<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="66">
<package pkgid="735eaf13e507161f3ef09c344f79f2fbea1ffb7dd49ad74d4e383427c93b5ed9" name="easy-rsa" arch="noarch">
  <version epoch="0" ver="3.2.6" rel="150700.55.1"/>
  <changelog author="seroton10@gmail.com" date="1500379200">- Include upstream patches:
  + 6436eaf.patch
    Add CN as SAN (if none requested) on server certs by default
  + e9e8e27.patch
    Moved @ValdikSS's serial randomization to sign_req</changelog>
  <changelog author="seroton10@gmail.com" date="1500897600">- Include upstream patches:
  + 534f673.patch
    Make $PWD/pki the default PKI location
- Adapted easy-rsa-packaging.patch to work with upstream patch
- Treat /etc/easy-rsa as public default config, no default vars</changelog>
  <changelog author="seroton10@gmail.com" date="1501243200">- Include upstream patches:
  + d20d2b3.patch
    Update docs and examples to fit changes in 534f673
- Adapted easy-rsa-packaging.patch to work with upstream patch</changelog>
  <changelog author="seroton10@gmail.com" date="1503489600">- Include upstream patches:
  + 4eac410.patch
    Fix string comprehension
  + a138c0d.patch
    Fix incorrect "openssl rand" usage
  + 83a1a21.patch
    Add --copy-ext option</changelog>
  <changelog author="seroton10@gmail.com" date="1508155200">- Update to version 3.0.3
- Rename easy-rsa-packaging.patch to suse-packaging.patch
- Remove obsolete upstream patches:
  * f174800.patch
  * 29d4dee.patch
  * b93d0a1.patch
  * fb4d8d8.patch
  * b75faa4.patch
  * 6436eaf.patch
  * e9e8e27.patch
  * 534f673.patch
  * d20d2b3.patch
  * 4eac410.patch
  * a138c0d.patch
  * 83a1a21.patch</changelog>
  <changelog author="astieger@suse.com" date="1508328000">- update release tarball instead of git snapshot
- add upstream signing keyring and verify source signature</changelog>
  <changelog author="seroton10@gmail.com" date="1517140800">- Upgrade to version 3.0.4
  * Remove use of egrep (#154)
  * Finally(?) fix the subjectAltName issues (really fixes #168)
- Improve RPM description</changelog>
  <changelog author="chris@computersalat.de" date="1543579200">- update to 3.0.5
  * Fix #17 &amp; #58: use AES256 for CA key
  * Also, don't use read -s, use stty -echo
  * Fix broken "nopass" option
  * Add -r to read to stop errors reported by shellcheck (and to behave)
  * remove overzealous quotes around $pkcs_opts (more SC errors)
- update and rebase suse-packaging.patch
  * fix: set_var EASYRSA in vars.example
- fix License</changelog>
  <changelog author="tuukka.pasanen@ilmi.fi" date="1549972800">- update to 3.0.6 (2019-02-01)
  * Certifcates that are revoked now move to a revoked subdirectory (#63)
  * EasyRSA no longer clobbers non-EASYRSA environment variables (#277)
  * More sane string checking, allowingn for commas in CN (#267)
  * Support for reasonCode in CRL (#280)
  * Better handling for capturing passphrases (#230, others)
  * Improved LibreSSL/MacOS support
  * Adds support to renew certificates up to 30 days before expiration (#286)
  - This changes previous behavior allowing for certificate creation using
    duplicate CNs.
- update and rebase suse-packaging.patch</changelog>
  <changelog author="seroton10@gmail.com" date="1606305600">- update to 3.0.8 (2020-09-09)
  * Provide --version option (#372)
  * Version information now within generated certificates like on *nix
  * Fixed issue where gen-dh overwrote existing files without warning (#373)
  * Fixed issue with ED/EC certificates were still signed by RSA (#374)
  * Added support for export-p8 (#339)
  * Clarified error message (#384)
  * 2-&gt;3 upgrade now errors and prints message when vars isn't found (#377)
  * Update OpenSSL Windows binaries to 1.1.1g
  * Reverted OpenSSL back to 1.1.0j</changelog>
  <changelog author="seroton10@gmail.com" date="1655294400">- Update to 3.0.9 (2022-05-04)
  * Upgrade OpenSSL from 1.1.0j to 1.1.1o (#405, #407)
  - We are buliding this ourselves now.
  * Fix --version so it uses EASYRSA_OPENSSL (#416)
  * Use openssl rand instead of non-POSIX mktemp (#478)
  * Fix paths with spaces (#443)
  * Correct OpenSSL version from Homebrew on macOs (#416)
  * Fix revoking a renewed certificate (Original PR #394)
  * Follow-up commit: ef22701
  * Introduce 'show-crl' (d199389)
  * Support Windows-Git 'version of bash' (#533)
  * Disallow use of single quote (') in vars file, Warning (#530)
  * Creating a CA uses x509-types/ca and COMMON (#526)
  * Prefer 'PKI/vars' over all other locations (#528)
  * Introduce 'init-pki soft' option (#197)
  * Warnings are no longer silenced by --batch (#523)
  * Improve packaging options (#510)</changelog>
  <changelog author="packaging@sp1rit.anonaddy.me" date="1662379200">- Update to 3.1.0 (2022-05-18)
  * Introduce basic support for OpenSSL version 3 (#492)
  * Update regex in grep to be POSIX compliant (#556)
  * Introduce status reporting tools (#555 &amp; #557)
  * Display certificates using UTF8 (#551)
  * Allow certificates to be created with fixed date offset (#550)
  * Add 'verify' to verify certificate against CA (#549)
  * Add PKCS#12 alias 'friendlyName' (#544)
  * Disallow use of '--vars=FILE init-pki' (#566)
  * Support multiple IP-Addresses in SAN (#564)
  * Add option '--renew-days=NN', custom renew grace period (#557)
  * Add 'nopass' option to the 'export-pkcs' functions (#411)
  * Add support for 'busybox' (#543)
  * Add option '--tmp-dir=DIR' to declare Temp-dir (Commit f503a22)</changelog>
  <changelog author="dmueller@suse.com" date="1670068800">- update to 3.1.1:
  * Remove command 'renewable' (#715)
  * Expand 'show-renew', include 'renewed/certs_by_serial' (#700)
  * Resolve long-standing issue with --subca-len=N (#691)
  * ++ NOTICE: Add EasyRSA-Renew-and-Revoke.md (#690)
  * Require 'openssl-easyrsa.cnf' is up to date (#695}
  * Introduce 'renew' (version 3). Only renew cert (#688)
  * Always ensure X509-types files exist (#581 #696)
  * Expand alias '--days' to all suitable options with a period (#674)
  * Introduce --keep-tmp, keep temp files for debugging (#667)
  * Introduce Option -q|--quiet, disable information output (#703)
  * Add serialNumber (OID 2.5.4.5) to DN 'org' mode (#606)
  * Support ampersand and dollar-sign in vars file (#590)
  * Introduce 'rewind-renew' (#579)
  * Expand status reports to include checking a single cert (#577)
  * Introduce 'revoke-renewed' (#547)
  * update OpenSSL for Windows to 3.0.5</changelog>
  <changelog author="seroton10@gmail.com" date="1670932800">- fix for 3.1.1:
  * add patch fix-747.patch from upstream</changelog>
  <changelog author="info@paolostivanin.com" date="1673956800">- Update to 3.1.2:
  * Command 'renew': Remove option 'nopass'
  * find_x509_types_dir(): Remove excess checks
  * Remove function find_x509_types_dir()
  * For 'init-pki hard' only, always try to create a new pki/vars file
  * Introduce global option '--notext|--no-text'
  * Minor style change
  * Introduce command 'set-pass'
  * Fix shellcheck warning for command set-pass case statement
  * cleanup(): Exit correctly for SIGINT
  * Update help: Standardise output; Improve code; Reprioritise options
  * vars.example: Add EASYRSA_NO_PASS and wrap long lines
  * Use 'unset -v', consistently
  * build-ca: Improve passphrase input mechanism
  * Remove global options '--verbose' and '--quiet' as not required
  * Remove all prerequisite code to build a safe SSL config file
  * Rename temp files to reflect the purpose
  * easyrsa_openssl(): Always set OPENSSL_CONF to EasyRSA safe SSL config
  * Replace SSL calls for serial number with function ssl_cert_serial()
  * Introduce OpenSSL only mode: No Safe SSL Config File
  * ff_date_to_cert_date(): Correct the input format for busybox date
  * Re-order easyrsa_openssl() temp-file assignment
  * Stop EASYRSA_DEBUG interfering with SSL output from subshells
  * Status reports: Recognise Expired certificates
  * New function safe_set_var(): Safe wrapper for set_var()
  * Windows, build-ca: Add input password to re-open private key
  * Renewal: General code improvements
  * cleanup(): General improvements - Create KNOWN error exit
  * build-ca: Change FATAL error to warning for old openssl-easyrsa.cnf
  * Allow --fix-offset to create post-dated certificates
  * Default settings: Make default Edwards curve ED25519
  * cleanup(): Exit with numeric error-code only
  * init-pki(): Introduce second warning before HARD removal
  * build-full: Always enable inline file creation
  * Global option '--passout' always take priority ONLY
  * Status Reports: Set 'LC_TIME=C.UTF-8', only used for reports
  * Option --fix-offset: Adjust off-by-one day
- Drop fix-747.patch</changelog>
  <changelog author="elimat@opensuse.org" date="1691323200">- Update to 3.1.5:
  * Build Update: script now supports signing and verifying
  * Automate support-file creation (Free packaging) (#964)
  * build-ca: New command option 'raw-ca', abbrevation: 'raw' (#963)
  This 'raw' method, is the most reliable way to build a CA,
    with a password, without writing the CA password to a temp-file.
    This option completely replaces both methods below:
    build-ca: New option --ca-via-stdin, use SSL -pass* argument 'stdin' (#959)
    Option '--ca-via-stdin' offers no more security than standard method.
    Easy-RSA version 3.1.4 ONLY.
    build-ca: Replace password temp-files with file-descriptors (#955)
    Using file-descriptors does not work in Windows.
    Easy-RSA version 3.1.3 ONLY.
