a screenshot from current canvas using a
  generated filename in the current working directory
- Rearranged cartridge/io settings around a bit. not perfect yet, but probably
  better than before
- Add optional hiding of VDC display
- Make double-clicking on the emulated screen switch fullscreen mode
- Alt+Enter will now also toggle fullscreen mode
- Added option to pause the emulation when settings dialog is open
- Remember not only the last directory but also the last file in file dialogs
- Show "Use Alt+M to disable mouse grab" in window title if mouse grab is
  active
- Support 'StartMinimized'/-minimized
- Added 'restore window geometry' to UI and commandline to allow users to apply/
  ignore the last position/size of the window(s) stored in vicerc/vice.ini.
- Allow for 8 'analog' controllers on Linux
- Added Alt+Shift+F12 VICII to switch border mode in x64sc
- Moved the netplay settings from the 'File' menu to the settings dialog
- Added 'Host' root node in the settings UI, move Autostart, Monitor, Netplay,
  Snapshot/Event/Media recording directory and start-mode under that.
- Also move Host-&gt;Machine settings (CWD and JAM-action) under Host, remove the
  Host-&gt;Machine node.
- Use workaround for GTKFileChooser's "Select" button not being active when
  selecting/creating a directory.
- Several Keyboard mapping fixes:
  - Added keymaps for THE64 keyboard
  - Updated keymaps for pet graphical keyboard
  - Fix shift+z/y in german positional mapping (c64)
  - Some tweaks to symbolic keymap for german layout (plus4)
  - Some tweaks to symbolic keymap for german layout (c64)
  - Fix (some) plus4 keymaps
  - Added positional keymap for Swedish keyboard
  - Fix ctrl and cbm mapping (c128)
-- macOS fixes
- VICE GTK performance on macOS is now excellent and we finally now recommend
  the GTK build over the SDL build.
- macOS bindist now relies on macports rather than homebrew. With macports itâ€™s
  possible to build deps from source while targeting an older macOS version,
  which allows us to continue to support macOS 10.9+.
- Re-enabled the bafflingly disabled working macOS joystick code
- Actual macOS game controller device names are now listed instead of 6x â€œAnalog
  joystick nâ€
-- c1541 fixes
- Added some REL file support
  - support for REL files to the c1541 COPY subcommand
- Add subcommand to show dir entry of a file, and all side sectors.
- Add support for SEQ and USR files for the -extract command
- Renamed `zcreate` command to `unzip`. 'unzip' (dissolve a zipcode archive)
  sounds more logical than 'zcreate'. When we decide to also support creating
  zipcode archives, a proper name for that could be 'zip' or 'zipcode'.
-- petcat fixes
- Added missing basic v4 tokens for cbmII</changelog>
  <changelog author="Karol S&#x142;awi&#x144;ski &lt;karol_slawinski@wp.pl&gt;" date="1609243200">- Adding support for libieee1284
- Adding libmpg123 and yasm to build process</changelog>
  <changelog author="Wolfgang Bauer &lt;wbauer@tmo.at&gt;" date="1610452800">- Explicitly enable fastsid, x64-image, mp3, flac, gif, jpeg,
  vorbis and midi support, these are disabled by default now
- No longer necessary to set VICE_DIR, it defaults to
  /usr/share/vice/ on Linux now
- Remove duplicate libmpg123 BuildRequires again
- Remove yasm BuildRequires again, it's not used
- Remove unnecessary dependencies related to the info files (which
  are not built/installed anymore)
- Remove some other BuildRequires too that are not needed/used
  anymore
- Add NEWS and COPYING
- Install docs to %{_docdir} instead of %{_datadir}/doc/</changelog>
</package>
<package pkgid="8a88aab2134b31ef8c935a83412a911aa98ce568ccad0540487362af5ea094b5e6eee039c2b47dcfd8ca54ae9fe2be82b8e20c8501c694bd1c790b269705dc04" name="vice-gtk" arch="i586">
  <version epoch="0" ver="3.4" rel="13.19"/>
</package>
<package pkgid="3ec23b8d2a41fb2ac9100173354273e8143bc5b0eaf484b89c3ad2b44388b8c4a30fefa315b806bbeda2cd430c5b8d4966a18c57f8e7c1c9c140e12e258b3a0d" name="xa65" arch="i586">
  <version epoch="0" ver="2.3.11" rel="8.62"/>
  <changelog author="Sauerlandlinux@gmx.de" date="1537617600">- Initial release</changelog>
</package>
<package pkgid="f47a5c8e24ee3c82329db99f5c58b3279dbea2d99d5f44d38e6fe187f9015e4d5b1348afa3db9af4be4403366ea02c0f385d105755c0c98972048eabd5b54d67" name="xa65" arch="src">
  <version epoch="0" ver="2.3.11" rel="8.62"/>
  <changelog author="Sauerlandlinux@gmx.de" date="1537617600">- Initial release</changelog>
</package>
<package pkgid="686c0b01412e6746c7d433a235e4e82758d6fd07a4007cd470b86b79880d0ac1a7c0d842691c58b6173fd6f794716a20dfaa9f8f9d6bb964cae2033d2d2214b9" name="xa65" arch="x86_64">
  <version epoch="0" ver="2.3.11" rel="8.62"/>
  <changelog author="Sauerlandlinux@gmx.de" date="1537617600">- Initial release</changelog>
</package>
</otherdata>