- update and rebase suse-packaging.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1697544000">- Update to 3.1.7:
  * Completely Remove Upgrade Functionality
  * Expand help to include undocumented commands
  * Forbid "default vars in the default PKI" for all commands
  * show-expire: Calculate certificate expire seconds from Database date
  * Expand help to include undocumented commands
  * New command: make-vars - Print vars.example (here-doc) to stdout
  * gen-crl: preserve existing crl.pem ownership+mode by @Tabiskabis in #1020
  * Improve vars auto load
  * Replace santize_path() and ignore Windows "security" warning
  * Improve select_vars() and source_vars()
  * sign-req: Allow the CSR DN-field order to be preserved
  * vars-file: Warn about EASYRSA_NO_VARS disabling vars-file use
  * Expand default status to include vars-file and CA status
  * verify_ssl_lib(): Minor style improvements
  * cleanup: Rename $easyrsa_error_exit to $easyrsa_exit_with_error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1732968000">- update to 3.2.1:
  * inline: Add decimal value for cert. serial
  * Always exit with error for unknown command options
  * ntegrate Easy-RSA TLS-Key for use with 'init-pki soft'
  * easyrsa-tools.lib, show-expire: Add CA certificate to report
  * inline: OpenVPN TLS Keys inlining for TLS-AUTH, TLS-CRYPT-V1
  * easyrsa-tools.lib: OpenVPN TLS Key gen. TLS-AUTH, TLS-CRYPT-V1
  * easyrsa-tools.lib: expire_status_v2() (show-expire version 2)
  * sign-req: Require 128bit serial number
  * Move command 'verify-cert' to Tools-lib; drop 'verify' shortcut
  * Windows secure_session(): Ensure $secured_session dir is created
  * Switch to '-f' for file existence
  * inline: Move auto-inline from build_full() to sign_req()
  * gen-crl: Create additional CRL in DER format
  * self-sign: Allow Edwards Curve based keys
  * Re-enable command 'renew' (version 2): Requires EasyRSA Tools
  * bug-fix: revoke: Pass the correct certificate location
  * vars.example: Add flags for auto-SAN and X509 critical attribute
  * Global option --eku-crit: Mark X509 extendedKeyUsage as critical
  * sign-req: Add critical and pathlen details to confirmation
  * export-p12: Automatically generate inline file
  * Introduce global option --auto-san, use commonName as SAN
  * Introduce global option --san-crit, mark SAN critical
  * Introduce new global options: --ku-crit and --bc-crit
  * gen-req: Always check for existing request file
  * revoke/revoke-expired/-renewed: Keep duplicate certificate
  * revoke-expired/-renewed: Keep req/key files for resigning
  * revoke: Add abbreviations for optional 'reason'
  * build-ca: Allow use of --req-cn without batch mode
  * gen-req: Re-enable use of --req-cn
  * write: Change syntax, target as file, not directory
- update to 3.2.0:
  * Revert ca76697: Restore escape_hazard()
  * New X509 Type: 'selfsign' Internal only
  * New commands: self-sign-server and self-sign-client
  * build-ca: Command 'req', remove SSL option '-keyout'
  * Remove escape_hazard(), obsolete
  * Remove command and function display_cn(), unused
  * docs: Update EasyRSA-Renew-and-Revoke.md
  * Remove all 'renew' code; replaced by 'expire' code
  * Introduce commands: 'expire' and 'revoke-expired'
  * Keep request files [CSR] when revoking certificates
  * Restrict use of --req-cn to build-ca
  * Remove command 'display-san' (Code removed in 5a06f94)
  * Move Status Reports to 'easyrsa-tools.lib'
  * export-p12, OpenSSL v1.x: Upgrade PBE and MAC options
  * LibreSSL: Add fix for missing 'x509' option '-ext'
  * Variable heredoc expansion for SSL/Safe Config file
  * Always use here-doc version of openssl-easyrsa.cnf
  * export-p12: New command option 'legacy'. OpenSSL V3 Only
  * export-p12: Always set 'friendlyName' to file-name-base
  * As of Easy-RSA version 3.2.0-beta1, the configuration files
    vars.example, openssl-eayrsa.cnf and all files in x509-types directory
    are no longer required
  * Rename X509-type file code-signing to codeSigning
  * init-pki: Always write vars.example file to fresh PKI
  * New command 'write': Write 'legacy' files to stdout or files
  * Remove command 'make-safe-ssl': Replaced by command 'write safe-cnf'
  * New Command 'rand': Expose easyrsa_random() to the command line
  * Remove function 'set_pass_legacy()'
  * Remove command 'rewind-renew'
  * Remove command 'rebuild'
  * Remove command 'upgrade'
  * Remove EASYRSA_NO_VARS; Allow graceful use without a vars file
  * New diagnostic command 'display-cn'
  * Expand renewable certificate types to include code-signing
- attach a source to keyring</changelog>
  <changelog author="rrahl0@opensuse.org" date="1738411200">- update to 3.2.2:
  * Remove redundant file: index.txt.attr
  * sign-req: Allow custom X509 Types
  * Add LibreSSL version 4 to supported SSL Libraries
  * Revoke remove private inline
  * Easyrsa disable inline
  * easyrsa-tools.lib: renew SAN, remove excess word 'Address'
  * easyrsa-tls.lib: renew, make sed regex for 'IP Address' greedy
  * Show expire allow zero days
  * easyrsa-tools.lib: New command 'renew ca'
  * Improve CRL expiration details
  * Tools move to easyrsa3
  * vars.example: Remove $EASYRSA_PKI
  * Introduce new command revoke-issued
  * Bugfix renew ca and renew
  * Always use locate_support_files() after secure_session()
  * revoke: Make check for conflicting files less intrusive
  * Forbid a self-signed certificate from being expired/renewed/revoked
  * V321 minor final
  * op-test.sh: Disable download ossl3 and shellcheck binaries
  * Revert: Do not remove index.txt.attr
  * Fold easyrsa-tools.lib into easyrsa</changelog>
  <changelog author="ecsos@opensuse.org" date="1773576000">- Update to 3.2.6:
  - CI: Enable shell switch errexit in #1417
  - V325 326 minor touches in #1421
  - Inline sub ca v1 in #1423
  - X509-Type ca: Enable 'basicConstraints = critical' for CA/subCA certificates in #1428
  - Import tls key v1 in #1429
  - import_tls_key(): Use set_no_clobber() to preserve existing key file in #1430
- Changes from 3.2.5:
  - Replace local / global openssl-easyrsa.cnf in #1394
  - init-pki: Introduce configurable cryptography in #1397
  - Drop x509 type kdc built-in in #1399
  - Always generate an openssl-easyrsa.cnf or x509-types tmp-file in #1401
  - Libressl use $EASYRSA_FORCE_SAFE_SSL in #1402
  - Update EasyRSA-Advanced.md in #1403
  - source_vars(): Add grep regex for assign by equal = in #1405
  - export_pkcs(), PKCS12 inline: Respect $EASYRSA_NO_INLINE in #1407
  - Introduce peer-fingerprint inline lists in #1410
  - help: Add '-b' alias for --batch and correct default 'vars' file in #1411
  - New function ssl_cert_sig_digest(); Extract certificae digest name in #1414
  - Upgrading OpenSSL for Windows to 3.6.0 in #1416
- Changes from 3.2.4:
  - export-p12: Move inline file to 'inline/private' folder in #1356
  - Restructure help in #1363
  - New global option: --no-lockfile = env-var: $EASYRSA_NO_LOCKFILE in #1364
  - Restructure verify_working_env() in #1367
  - Improve verbose in #1368
  - Windows easyrsa-shell-init.sh: Replace 'read -p' in #1371
  - mutual_exclusions(): Include basic checks for --startdate/--enddate in #1372
  - easyrsa-shell-init.sh: Allow Easy-RSA to use '\User$HOME' directory in #1374
  - Remove 'easyrsa_mkdir()', use only 'mkdir' in #1376
  - revoke: Archive request and private key files and expand help in #1378
  - set_no_clobber(): Add simple error detection in #1379
  - random: Use verify_working_env() to configure EASYRSA_OPENSSL in #1381
  - self_sign(): Force use of Easy-RSA X509-type file 'selfsign' in #1383
- Changes from 3.2.3:
  - Update OpenSSL to v3.5.0
  - renew: Print 'unique_subject = no' to index.txt.attr in #1293
  - check_serial_unique(): Check for duplicate Subject error in #1294
  - Correctly define options names - Remove wild-card pattern in #1297
  - Remove all references to file:easyrsa-tools.lib in #1298
  - Reinstate old function as 'db_date_to_iso_8601()' [Renamed] in #1303
  - expire_status_v2(): Refactor 'if' statement to capture error correctly in #1304
  - source_vars() improvements in #1300
  - add_critical_attrib(): Do not add 'critical' if 'critical' exists in #1308
  - inline_file(): Include DH file or placeholder, for RSA Servers in #1310
  - Fix shellcheck warnings in #1311
  - Introduce command line options --umask|--no-umask, to set 'umask' in #1312
  - Introduce "robust" lock-file mechanism in #1313
  - New function set_no_clobber() in #1314
  - Easyrsa mktemp v2 in #1315
  - add_critical_attrib_v2(): Move file access to function in #1316
  - Command 'write': Remove options 'overwrite' and 'filename' in #1318
  - Introduce option --text: Create CSR files with human readable text in #1319
  - will_cert_be_valid(): Remove SSL option -noout in #1321
  - easyrsa_mktemp(): Remove secondary atomic operation in #1322
  - easyrsa_mkdir(): Separate Windows from *nix in #1324
  - Update Copyright 2025 in #1327
  - inine_file(): Correct logic and add 'dh none' for DH params file in #1330
  - show-expire: Move setting $pre_expire_window_s to status() in #1332
  - Always export EASYRSA_SSL_CONF, when assigned (code standard) in #1334
  - Unit-test: Drop old *nix test in #1335
  - add_critical_attrib(): export temp-file name as input file in #1333
  - Inline improvements in #1337
  - Unit-test: Minimize Windows test in #1339
  - PKI lock-file: Move possible creation to sub-function request_lock_file() in #1340
  - forbid_selfsign(): Compare cert serial to signing cert serial in #1342
  - inline_file(): Use ssl_cert_serial() in #1343
  - Inline self sign improvements in #1345
  - peer-fingerprint mode: Make CA mode mutually exclusive to PFP mode in #1347
  - Remove init pki soft in #1351</changelog>
</package>
<package pkgid="1a02a81468d57338eefcd862f0b81e2875ce6a4c8dfbeb72db903c28e8527483" name="easy-rsa" arch="src">
  <version epoch="0" ver="3.2.6" rel="150700.55.1"/>
  <changelog author="seroton10@gmail.com" date="1500379200">- Include upstream patches:
  + 6436eaf.patch
    Add CN as SAN (if none requested) on server certs by default
  + e9e8e27.patch
    Moved @ValdikSS's serial randomization to sign_req</changelog>
  <changelog author="seroton10@gmail.com" date="1500897600">- Include upstream patches:
  + 534f673.patch
    Make $PWD/pki the default PKI location
- Adapted easy-rsa-packaging.patch to work with upstream patch
- Treat /etc/easy-rsa as public default config, no default vars</changelog>
  <changelog author="seroton10@gmail.com" date="1501243200">- Include upstream patches:
  + d20d2b3.patch
    Update docs and examples to fit changes in 534f673
- Adapted easy-rsa-packaging.patch to work with upstream patch</changelog>
  <changelog author="seroton10@gmail.com" date="1503489600">- Include upstream patches:
  + 4eac410.patch
    Fix string comprehension
  + a138c0d.patch
    Fix incorrect "openssl rand" usage
  + 83a1a21.patch
    Add --copy-ext option</changelog>
  <changelog author="seroton10@gmail.com" date="1508155200">- Update to version 3.0.3
- Rename easy-rsa-packaging.patch to suse-packaging.patch
- Remove obsolete upstream patches:
  * f174800.patch
  * 29d4dee.patch
  * b93d0a1.patch
  * fb4d8d8.patch
  * b75faa4.patch
  * 6436eaf.patch
  * e9e8e27.patch
  * 534f673.patch
  * d20d2b3.patch
  * 4eac410.patch
  * a138c0d.patch
  * 83a1a21.patch</changelog>
  <changelog author="astieger@suse.com" date="1508328000">- update release tarball instead of git snapshot
- add upstream signing keyring and verify source signature</changelog>
  <changelog author="seroton10@gmail.com" date="1517140800">- Upgrade to version 3.0.4
  * Remove use of egrep (#154)
  * Finally(?) fix the subjectAltName issues (really fixes #168)
- Improve RPM description</changelog>
  <changelog author="chris@computersalat.de" date="1543579200">- update to 3.0.5
  * Fix #17 &amp; #58: use AES256 for CA key
  * Also, don't use read -s, use stty -echo
  * Fix broken "nopass" option
  * Add -r to read to stop errors reported by shellcheck (and to behave)
  * remove overzealous quotes around $pkcs_opts (more SC errors)
- update and rebase suse-packaging.patch
  * fix: set_var EASYRSA in vars.example
- fix License</changelog>
  <changelog author="tuukka.pasanen@ilmi.fi" date="1549972800">- update to 3.0.6 (2019-02-01)
  * Certifcates that are revoked now move to a revoked subdirectory (#63)
  * EasyRSA no longer clobbers non-EASYRSA environment variables (#277)
  * More sane string checking, allowingn for commas in CN (#267)
  * Support for reasonCode in CRL (#280)
  * Better handling for capturing passphrases (#230, others)
  * Improved LibreSSL/MacOS support
  * Adds support to renew certificates up to 30 days before expiration (#286)
  - This changes previous behavior allowing for certificate creation using
    duplicate CNs.
- update and rebase suse-packaging.patch</changelog>
  <changelog author="seroton10@gmail.com" date="1606305600">- update to 3.0.8 (2020-09-09)
  * Provide --version option (#372)
  * Version information now within generated certificates like on *nix
  * Fixed issue where gen-dh overwrote existing files without warning (#373)
  * Fixed issue with ED/EC certificates were still signed by RSA (#374)
  * Added support for export-p8 (#339)
  * Clarified error message (#384)
  * 2-&gt;3 upgrade now errors and prints message when vars isn't found (#377)
  * Update OpenSSL Windows binaries to 1.1.1g
  * Reverted OpenSSL back to 1.1.0j</changelog>
  <changelog author="seroton10@gmail.com" date="1655294400">- Update to 3.0.9 (2022-05-04)
  * Upgrade OpenSSL from 1.1.0j to 1.1.1o (#405, #407)
  - We are buliding this ourselves now.
  * Fix --version so it uses EASYRSA_OPENSSL (#416)
  * Use openssl rand instead of non-POSIX mktemp (#478)
  * Fix paths with spaces (#443)
  * Correct OpenSSL version from Homebrew on macOs (#416)
  * Fix revoking a renewed certificate (Original PR #394)
  * Follow-up commit: ef22701
  * Introduce 'show-crl' (d199389)
  * Support Windows-Git 'version of bash' (#533)
  * Disallow use of single quote (') in vars file, Warning (#530)
  * Creating a CA uses x509-types/ca and COMMON (#526)
  * Prefer 'PKI/vars' over all other locations (#528)
  * Introduce 'init-pki soft' option (#197)
  * Warnings are no longer silenced by --batch (#523)
  * Improve packaging options (#510)</changelog>
  <changelog author="packaging@sp1rit.anonaddy.me" date="1662379200">- Update to 3.1.0 (2022-05-18)
  * Introduce basic support for OpenSSL version 3 (#492)
  * Update regex in grep to be POSIX compliant (#556)
  * Introduce status reporting tools (#555 &amp; #557)
  * Display certificates using UTF8 (#551)
  * Allow certificates to be created with fixed date offset (#550)
  * Add 'verify' to verify certificate against CA (#549)
  * Add PKCS#12 alias 'friendlyName' (#544)
  * Disallow use of '--vars=FILE init-pki' (#566)
  * Support multiple IP-Addresses in SAN (#564)
  * Add option '--renew-days=NN', custom renew grace period (#557)
  * Add 'nopass' option to the 'export-pkcs' functions (#411)
  * Add support for 'busybox' (#543)
  * Add option '--tmp-dir=DIR' to declare Temp-dir (Commit f503a22)</changelog>
  <changelog author="dmueller@suse.com" date="1670068800">- update to 3.1.1:
  * Remove command 'renewable' (#715)
  * Expand 'show-renew', include 'renewed/certs_by_serial' (#700)
  * Resolve long-standing issue with --subca-len=N (#691)
  * ++ NOTICE: Add EasyRSA-Renew-and-Revoke.md (#690)
  * Require 'openssl-easyrsa.cnf' is up to date (#695}
  * Introduce 'renew' (version 3). Only renew cert (#688)
  * Always ensure X509-types files exist (#581 #696)
  * Expand alias '--days' to all suitable options with a period (#674)
  * Introduce --keep-tmp, keep temp files for debugging (#667)
  * Introduce Option -q|--quiet, disable information output (#703)
  * Add serialNumber (OID 2.5.4.5) to DN 'org' mode (#606)
  * Support ampersand and dollar-sign in vars file (#590)
  * Introduce 'rewind-renew' (#579)
  * Expand status reports to include checking a single cert (#577)
  * Introduce 'revoke-renewed' (#547)
  * update OpenSSL for Windows to 3.0.5</changelog>
  <changelog author="seroton10@gmail.com" date="1670932800">- fix for 3.1.1:
  * add patch fix-747.patch from upstream</changelog>
  <changelog author="info@paolostivanin.com" date="1673956800">- Update to 3.1.2:
  * Command 'renew': Remove option 'nopass'
  * find_x509_types_dir(): Remove excess checks
  * Remove function find_x509_types_dir()
  * For 'init-pki hard' only, always try to create a new pki/vars file
  * Introduce global option '--notext|--no-text'
  * Minor style change
  * Introduce command 'set-pass'
  * Fix shellcheck warning for command set-pass case statement
  * cleanup(): Exit correctly for SIGINT
  * Update help: Standardise output; Improve code; Reprioritise options
  * vars.example: Add EASYRSA_NO_PASS and wrap long lines
  * Use 'unset -v', consistently
  * build-ca: Improve passphrase input mechanism
  * Remove global options '--verbose' and '--quiet' as not required
  * Remove all prerequisite code to build a safe SSL config file
  * Rename temp files to reflect the purpose
  * easyrsa_openssl(): Always set OPENSSL_CONF to EasyRSA safe SSL config
  * Replace SSL calls for serial number with function ssl_cert_serial()
  * Introduce OpenSSL only mode: No Safe SSL Config File
  * ff_date_to_cert_date(): Correct the input format for busybox date
  * Re-order easyrsa_openssl() temp-file assignment
  * Stop EASYRSA_DEBUG interfering with SSL output from subshells
  * Status reports: Recognise Expired certificates
  * New function safe_set_var(): Safe wrapper for set_var()
  * Windows, build-ca: Add input password to re-open private key
  * Renewal: General code improvements
  * cleanup(): General improvements - Create KNOWN error exit
  * build-ca: Change FATAL error to warning for old openssl-easyrsa.cnf
  * Allow --fix-offset to create post-dated certificates
  * Default settings: Make default Edwards curve ED25519
  * cleanup(): Exit with numeric error-code only
  * init-pki(): Introduce second warning before HARD removal
  * build-full: Always enable inline file creation
  * Global option '--passout' always take priority ONLY
  * Status Reports: Set 'LC_TIME=C.UTF-8', only used for reports
  * Option --fix-offset: Adjust off-by-one day
- Drop fix-747.patch</changelog>
  <changelog author="elimat@opensuse.org" date="1691323200">- Update to 3.1.5:
  * Build Update: script now supports signing and verifying
  * Automate support-file creation (Free packaging) (#964)
  * build-ca: New command option 'raw-ca', abbrevation: 'raw' (#963)
  This 'raw' method, is the most reliable way to build a CA,
    with a password, without writing the CA password to a temp-file.
    This option completely replaces both methods below:
    build-ca: New option --ca-via-stdin, use SSL -pass* argument 'stdin' (#959)
    Option '--ca-via-stdin' offers no more security than standard method.
    Easy-RSA version 3.1.4 ONLY.
    build-ca: Replace password temp-files with file-descriptors (#955)
    Using file-descriptors does not work in Windows.
    Easy-RSA version 3.1.3 ONLY.
- update and rebase suse-packaging.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1697544000">- Update to 3.1.7:
  * Completely Remove Upgrade Functionality
  * Expand help to include undocumented commands
  * Forbid "default vars in the default PKI" for all commands
  * show-expire: Calculate certificate expire seconds from Database date
  * Expand help to include undocumented commands
  * New command: make-vars - Print vars.example (here-doc) to stdout
  * gen-crl: preserve existing crl.pem ownership+mode by @Tabiskabis in #1020
  * Improve vars auto load
  * Replace santize_path() and ignore Windows "security" warning
  * Improve select_vars() and source_vars()
  * sign-req: Allow the CSR DN-field order to be preserved
  * vars-file: Warn about EASYRSA_NO_VARS disabling vars-file use
  * Expand default status to include vars-file and CA status
  * verify_ssl_lib(): Minor style improvements
  * cleanup: Rename $easyrsa_error_exit to $easyrsa_exit_with_error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1732968000">- update to 3.2.1:
  * inline: Add decimal value for cert. serial
  * Always exit with error for unknown command options
  * ntegrate Easy-RSA TLS-Key for use with 'init-pki soft'
  * easyrsa-tools.lib, show-expire: Add CA certificate to report
  * inline: OpenVPN TLS Keys inlining for TLS-AUTH, TLS-CRYPT-V1
  * easyrsa-tools.lib: OpenVPN TLS Key gen. TLS-AUTH, TLS-CRYPT-V1
  * easyrsa-tools.lib: expire_status_v2() (show-expire version 2)
  * sign-req: Require 128bit serial number
  * Move command 'verify-cert' to Tools-lib; drop 'verify' shortcut
  * Windows secure_session(): Ensure $secured_session dir is created
  * Switch to '-f' for file existence
  * inline: Move auto-inline from build_full() to sign_req()
  * gen-crl: Create additional CRL in DER format
  * self-sign: Allow Edwards Curve based keys
  * Re-enable command 'renew' (version 2): Requires EasyRSA Tools
  * bug-fix: revoke: Pass the correct certificate location
  * vars.example: Add flags for auto-SAN and X509 critical attribute
  * Global option --eku-crit: Mark X509 extendedKeyUsage as critical
  * sign-req: Add critical and pathlen details to confirmation
  * export-p12: Automatically generate inline file
  * Introduce global option --auto-san, use commonName as SAN
  * Introduce global option --san-crit, mark SAN critical
  * Introduce new global options: --ku-crit and --bc-crit
  * gen-req: Always check for existing request file
  * revoke/revoke-expired/-renewed: Keep duplicate certificate
  * revoke-expired/-renewed: Keep req/key files for resigning
  * revoke: Add abbreviations for optional 'reason'
  * build-ca: Allow use of --req-cn without batch mode
  * gen-req: Re-enable use of --req-cn
  * write: Change syntax, target as file, not directory
- update to 3.2.0:
  * Revert ca76697: Restore escape_hazard()
  * New X509 Type: 'selfsign' Internal only
  * New commands: self-sign-server and self-sign-client
  * build-ca: Command 'req', remove SSL option '-keyout'
  * Remove escape_hazard(), obsolete
  * Remove command and function display_cn(), unused
  * docs: Update EasyRSA-Renew-and-Revoke.md
  * Remove all 'renew' code; replaced by 'expire' code
  * Introduce commands: 'expire' and 'revoke-expired'
  * Keep request files [CSR] when revoking certificates
  * Restrict use of --req-cn to build-ca
  * Remove command 'display-san' (Code removed in 5a06f94)
  * Move Status Reports to 'easyrsa-tools.lib'
  * export-p12, OpenSSL v1.x: Upgrade PBE and MAC options
  * LibreSSL: Add fix for missing 'x509' option '-ext'
  * Variable heredoc expansion for SSL/Safe Config file
  * Always use here-doc version of openssl-easyrsa.cnf
  * export-p12: New command option 'legacy'. OpenSSL V3 Only
  * export-p12: Always set 'friendlyName' to file-name-base
  * As of Easy-RSA version 3.2.0-beta1, the configuration files
    vars.example, openssl-eayrsa.cnf and all files in x509-types directory
    are no longer required
  * Rename X509-type file code-signing to codeSigning
  * init-pki: Always write vars.example file to fresh PKI
  * New command 'write': Write 'legacy' files to stdout or files
  * Remove command 'make-safe-ssl': Replaced by command 'write safe-cnf'
  * New Command 'rand': Expose easyrsa_random() to the command line
  * Remove function 'set_pass_legacy()'
  * Remove command 'rewind-renew'
  * Remove command 'rebuild'
  * Remove command 'upgrade'
  * Remove EASYRSA_NO_VARS; Allow graceful use without a vars file
  * New diagnostic command 'display-cn'
  * Expand renewable certificate types to include code-signing
- attach a source to keyring</changelog>
  <changelog author="rrahl0@opensuse.org" date="1738411200">- update to 3.2.2:
  * Remove redundant file: index.txt.attr
  * sign-req: Allow custom X509 Types
  * Add LibreSSL version 4 to supported SSL Libraries
  * Revoke remove private inline
  * Easyrsa disable inline
  * easyrsa-tools.lib: renew SAN, remove excess word 'Address'
  * easyrsa-tls.lib: renew, make sed regex for 'IP Address' greedy
  * Show expire allow zero days
  * easyrsa-tools.lib: New command 'renew ca'
  * Improve CRL expiration details
  * Tools move to easyrsa3
  * vars.example: Remove $EASYRSA_PKI
  * Introduce new command revoke-issued
  * Bugfix renew ca and renew
  * Always use locate_support_files() after secure_session()
  * revoke: Make check for conflicting files less intrusive
  * Forbid a self-signed certificate from being expired/renewed/revoked
  * V321 minor final
  * op-test.sh: Disable download ossl3 and shellcheck binaries
  * Revert: Do not remove index.txt.attr
  * Fold easyrsa-tools.lib into easyrsa</changelog>
  <changelog author="ecsos@opensuse.org" date="1773576000">- Update to 3.2.6:
  - CI: Enable shell switch errexit in #1417
  - V325 326 minor touches in #1421
  - Inline sub ca v1 in #1423
  - X509-Type ca: Enable 'basicConstraints = critical' for CA/subCA certificates in #1428
  - Import tls key v1 in #1429
  - import_tls_key(): Use set_no_clobber() to preserve existing key file in #1430
- Changes from 3.2.5:
  - Replace local / global openssl-easyrsa.cnf in #1394
  - init-pki: Introduce configurable cryptography in #1397
  - Drop x509 type kdc built-in in #1399
  - Always generate an openssl-easyrsa.cnf or x509-types tmp-file in #1401
  - Libressl use $EASYRSA_FORCE_SAFE_SSL in #1402
  - Update EasyRSA-Advanced.md in #1403
  - source_vars(): Add grep regex for assign by equal = in #1405
  - export_pkcs(), PKCS12 inline: Respect $EASYRSA_NO_INLINE in #1407
  - Introduce peer-fingerprint inline lists in #1410
  - help: Add '-b' alias for --batch and correct default 'vars' file in #1411
  - New function ssl_cert_sig_digest(); Extract certificae digest name in #1414
  - Upgrading OpenSSL for Windows to 3.6.0 in #1416
- Changes from 3.2.4:
  - export-p12: Move inline file to 'inline/private' folder in #1356
  - Restructure help in #1363
  - New global option: --no-lockfile = env-var: $EASYRSA_NO_LOCKFILE in #1364
  - Restructure verify_working_env() in #1367
  - Improve verbose in #1368
  - Windows easyrsa-shell-init.sh: Replace 'read -p' in #1371
  - mutual_exclusions(): Include basic checks for --startdate/--enddate in #1372
  - easyrsa-shell-init.sh: Allow Easy-RSA to use '\User$HOME' directory in #1374
  - Remove 'easyrsa_mkdir()', use only 'mkdir' in #1376
  - revoke: Archive request and private key files and expand help in #1378
  - set_no_clobber(): Add simple error detection in #1379
  - random: Use verify_working_env() to configure EASYRSA_OPENSSL in #1381
  - self_sign(): Force use of Easy-RSA X509-type file 'selfsign' in #1383
- Changes from 3.2.3:
  - Update OpenSSL to v3.5.0
  - renew: Print 'unique_subject = no' to index.txt.attr in #1293
  - check_serial_unique(): Check for duplicate Subject error in #1294
  - Correctly define options names - Remove wild-card pattern in #1297
  - Remove all references to file:easyrsa-tools.lib in #1298
  - Reinstate old function as 'db_date_to_iso_8601()' [Renamed] in #1303
  - expire_status_v2(): Refactor 'if' statement to capture error correctly in #1304
  - source_vars() improvements in #1300
  - add_critical_attrib(): Do not add 'critical' if 'critical' exists in #1308
  - inline_file(): Include DH file or placeholder, for RSA Servers in #1310
  - Fix shellcheck warnings in #1311
  - Introduce command line options --umask|--no-umask, to set 'umask' in #1312
  - Introduce "robust" lock-file mechanism in #1313
  - New function set_no_clobber() in #1314
  - Easyrsa mktemp v2 in #1315
  - add_critical_attrib_v2(): Move file access to function in #1316
  - Command 'write': Remove options 'overwrite' and 'filename' in #1318
  - Introduce option --text: Create CSR files with human readable text in #1319
  - will_cert_be_valid(): Remove SSL option -noout in #1321
  - easyrsa_mktemp(): Remove secondary atomic operation in #1322
  - easyrsa_mkdir(): Separate Windows from *nix in #1324
  - Update Copyright 2025 in #1327
  - inine_file(): Correct logic and add 'dh none' for DH params file in #1330
  - show-expire: Move setting $pre_expire_window_s to status() in #1332
  - Always export EASYRSA_SSL_CONF, when assigned (code standard) in #1334
  - Unit-test: Drop old *nix test in #1335
  - add_critical_attrib(): export temp-file name as input file in #1333
  - Inline improvements in #1337
  - Unit-test: Minimize Windows test in #1339
  - PKI lock-file: Move possible creation to sub-function request_lock_file() in #1340
  - forbid_selfsign(): Compare cert serial to signing cert serial in #1342
  - inline_file(): Use ssl_cert_serial() in #1343
  - Inline self sign improvements in #1345
  - peer-fingerprint mode: Make CA mode mutually exclusive to PFP mode in #1347
  - Remove init pki soft in #1351</changelog>
</package>
<package pkgid="7d555213c01d90ae5227b97749941f5d86eef9a684db881598fc569fb2a04ed1" name="headscale" arch="src">
  <version epoch="0" ver="0.28.0" rel="150700.40.2"/>
  <changelog author="rrahl0@proton.me" date="1703073600">- initial packaging</changelog>
  <changelog author="rrahl0@disroot.org" date="1713441600">- remove CAP_CHOWN from systemd unit file, as it's unneeded</changelog>
  <changelog author="rrahl0@opensuse.org" date="1726660800">- update to 0.23.0:
  * Code reorganisation, a lot of code has moved
  * Change the structure of database configuration, see config-example.yaml
  - Old structure has been remove and the configuration must be converted
  - Adds additional configuration for PostgreSQL for setting max open,
    idle connection and idle connection lifetime
  * API: Machine is now Node
  * Remove support for older Tailscale clients (supported &gt;=1.42)
  * Headscale checks that at least one DERP is defined at start
  * Embedded DERP server requires a private key
  * Prefixes are now defined per v4 and v6 range
  * MagicDNS domains no longer contain usernames
  * YAML files are no longer supported for headscale policy (use HuJSON)
  * DNS configuration has been restructured
  * Use versioned migrations
  * Make the OIDC callback page better
  * SSH support
  * State management has been improved
  * Use error group handling to ensure tests actually pass
  * Fix hang on SIGTERM
  * Send logs to stderr by default
  * Fix TS-2023-006 security UPnP issue
  * Turn off gRPC logging
  * Added the possibility to manually create a DERP-map entry
  * Add support for deleting api keys
  * Add command to backfill IP addresses for nodes missing IPs from configured prefixes
  * Log available update as warning
  * Add autogroup:internet to Policy
  * Restore foreign keys and add constraints
  * Make registration page easier to use on mobile devices
  * Make write-ahead-log default on and configurable for SQLite
  * Add APIs for managing headscale policy
  * Fix for registering nodes using preauthkeys when running
    on a postgres database in a non-UTC timezone
  * Make sure integration tests cover postgres for all scenarios
  * CLI commands (all except serve) only requires minimal configuration
  * CLI results are now concistently sent to stdout and errors to stderr
  * Fix issue where shutting down headscale would hang
  * add shutdown that asserts if headscale had panics</changelog>
  <changelog author="mrueckert@suse.de" date="1735819200">- Fix the system integration
  - actually build and use the sysuser pre snippet so that the user
    is created before tmpfiles.d tries to create files
- no longer break debugsymbols for the binary (remove -s -w)
- use systemd macros for paths
- ensure proper requires/ordering for sysuser/systemd</changelog>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- update 0.24.3:
  * Fix migration error caused by nodes having invalid auth keys
  * Pre auth keys belonging to a user are no longer deleted with the user
  * Pre auth keys that are used by a node can no longer be deleted
- update to 0.24.2:
  * Fix issue where email and username being equal fails to match in Policy
  * Delete invalid routes before adding a NOT NULL constraint on node_id
- update to 0.24.1:
  * Fix migration issue with user table for PostgreSQL
  * Relax username validation to allow emails
  * Remove invalid routes and add stronger constraints for routes to avoid API panic
  * Fix panic when derp.update_frequency is 0
- update to 0.24.0:
  BREAKING:
  * Remove dns.use_username_in_magic_dns configuration option
  * Having usernames in magic DNS is no longer possible.
  * Remove versions older than 1.56
  * Clean up old code required by old versions
  * If you depend on a Headscale Web UI, you should wait with this update until
    the UI have been updated to match the new API.
  * GET /api/v1/user/{name} and GetUser have been removed in favour of
    ListUsers with an ID parameter
  * RenameUser and DeleteUser now require an ID instead of a name.
  CHANGES:
  * Improved compatibility of built-in DERP server with clients connecting over WebSocket
  * Allow nodes to use SSH agent forwarding
  * Fixed processing of fields in post request in MoveNode rpc
  * Added conversion of 'Hostname' to 'givenName' in a node with FQDN rules applied
  * Fixed updating of hostname and givenName when it is updated in HostInfo
  * Fixed missing stable-debug container tag
  * Loosened up server_url and base_domain check. It was overly strict in some cases
  * CLI for managing users now accepts --identifier in addition to --name,
    usage of --identifier is recommended
  * Add dns.extra_records_path configuration option
  * Support client verify for DERP
  * Add PKCE Verifier for OIDC</changelog>
  <changelog author="rrahl0@opensuse.org" date="1739448000">- update to 0.25.0:
  BREAKING:
  * Authentication flow has been rewritten
  * Remove support for Tailscale clients older than 1.62 (Capability version 87)
  CHANGES:
  * oidc.map_legacy_users is now false by default
  * Print Tailscale version instead of capability versions for outdated nodes
  * Do not allow renaming of users from OIDC
  * Change minimum hostname length to 2
  * Fix migration error caused by nodes having invalid auth keys
  * Pre auth keys belonging to a user are no longer deleted with the user
  * Pre auth keys that are used by a node can no longer be deleted
  * Rehaul HTTP errors, return better status code and errors to users</changelog>
  <changelog author="rrahl0@opensuse.org" date="1740484800">- update to 0.25.1:
  * Fix issue where registration errors are sent correctly
  * Fix issue where routes are passed on registration were not saved
  * Fix issue where registration page was displayed twice
  * fix double login URL with OIDC
  * fix routes not being saved when new nodes registers
  * hand register auth rerrors</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743508800">- add patch fix-CVE-2025-30204.patch, for fixing bsc#1240506</changelog>
  <changelog author="rrahl0@opensuse.org" date="1744804800">- add patch fix-CVEs.patch to fix bsc#1241235, bsc#1237674</changelog>
  <changelog author="rrahl0@opensuse.org" date="1745496000">- update fix-CVEs.patch for fixing bsc#1241801</changelog>
  <changelog author="rrahl0@opensuse.org" date="1747742400">- update to 0.26.0:
  * make version info in bug template more explicit
  * add git hash to binary, print on startup
  * remove oidc migration
  * use helper function for constructing state updates
  * use tsweb debugger
  * set 0.25.0 changelog date
  * activate json logs
  * use tailscale version in all unsupported errs
  * handle register auth errors
  * fix routes not being saved when new nodes registers
  * fix double login URL with OIDC
  * Redo route code
  * Experimental implementation of Policy v2
  * Drop routes table
  * Add usage example to routes flag
  * Remove leftover printf
  * remove policy handling for old capver
  * Container images are also available on GHCR
  * add faq section on scaling/performance
  * Add a FAQ entry about two nodes seeing each other
  * update bug template with debug
  * Set content-type to JSON for some debug endpoints
  * Remove coderabbit
  * add third-party tool headscale-pf
  * Explicitly handle /headscale/{config,lib,run} in container docs
  * Mention that private keys generated if needed
  * Multi network integration tests
  * OIDC: Fetch UserInfo to get EmailVerified if necessary
  * populate serving from primary routes
  * allow users to be defined with @ in v1
  * fix auto approver on register and new policy
  * Add unraid-headscale-admin web UI to docs
  * Only read relevant nodes from database in PeerChangedResponse
  * ensure final dot on node name
  * Restore support for "Override local DNS"
  * some clarifications for tags
  * Update oidc.md
  * flake: add golang-lint lsp
  * policy/v2: fix host validation, consistent pattern
  * integration: clean up unreferenced hs- networks
  * Mention "Network flow logs" as a missing feature
  * Fix goroutine leak in EphemeralGC on node cancel
  * Fix panic on fast reconnection of node
  * add casbin user test
  * config: disallow same server url and base_domain
  * policy/v2: make default
  * integration: remove failing resolvconf tests
  * fix webauth + autoapprove routes
  * types/authkey: include user object in response
  * oidc: try to get username from userinfo
  * notify nodes after owner change
  * auth: ensure that routes are autoapproved when the node is stored
  * Make matchers part of the Policy interface
  * cli/nodes: filter nodes without any routes
  * error on undefined host in policy
  * Update source.md
  * policy/v2: validate autogroup:interet only in dst
  * cmd: add policy check command
  * policy/matcher: fix bug using contains instead of overlap
  * update capmap and deps for release
  * Add documentation for routes
  * Fix deprecation warnings
  * feat: Create headscale user and group as system user/groups
  * Update container.md
  * go.mod: update rest of deps
  * Make more granular SSH tests for both Policies
  * policy: reduce routes sent to peers based on packetfilter
  * Misc doc fixes
  * app: throw away not found body
  * Remove subnet router visibility workaround from docs
  * policy/v2: validate that no undefined group or tag is used
  * cli: policy check, dont require config or log
  * policy/v2: separate exit node and 0.0.0.0/0 routes
  * Add migration steps when policy is stored in the database
  * Simplify policy migration
  * bring back last_seen in database
  * Remove map_legacy_users from example configuration
  * fix: change FormatUint base from 64 to 10 in preauthkeys list command
  * users: harden, test, and add cleaner of identifier
- remove patches fix-CVE-2025-30204.patch and fix-CVEs.patch, as upstream
  updated their dependencies</changelog>
  <changelog author="mrueckert@suse.de" date="1748779200">- Fix the ldflags to set version and commit hash again</changelog>
  <changelog author="mrueckert@suse.de" date="1748779201">- Sync default configurations</changelog>
  <changelog author="rrahl0@opensuse.org" date="1749211200">- update to 0.26.1:
  * Ensure nodes are matching both node key and machine key when connecting
  * Fix /machine/map endpoint vulnerability</changelog>
  <changelog author="rrahl0@opensuse.org" date="1760011200">- add fix-CVE-2025-58190.patch, fixing bsc#1251650
- add fix-CVE-2025-47911.patch, fixing bsc#1251479</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761652800">- Update to version 0.27.0:
  * Database integrity improvements
  * update DERPMap update frequency to 3 hrs
  * This release adds support for the three missing autogroups: self
    (experimental), member, and tagged
  * Under the hood, we have added a new datastructure to store nodes in memory
- remove patches fix-CVE-2025-58190.patch and fix-CVE-2025-47911.patch,
  fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1762948800">- Update to version 0.27.1:
  * Expire nodes with a custom timestamp
  * Fix issue where node expiry was reset when tailscaled restarts
  * Fix OIDC authentication when multiple login URLs are opened
  * Fix node re-registration failing with expired auth keys
  * Remove old unused database tables and indices
  * Ignore litestream tables during database validation
  * Fix exit node visibility to respect ACL rules
  * Fix SSH policy becoming empty when unknown user is referenced
  * Fix policy validation when using bypass-grpc mode
  * Fix autogroup:self interaction with other ACL rules
  * Fix flaky DERP map shuffle test</changelog>
  <changelog author="mrueckert@suse.de" date="1767355200">- currently setting the version and commit hash via ldflags does
  not look functional. So we patch the values in via perl for now.</changelog>
  <changelog author="rrahl0@opensuse.org" date="1770206400">- Update to version 0.28.0:
  * Minimum supported Tailscale client version: v1.74.0
  * Tags as identity
  * Smarter map updates
  * Pre-authentication key security improvements
  * Web registration templates redesign
  * Database migration support removed for pre-0.25.0 databases
  * Full changelog at
    https://github.com/juanfont/headscale/releases/tag/v0.28.0</changelog>
</package>
<package pkgid="eeb473e6bceead904e6976d845c68daaa9906edb7c137e22939d400bd6169442" name="headscale" arch="x86_64">
  <version epoch="0" ver="0.28.0" rel="150700.40.2"/>
  <changelog author="rrahl0@proton.me" date="1703073600">- initial packaging</changelog>
  <changelog author="rrahl0@disroot.org" date="1713441600">- remove CAP_CHOWN from systemd unit file, as it's unneeded</changelog>
  <changelog author="rrahl0@opensuse.org" date="1726660800">- update to 0.23.0:
  * Code reorganisation, a lot of code has moved
  * Change the structure of database configuration, see config-example.yaml
  - Old structure has been remove and the configuration must be converted
  - Adds additional configuration for PostgreSQL for setting max open,
    idle connection and idle connection lifetime
  * API: Machine is now Node
  * Remove support for older Tailscale clients (supported &gt;=1.42)
  * Headscale checks that at least one DERP is defined at start
  * Embedded DERP server requires a private key
  * Prefixes are now defined per v4 and v6 range
  * MagicDNS domains no longer contain usernames
  * YAML files are no longer supported for headscale policy (use HuJSON)
  * DNS configuration has been restructured
  * Use versioned migrations
  * Make the OIDC callback page better
  * SSH support
  * State management has been improved
  * Use error group handling to ensure tests actually pass
  * Fix hang on SIGTERM
  * Send logs to stderr by default
  * Fix TS-2023-006 security UPnP issue
  * Turn off gRPC logging
  * Added the possibility to manually create a DERP-map entry
  * Add support for deleting api keys
  * Add command to backfill IP addresses for nodes missing IPs from configured prefixes
  * Log available update as warning
  * Add autogroup:internet to Policy
  * Restore foreign keys and add constraints
  * Make registration page easier to use on mobile devices
  * Make write-ahead-log default on and configurable for SQLite
  * Add APIs for managing headscale policy
  * Fix for registering nodes using preauthkeys when running
    on a postgres database in a non-UTC timezone
  * Make sure integration tests cover postgres for all scenarios
  * CLI commands (all except serve) only requires minimal configuration
  * CLI results are now concistently sent to stdout and errors to stderr
  * Fix issue where shutting down headscale would hang
  * add shutdown that asserts if headscale had panics</changelog>
  <changelog author="mrueckert@suse.de" date="1735819200">- Fix the system integration
  - actually build and use the sysuser pre snippet so that the user
    is created before tmpfiles.d tries to create files
- no longer break debugsymbols for the binary (remove -s -w)
- use systemd macros for paths
- ensure proper requires/ordering for sysuser/systemd</changelog>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- update 0.24.3:
  * Fix migration error caused by nodes having invalid auth keys
  * Pre auth keys belonging to a user are no longer deleted with the user
  * Pre auth keys that are used by a node can no longer be deleted
- update to 0.24.2:
  * Fix issue where email and username being equal fails to match in Policy
  * Delete invalid routes before adding a NOT NULL constraint on node_id
- update to 0.24.1:
  * Fix migration issue with user table for PostgreSQL
  * Relax username validation to allow emails
  * Remove invalid routes and add stronger constraints for routes to avoid API panic
  * Fix panic when derp.update_frequency is 0
- update to 0.24.0:
  BREAKING:
  * Remove dns.use_username_in_magic_dns configuration option
  * Having usernames in magic DNS is no longer possible.
  * Remove versions older than 1.56
  * Clean up old code required by old versions
  * If you depend on a Headscale Web UI, you should wait with this update until
    the UI have been updated to match the new API.
  * GET /api/v1/user/{name} and GetUser have been removed in favour of
    ListUsers with an ID parameter
  * RenameUser and DeleteUser now require an ID instead of a name.
  CHANGES:
  * Improved compatibility of built-in DERP server with clients connecting over WebSocket
  * Allow nodes to use SSH agent forwarding
  * Fixed processing of fields in post request in MoveNode rpc
  * Added conversion of 'Hostname' to 'givenName' in a node with FQDN rules applied
  * Fixed updating of hostname and givenName when it is updated in HostInfo
  * Fixed missing stable-debug container tag
  * Loosened up server_url and base_domain check. It was overly strict in some cases
  * CLI for managing users now accepts --identifier in addition to --name,
    usage of --identifier is recommended
  * Add dns.extra_records_path configuration option
  * Support client verify for DERP
  * Add PKCE Verifier for OIDC</changelog>
  <changelog author="rrahl0@opensuse.org" date="1739448000">- update to 0.25.0:
  BREAKING:
  * Authentication flow has been rewritten
  * Remove support for Tailscale clients older than 1.62 (Capability version 87)
  CHANGES:
  * oidc.map_legacy_users is now false by default
  * Print Tailscale version instead of capability versions for outdated nodes
  * Do not allow renaming of users from OIDC
  * Change minimum hostname length to 2
  * Fix migration error caused by nodes having invalid auth keys
  * Pre auth keys belonging to a user are no longer deleted with the user
  * Pre auth keys that are used by a node can no longer be deleted
  * Rehaul HTTP errors, return better status code and errors to users</changelog>
  <changelog author="rrahl0@opensuse.org" date="1740484800">- update to 0.25.1:
  * Fix issue where registration errors are sent correctly
  * Fix issue where routes are passed on registration were not saved
  * Fix issue where registration page was displayed twice
  * fix double login URL with OIDC
  * fix routes not being saved when new nodes registers
  * hand register auth rerrors</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743508800">- add patch fix-CVE-2025-30204.patch, for fixing bsc#1240506</changelog>
  <changelog author="rrahl0@opensuse.org" date="1744804800">- add patch fix-CVEs.patch to fix bsc#1241235, bsc#1237674</changelog>
  <changelog author="rrahl0@opensuse.org" date="1745496000">- update fix-CVEs.patch for fixing bsc#1241801</changelog>
  <changelog author="rrahl0@opensuse.org" date="1747742400">- update to 0.26.0:
  * make version info in bug template more explicit
  * add git hash to binary, print on startup
  * remove oidc migration
  * use helper function for constructing state updates
  * use tsweb debugger
  * set 0.25.0 changelog date
  * activate json logs
  * use tailscale version in all unsupported errs
  * handle register auth errors
  * fix routes not being saved when new nodes registers
  * fix double login URL with OIDC
  * Redo route code
  * Experimental implementation of Policy v2
  * Drop routes table
  * Add usage example to routes flag
  * Remove leftover printf
  * remove policy handling for old capver
  * Container images are also available on GHCR
  * add faq section on scaling/performance
  * Add a FAQ entry about two nodes seeing each other
  * update bug template with debug
  * Set content-type to JSON for some debug endpoints
  * Remove coderabbit
  * add third-party tool headscale-pf
  * Explicitly handle /headscale/{config,lib,run} in container docs
  * Mention that private keys generated if needed
  * Multi network integration tests
  * OIDC: Fetch UserInfo to get EmailVerified if necessary
  * populate serving from primary routes
  * allow users to be defined with @ in v1
  * fix auto approver on register and new policy
  * Add unraid-headscale-admin web UI to docs
  * Only read relevant nodes from database in PeerChangedResponse
  * ensure final dot on node name
  * Restore support for "Override local DNS"
  * some clarifications for tags
  * Update oidc.md
  * flake: add golang-lint lsp
  * policy/v2: fix host validation, consistent pattern
  * integration: clean up unreferenced hs- networks
  * Mention "Network flow logs" as a missing feature
  * Fix goroutine leak in EphemeralGC on node cancel
  * Fix panic on fast reconnection of node
  * add casbin user test
  * config: disallow same server url and base_domain
  * policy/v2: make default
  * integration: remove failing resolvconf tests
  * fix webauth + autoapprove routes
  * types/authkey: include user object in response
  * oidc: try to get username from userinfo
  * notify nodes after owner change
  * auth: ensure that routes are autoapproved when the node is stored
  * Make matchers part of the Policy interface
  * cli/nodes: filter nodes without any routes
  * error on undefined host in policy
  * Update source.md
  * policy/v2: validate autogroup:interet only in dst
  * cmd: add policy check command
  * policy/matcher: fix bug using contains instead of overlap
  * update capmap and deps for release
  * Add documentation for routes
  * Fix deprecation warnings
  * feat: Create headscale user and group as system user/groups
  * Update container.md
  * go.mod: update rest of deps
  * Make more granular SSH tests for both Policies
  * policy: reduce routes sent to peers based on packetfilter
  * Misc doc fixes
  * app: throw away not found body
  * Remove subnet router visibility workaround from docs
  * policy/v2: validate that no undefined group or tag is used
  * cli: policy check, dont require config or log
  * policy/v2: separate exit node and 0.0.0.0/0 routes
  * Add migration steps when policy is stored in the database
  * Simplify policy migration
  * bring back last_seen in database
  * Remove map_legacy_users from example configuration
  * fix: change FormatUint base from 64 to 10 in preauthkeys list command
  * users: harden, test, and add cleaner of identifier
- remove patches fix-CVE-2025-30204.patch and fix-CVEs.patch, as upstream
  updated their dependencies</changelog>
  <changelog author="mrueckert@suse.de" date="1748779200">- Fix the ldflags to set version and commit hash again</changelog>
  <changelog author="mrueckert@suse.de" date="1748779201">- Sync default configurations</changelog>
  <changelog author="rrahl0@opensuse.org" date="1749211200">- update to 0.26.1:
  * Ensure nodes are matching both node key and machine key when connecting
  * Fix /machine/map endpoint vulnerability</changelog>
  <changelog author="rrahl0@opensuse.org" date="1760011200">- add fix-CVE-2025-58190.patch, fixing bsc#1251650
- add fix-CVE-2025-47911.patch, fixing bsc#1251479</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761652800">- Update to version 0.27.0:
  * Database integrity improvements
  * update DERPMap update frequency to 3 hrs
  * This release adds support for the three missing autogroups: self
    (experimental), member, and tagged
  * Under the hood, we have added a new datastructure to store nodes in memory
- remove patches fix-CVE-2025-58190.patch and fix-CVE-2025-47911.patch,
  fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1762948800">- Update to version 0.27.1:
  * Expire nodes with a custom timestamp
  * Fix issue where node expiry was reset when tailscaled restarts
  * Fix OIDC authentication when multiple login URLs are opened
  * Fix node re-registration failing with expired auth keys
  * Remove old unused database tables and indices
  * Ignore litestream tables during database validation
  * Fix exit node visibility to respect ACL rules
  * Fix SSH policy becoming empty when unknown user is referenced
  * Fix policy validation when using bypass-grpc mode
  * Fix autogroup:self interaction with other ACL rules
  * Fix flaky DERP map shuffle test</changelog>
  <changelog author="mrueckert@suse.de" date="1767355200">- currently setting the version and commit hash via ldflags does
  not look functional. So we patch the values in via perl for now.</changelog>
  <changelog author="rrahl0@opensuse.org" date="1770206400">- Update to version 0.28.0:
  * Minimum supported Tailscale client version: v1.74.0
  * Tags as identity
  * Smarter map updates
  * Pre-authentication key security improvements
  * Web registration templates redesign
  * Database migration support removed for pre-0.25.0 databases
  * Full changelog at
    https://github.com/juanfont/headscale/releases/tag/v0.28.0</changelog>
</package>
<package pkgid="0d7f389b361f875131464f97541bf5491bbdad0dddeb5055fa0f528097d324e2" name="headscale-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.28.0" rel="150700.40.2"/>
  <changelog author="rrahl0@proton.me" date="1703073600">- initial packaging</changelog>
  <changelog author="rrahl0@disroot.org" date="1713441600">- remove CAP_CHOWN from systemd unit file, as it's unneeded</changelog>
  <changelog author="rrahl0@opensuse.org" date="1726660800">- update to 0.23.0:
  * Code reorganisation, a lot of code has moved
  * Change the structure of database configuration, see config-example.yaml
  - Old structure has been remove and the configuration must be converted
  - Adds additional configuration for PostgreSQL for setting max open,
    idle connection and idle connection lifetime
  * API: Machine is now Node
  * Remove support for older Tailscale clients (supported &gt;=1.42)
  * Headscale checks that at least one DERP is defined at start
  * Embedded DERP server requires a private key
  * Prefixes are now defined per v4 and v6 range
  * MagicDNS domains no longer contain usernames
  * YAML files are no longer supported for headscale policy (use HuJSON)
  * DNS configuration has been restructured
  * Use versioned migrations
  * Make the OIDC callback page better
  * SSH support
  * State management has been improved
  * Use error group handling to ensure tests actually pass
  * Fix hang on SIGTERM
  * Send logs to stderr by default
  * Fix TS-2023-006 security UPnP issue
  * Turn off gRPC logging
  * Added the possibility to manually create a DERP-map entry
  * Add support for deleting api keys
  * Add command to backfill IP addresses for nodes missing IPs from configured prefixes
  * Log available update as warning
  * Add autogroup:internet to Policy
  * Restore foreign keys and add constraints
  * Make registration page easier to use on mobile devices
  * Make write-ahead-log default on and configurable for SQLite
  * Add APIs for managing headscale policy
  * Fix for registering nodes using preauthkeys when running
    on a postgres database in a non-UTC timezone
  * Make sure integration tests cover postgres for all scenarios
  * CLI commands (all except serve) only requires minimal configuration
  * CLI results are now concistently sent to stdout and errors to stderr
  * Fix issue where shutting down headscale would hang
  * add shutdown that asserts if headscale had panics</changelog>
  <changelog author="mrueckert@suse.de" date="1735819200">- Fix the system integration
  - actually build and use the sysuser pre snippet so that the user
    is created before tmpfiles.d tries to create files
- no longer break debugsymbols for the binary (remove -s -w)
- use systemd macros for paths
- ensure proper requires/ordering for sysuser/systemd</changelog>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- update 0.24.3:
  * Fix migration error caused by nodes having invalid auth keys
  * Pre auth keys belonging to a user are no longer deleted with the user
  * Pre auth keys that are used by a node can no longer be deleted
- update to 0.24.2:
  * Fix issue where email and username being equal fails to match in Policy
  * Delete invalid routes before adding a NOT NULL constraint on node_id
- update to 0.24.1:
  * Fix migration issue with user table for PostgreSQL
  * Relax username validation to allow emails
  * Remove invalid routes and add stronger constraints for routes to avoid API panic
  * Fix panic when derp.update_frequency is 0
- update to 0.24.0:
  BREAKING:
  * Remove dns.use_username_in_magic_dns configuration option
  * Having usernames in magic DNS is no longer possible.
  * Remove versions older than 1.56
  * Clean up old code required by old versions
  * If you depend on a Headscale Web UI, you should wait with this update until
    the UI have been updated to match the new API.
  * GET /api/v1/user/{name} and GetUser have been removed in favour of
    ListUsers with an ID parameter
  * RenameUser and DeleteUser now require an ID instead of a name.
  CHANGES:
  * Improved compatibility of built-in DERP server with clients connecting over WebSocket
  * Allow nodes to use SSH agent forwarding
  * Fixed processing of fields in post request in MoveNode rpc
  * Added conversion of 'Hostname' to 'givenName' in a node with FQDN rules applied
  * Fixed updating of hostname and givenName when it is updated in HostInfo
  * Fixed missing stable-debug container tag
  * Loosened up server_url and base_domain check. It was overly strict in some cases
  * CLI for managing users now accepts --identifier in addition to --name,
    usage of --identifier is recommended
  * Add dns.extra_records_path configuration option
  * Support client verify for DERP
  * Add PKCE Verifier for OIDC</changelog>
  <changelog author="rrahl0@opensuse.org" date="1739448000">- update to 0.25.0:
  BREAKING:
  * Authentication flow has been rewritten
  * Remove support for Tailscale clients older than 1.62 (Capability version 87)
  CHANGES:
  * oidc.map_legacy_users is now false by default
  * Print Tailscale version instead of capability versions for outdated nodes
  * Do not allow renaming of users from OIDC
  * Change minimum hostname length to 2
  * Fix migration error caused by nodes having invalid auth keys
  * Pre auth keys belonging to a user are no longer deleted with the user
  * Pre auth keys that are used by a node can no longer be deleted
  * Rehaul HTTP errors, return better status code and errors to users</changelog>
  <changelog author="rrahl0@opensuse.org" date="1740484800">- update to 0.25.1:
  * Fix issue where registration errors are sent correctly
  * Fix issue where routes are passed on registration were not saved
  * Fix issue where registration page was displayed twice
  * fix double login URL with OIDC
  * fix routes not being saved when new nodes registers
  * hand register auth rerrors</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743508800">- add patch fix-CVE-2025-30204.patch, for fixing bsc#1240506</changelog>
  <changelog author="rrahl0@opensuse.org" date="1744804800">- add patch fix-CVEs.patch to fix bsc#1241235, bsc#1237674</changelog>
  <changelog author="rrahl0@opensuse.org" date="1745496000">- update fix-CVEs.patch for fixing bsc#1241801</changelog>
  <changelog author="rrahl0@opensuse.org" date="1747742400">- update to 0.26.0:
  * make version info in bug template more explicit
  * add git hash to binary, print on startup
  * remove oidc migration
  * use helper function for constructing state updates
  * use tsweb debugger
  * set 0.25.0 changelog date
  * activate json logs
  * use tailscale version in all unsupported errs
  * handle register auth errors
  * fix routes not being saved when new nodes registers
  * fix double login URL with OIDC
  * Redo route code
  * Experimental implementation of Policy v2
  * Drop routes table
  * Add usage example to routes flag
  * Remove leftover printf
  * remove policy handling for old capver
  * Container images are also available on GHCR
  * add faq section on scaling/performance
  * Add a FAQ entry about two nodes seeing each other
  * update bug template with debug
  * Set content-type to JSON for some debug endpoints
  * Remove coderabbit
  * add third-party tool headscale-pf
  * Explicitly handle /headscale/{config,lib,run} in container docs
  * Mention that private keys generated if needed
  * Multi network integration tests
  * OIDC: Fetch UserInfo to get EmailVerified if necessary
  * populate serving from primary routes
  * allow users to be defined with @ in v1
  * fix auto approver on register and new policy
  * Add unraid-headscale-admin web UI to docs
  * Only read relevant nodes from database in PeerChangedResponse
  * ensure final dot on node name
  * Restore support for "Override local DNS"
  * some clarifications for tags
  * Update oidc.md
  * flake: add golang-lint lsp
  * policy/v2: fix host validation, consistent pattern
  * integration: clean up unreferenced hs- networks
  * Mention "Network flow logs" as a missing feature
  * Fix goroutine leak in EphemeralGC on node cancel
  * Fix panic on fast reconnection of node
  * add casbin user test
  * config: disallow same server url and base_domain
  * policy/v2: make default
  * integration: remove failing resolvconf tests
  * fix webauth + autoapprove routes
  * types/authkey: include user object in response
  * oidc: try to get username from userinfo
  * notify nodes after owner change
  * auth: ensure that routes are autoapproved when the node is stored
  * Make matchers part of the Policy interface
  * cli/nodes: filter nodes without any routes
  * error on undefined host in policy
  * Update source.md
  * policy/v2: validate autogroup:interet only in dst
  * cmd: add policy check command
  * policy/matcher: fix bug using contains instead of overlap
  * update capmap and deps for release
  * Add documentation for routes
  * Fix deprecation warnings
  * feat: Create headscale user and group as system user/groups
  * Update container.md
  * go.mod: update rest of deps
  * Make more granular SSH tests for both Policies
  * policy: reduce routes sent to peers based on packetfilter
  * Misc doc fixes
  * app: throw away not found body
  * Remove subnet router visibility workaround from docs
  * policy/v2: validate that no undefined group or tag is used
  * cli: policy check, dont require config or log
  * policy/v2: separate exit node and 0.0.0.0/0 routes
  * Add migration steps when policy is stored in the database
  * Simplify policy migration
  * bring back last_seen in database
  * Remove map_legacy_users from example configuration
  * fix: change FormatUint base from 64 to 10 in preauthkeys list command
  * users: harden, test, and add cleaner of identifier
- remove patches fix-CVE-2025-30204.patch and fix-CVEs.patch, as upstream
  updated their dependencies</changelog>
  <changelog author="mrueckert@suse.de" date="1748779200">- Fix the ldflags to set version and commit hash again</changelog>
  <changelog author="mrueckert@suse.de" date="1748779201">- Sync default configurations</changelog>
  <changelog author="rrahl0@opensuse.org" date="1749211200">- update to 0.26.1:
  * Ensure nodes are matching both node key and machine key when connecting
  * Fix /machine/map endpoint vulnerability</changelog>
  <changelog author="rrahl0@opensuse.org" date="1760011200">- add fix-CVE-2025-58190.patch, fixing bsc#1251650
- add fix-CVE-2025-47911.patch, fixing bsc#1251479</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761652800">- Update to version 0.27.0:
  * Database integrity improvements
  * update DERPMap update frequency to 3 hrs
  * This release adds support for the three missing autogroups: self
    (experimental), member, and tagged
  * Under the hood, we have added a new datastructure to store nodes in memory
- remove patches fix-CVE-2025-58190.patch and fix-CVE-2025-47911.patch,
  fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1762948800">- Update to version 0.27.1:
  * Expire nodes with a custom timestamp
  * Fix issue where node expiry was reset when tailscaled restarts
  * Fix OIDC authentication when multiple login URLs are opened
  * Fix node re-registration failing with expired auth keys
  * Remove old unused database tables and indices
  * Ignore litestream tables during database validation
  * Fix exit node visibility to respect ACL rules
  * Fix SSH policy becoming empty when unknown user is referenced
  * Fix policy validation when using bypass-grpc mode
  * Fix autogroup:self interaction with other ACL rules
  * Fix flaky DERP map shuffle test</changelog>
  <changelog author="mrueckert@suse.de" date="1767355200">- currently setting the version and commit hash via ldflags does
  not look functional. So we patch the values in via perl for now.</changelog>
  <changelog author="rrahl0@opensuse.org" date="1770206400">- Update to version 0.28.0:
  * Minimum supported Tailscale client version: v1.74.0
  * Tags as identity
  * Smarter map updates
  * Pre-authentication key security improvements
  * Web registration templates redesign
  * Database migration support removed for pre-0.25.0 databases
  * Full changelog at
    https://github.com/juanfont/headscale/releases/tag/v0.28.0</changelog>
</package>
<package pkgid="a0e6275d7d096d190a7e207d5486ce9bc776e224fd43fb9cc50df15fc327608c" name="nebula" arch="src">
  <version epoch="0" ver="1.10.3" rel="150700.31.2"/>
  <changelog author="rrahl0@proton.me" date="1712664000">- initial packaging</changelog>
  <changelog author="rrahl0@disroot.org" date="1715860800">- update to version 1.9.0:
  * This release adds a new setting default_local_cidr_any that defaults to
    true to match previous behavior, but will default to false in the next
    release (1.10)
  * Added example service script for OpenRC
  * The SSH daemon now supports inlined host keys
  * The SSH daemon now supports certificates with sshd.trusted_cas
  * Config setting tun.unsafe_routes is now reloadable
  * Support for the deprecated local_range option has been removed
  * Remove the TCP round trip tracking metrics, as they never had correct data
  * Fixed a potential deadlock introduced in 1.8.1
  * Fixed support for Linux when IPv6 has been disabled at the OS level
  * DNS will return NXDOMAIN now when there are no results
  * Allow :: in lighthouse.dns.host
  * Capitalization of NotAfter fixed in DNS TXT response
  * Don't log invalid certificates. It is untrusted data and can cause a large
    volume of logs</changelog>
  <changelog author="rrahl0@disroot.org" date="1716984000">- update to version 1.9.1:
  * Fixed a potential deadlock in GetOrHandshake</changelog>
  <changelog author="rrahl0@disroot.org" date="1717416000">- update to version 1.9.2:
  * Ensure messageCounter is set before handshake is complete</changelog>
  <changelog author="rrahl0@disroot.org" date="1717761600">- update to version 1.9.3:
  * Initialize messageCounter to 2 instead of verifying later</changelog>
  <changelog author="rrahl0@opensuse.org" date="1725969600">- update to 1.9.4:
  * Support UDP dialing with gVisor
  * Make some Nebula state programmatically available via control object
  * Switch internal representation of IPs to netip, to prepare for IPv6 support
  * Various dependency updates
  * Fix a bug on big endian hosts, like mips
  * Fix a rare panic if a local index collision happens
  * Fix integer wraparound in the calculation of handshake timeouts on 32-bit
- build the binaries non statically
- remove enable-pie.patch as it's not needed anymore, since we build the binaries
  manually, not using the Makefile anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1733486400">- update to 1.9.5:
  * Backport reestablish relays from cert-v2 to release-1.9
  * do not panic when loading a V2 CA certificate</changelog>
  <changelog author="rrahl0@opensuse.org" date="1741780800">- add patch fix-CVE-2025-22869.patch, fixes bsc#1239387</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- update to version 1.9.6:
  * Support dropping inactive tunnels. This is disabled by default
  * Ensure the same relay tunnel is always used when multiple relay
    tunnels are present
  * Fix relay migration panic</changelog>
  <changelog author="rrahl0@opensuse.org" date="1760184000">- update to version 1.9.7:
  * Disable sending recv_error messages when a packet is received outside the
    allowable counter window
  * Improve error messages and remove some unnecessary fatal conditions in the
    generic udp listener</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765022400">- Update to version 1.10.0:
  * Support for ipv6 and multiple ipv4/6 addresses in the overlay
  * Add the ability to mark packets on linux to better target nebula packets in
    iptables/nftables
  * Add ECMP support for unsafe_routes
  * PKCS11 support for P256 keys when built with pkcs11 tag
  * default_local_cidr_any now defaults to false
  * Improve logging when a relay is in use on an inbound packet
  * Avoid fatal errors if rountines is &gt; 1 on systems that &lt;= 1
  * Log a warning if a firewall rule contains an any that negates a more
    restrictive filter
  * Accept encrypted CA passphrase from an environment variable
  * Allow handshaking with any trusted remote
  * Log only the count of blocklisted certificate fingerprints instead of the
    entire list
  * Don't fatal when the ssh server is unable to be configured successfully
  * Improve lost packet statistics
  * Honor remote_allow_list in hole punch response
- remove patch fix-CVE-2025-22869.patch, fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768910400">- Update to version 1.10.1:
  * Fix a bug where an unsafe route derived from the system route table could
    be lost on a config reload
  * Fix the PEM banner for ECDSA P256 public keys
  * Fix a bug in handshake processing when a peer sends an unexpected public key
  * Add a config option to control accepting recv_error packets which defaults
    to always</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768996800">- Update to version 1.10.2:
  * Fix panic when using use_system_route_table</changelog>
  <changelog author="rrahl0@opensuse.org" date="1770984000">- Update to version 1.10.3:
  * Fix an issue where blocklist bypass is possible when using curve P256
    Any newly issued P256 based certificates will have their signature clamped
    to the low-s form.  Nebula will assert the low-s signature form when
    validating certificates in a future version</changelog>
  <changelog author="rrahl0@opensuse.org" date="1776168000">- add the nebula-service binary</changelog>
</package>
<package pkgid="83a4ad8e8aaf23ea294bdd6301e0baf54dcd0d17d9aefac577209cbf88e800de" name="nebula" arch="x86_64">
  <version epoch="0" ver="1.10.3" rel="150700.31.2"/>
  <changelog author="rrahl0@proton.me" date="1712664000">- initial packaging</changelog>
  <changelog author="rrahl0@disroot.org" date="1715860800">- update to version 1.9.0:
  * This release adds a new setting default_local_cidr_any that defaults to
    true to match previous behavior, but will default to false in the next
    release (1.10)
  * Added example service script for OpenRC
  * The SSH daemon now supports inlined host keys
  * The SSH daemon now supports certificates with sshd.trusted_cas
  * Config setting tun.unsafe_routes is now reloadable
  * Support for the deprecated local_range option has been removed
  * Remove the TCP round trip tracking metrics, as they never had correct data
  * Fixed a potential deadlock introduced in 1.8.1
  * Fixed support for Linux when IPv6 has been disabled at the OS level
  * DNS will return NXDOMAIN now when there are no results
  * Allow :: in lighthouse.dns.host
  * Capitalization of NotAfter fixed in DNS TXT response
  * Don't log invalid certificates. It is untrusted data and can cause a large
    volume of logs</changelog>
  <changelog author="rrahl0@disroot.org" date="1716984000">- update to version 1.9.1:
  * Fixed a potential deadlock in GetOrHandshake</changelog>
  <changelog author="rrahl0@disroot.org" date="1717416000">- update to version 1.9.2:
  * Ensure messageCounter is set before handshake is complete</changelog>
  <changelog author="rrahl0@disroot.org" date="1717761600">- update to version 1.9.3:
  * Initialize messageCounter to 2 instead of verifying later</changelog>
  <changelog author="rrahl0@opensuse.org" date="1725969600">- update to 1.9.4:
  * Support UDP dialing with gVisor
  * Make some Nebula state programmatically available via control object
  * Switch internal representation of IPs to netip, to prepare for IPv6 support
  * Various dependency updates
  * Fix a bug on big endian hosts, like mips
  * Fix a rare panic if a local index collision happens
  * Fix integer wraparound in the calculation of handshake timeouts on 32-bit
- build the binaries non statically
- remove enable-pie.patch as it's not needed anymore, since we build the binaries
  manually, not using the Makefile anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1733486400">- update to 1.9.5:
  * Backport reestablish relays from cert-v2 to release-1.9
  * do not panic when loading a V2 CA certificate</changelog>
  <changelog author="rrahl0@opensuse.org" date="1741780800">- add patch fix-CVE-2025-22869.patch, fixes bsc#1239387</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- update to version 1.9.6:
  * Support dropping inactive tunnels. This is disabled by default
  * Ensure the same relay tunnel is always used when multiple relay
    tunnels are present
  * Fix relay migration panic</changelog>
  <changelog author="rrahl0@opensuse.org" date="1760184000">- update to version 1.9.7:
  * Disable sending recv_error messages when a packet is received outside the
    allowable counter window
  * Improve error messages and remove some unnecessary fatal conditions in the
    generic udp listener</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765022400">- Update to version 1.10.0:
  * Support for ipv6 and multiple ipv4/6 addresses in the overlay
  * Add the ability to mark packets on linux to better target nebula packets in
    iptables/nftables
  * Add ECMP support for unsafe_routes
  * PKCS11 support for P256 keys when built with pkcs11 tag
  * default_local_cidr_any now defaults to false
  * Improve logging when a relay is in use on an inbound packet
  * Avoid fatal errors if rountines is &gt; 1 on systems that &lt;= 1
  * Log a warning if a firewall rule contains an any that negates a more
    restrictive filter
  * Accept encrypted CA passphrase from an environment variable
  * Allow handshaking with any trusted remote
  * Log only the count of blocklisted certificate fingerprints instead of the
    entire list
  * Don't fatal when the ssh server is unable to be configured successfully
  * Improve lost packet statistics
  * Honor remote_allow_list in hole punch response
- remove patch fix-CVE-2025-22869.patch, fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768910400">- Update to version 1.10.1:
  * Fix a bug where an unsafe route derived from the system route table could
    be lost on a config reload
  * Fix the PEM banner for ECDSA P256 public keys
  * Fix a bug in handshake processing when a peer sends an unexpected public key
  * Add a config option to control accepting recv_error packets which defaults
    to always</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768996800">- Update to version 1.10.2:
  * Fix panic when using use_system_route_table</changelog>
  <changelog author="rrahl0@opensuse.org" date="1770984000">- Update to version 1.10.3:
  * Fix an issue where blocklist bypass is possible when using curve P256
    Any newly issued P256 based certificates will have their signature clamped
    to the low-s form.  Nebula will assert the low-s signature form when
    validating certificates in a future version</changelog>
  <changelog author="rrahl0@opensuse.org" date="1776168000">- add the nebula-service binary</changelog>
</package>
<package pkgid="9cfdf8198d9de19d15b74542a87c6f243b872d070d0d8c17f4202f1fb518ce6b" name="nebula-cert" arch="x86_64">
  <version epoch="0" ver="1.10.3" rel="150700.31.2"/>
  <changelog author="rrahl0@proton.me" date="1712664000">- initial packaging</changelog>
  <changelog author="rrahl0@disroot.org" date="1715860800">- update to version 1.9.0:
  * This release adds a new setting default_local_cidr_any that defaults to
    true to match previous behavior, but will default to false in the next
    release (1.10)
  * Added example service script for OpenRC
  * The SSH daemon now supports inlined host keys
  * The SSH daemon now supports certificates with sshd.trusted_cas
  * Config setting tun.unsafe_routes is now reloadable
  * Support for the deprecated local_range option has been removed
  * Remove the TCP round trip tracking metrics, as they never had correct data
  * Fixed a potential deadlock introduced in 1.8.1
  * Fixed support for Linux when IPv6 has been disabled at the OS level
  * DNS will return NXDOMAIN now when there are no results
  * Allow :: in lighthouse.dns.host
  * Capitalization of NotAfter fixed in DNS TXT response
  * Don't log invalid certificates. It is untrusted data and can cause a large
    volume of logs</changelog>
  <changelog author="rrahl0@disroot.org" date="1716984000">- update to version 1.9.1:
  * Fixed a potential deadlock in GetOrHandshake</changelog>
  <changelog author="rrahl0@disroot.org" date="1717416000">- update to version 1.9.2:
  * Ensure messageCounter is set before handshake is complete</changelog>
  <changelog author="rrahl0@disroot.org" date="1717761600">- update to version 1.9.3:
  * Initialize messageCounter to 2 instead of verifying later</changelog>
  <changelog author="rrahl0@opensuse.org" date="1725969600">- update to 1.9.4:
  * Support UDP dialing with gVisor
  * Make some Nebula state programmatically available via control object
  * Switch internal representation of IPs to netip, to prepare for IPv6 support
  * Various dependency updates
  * Fix a bug on big endian hosts, like mips
  * Fix a rare panic if a local index collision happens
  * Fix integer wraparound in the calculation of handshake timeouts on 32-bit
- build the binaries non statically
- remove enable-pie.patch as it's not needed anymore, since we build the binaries
  manually, not using the Makefile anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1733486400">- update to 1.9.5:
  * Backport reestablish relays from cert-v2 to release-1.9
  * do not panic when loading a V2 CA certificate</changelog>
  <changelog author="rrahl0@opensuse.org" date="1741780800">- add patch fix-CVE-2025-22869.patch, fixes bsc#1239387</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- update to version 1.9.6:
  * Support dropping inactive tunnels. This is disabled by default
  * Ensure the same relay tunnel is always used when multiple relay
    tunnels are present
  * Fix relay migration panic</changelog>
  <changelog author="rrahl0@opensuse.org" date="1760184000">- update to version 1.9.7:
  * Disable sending recv_error messages when a packet is received outside the
    allowable counter window
  * Improve error messages and remove some unnecessary fatal conditions in the
    generic udp listener</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765022400">- Update to version 1.10.0:
  * Support for ipv6 and multiple ipv4/6 addresses in the overlay
  * Add the ability to mark packets on linux to better target nebula packets in
    iptables/nftables
  * Add ECMP support for unsafe_routes
  * PKCS11 support for P256 keys when built with pkcs11 tag
  * default_local_cidr_any now defaults to false
  * Improve logging when a relay is in use on an inbound packet
  * Avoid fatal errors if rountines is &gt; 1 on systems that &lt;= 1
  * Log a warning if a firewall rule contains an any that negates a more
    restrictive filter
  * Accept encrypted CA passphrase from an environment variable
  * Allow handshaking with any trusted remote
  * Log only the count of blocklisted certificate fingerprints instead of the
    entire list
  * Don't fatal when the ssh server is unable to be configured successfully
  * Improve lost packet statistics
  * Honor remote_allow_list in hole punch response
- remove patch fix-CVE-2025-22869.patch, fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768910400">- Update to version 1.10.1:
  * Fix a bug where an unsafe route derived from the system route table could
    be lost on a config reload
  * Fix the PEM banner for ECDSA P256 public keys
  * Fix a bug in handshake processing when a peer sends an unexpected public key
  * Add a config option to control accepting recv_error packets which defaults
    to always</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768996800">- Update to version 1.10.2:
  * Fix panic when using use_system_route_table</changelog>
  <changelog author="rrahl0@opensuse.org" date="1770984000">- Update to version 1.10.3:
  * Fix an issue where blocklist bypass is possible when using curve P256
    Any newly issued P256 based certificates will have their signature clamped
    to the low-s form.  Nebula will assert the low-s signature form when
    validating certificates in a future version</changelog>
  <changelog author="rrahl0@opensuse.org" date="1776168000">- add the nebula-service binary</changelog>
</package>
<package pkgid="d2e7ee6588f22f2a80e48cdf0fecf89711ef4918ef3c702ac2ac4e51cd48cb39" name="nebula-cert-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.10.3" rel="150700.31.2"/>
  <changelog author="rrahl0@proton.me" date="1712664000">- initial packaging</changelog>
  <changelog author="rrahl0@disroot.org" date="1715860800">- update to version 1.9.0:
  * This release adds a new setting default_local_cidr_any that defaults to
    true to match previous behavior, but will default to false in the next
    release (1.10)
  * Added example service script for OpenRC
  * The SSH daemon now supports inlined host keys
  * The SSH daemon now supports certificates with sshd.trusted_cas
  * Config setting tun.unsafe_routes is now reloadable
  * Support for the deprecated local_range option has been removed
  * Remove the TCP round trip tracking metrics, as they never had correct data
  * Fixed a potential deadlock introduced in 1.8.1
  * Fixed support for Linux when IPv6 has been disabled at the OS level
  * DNS will return NXDOMAIN now when there are no results
  * Allow :: in lighthouse.dns.host
  * Capitalization of NotAfter fixed in DNS TXT response
  * Don't log invalid certificates. It is untrusted data and can cause a large
    volume of logs</changelog>
  <changelog author="rrahl0@disroot.org" date="1716984000">- update to version 1.9.1:
  * Fixed a potential deadlock in GetOrHandshake</changelog>
  <changelog author="rrahl0@disroot.org" date="1717416000">- update to version 1.9.2:
  * Ensure messageCounter is set before handshake is complete</changelog>
  <changelog author="rrahl0@disroot.org" date="1717761600">- update to version 1.9.3:
  * Initialize messageCounter to 2 instead of verifying later</changelog>
  <changelog author="rrahl0@opensuse.org" date="1725969600">- update to 1.9.4:
  * Support UDP dialing with gVisor
  * Make some Nebula state programmatically available via control object
  * Switch internal representation of IPs to netip, to prepare for IPv6 support
  * Various dependency updates
  * Fix a bug on big endian hosts, like mips
  * Fix a rare panic if a local index collision happens
  * Fix integer wraparound in the calculation of handshake timeouts on 32-bit
- build the binaries non statically
- remove enable-pie.patch as it's not needed anymore, since we build the binaries
  manually, not using the Makefile anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1733486400">- update to 1.9.5:
  * Backport reestablish relays from cert-v2 to release-1.9
  * do not panic when loading a V2 CA certificate</changelog>
  <changelog author="rrahl0@opensuse.org" date="1741780800">- add patch fix-CVE-2025-22869.patch, fixes bsc#1239387</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- update to version 1.9.6:
  * Support dropping inactive tunnels. This is disabled by default
  * Ensure the same relay tunnel is always used when multiple relay
    tunnels are present
  * Fix relay migration panic</changelog>
  <changelog author="rrahl0@opensuse.org" date="1760184000">- update to version 1.9.7:
  * Disable sending recv_error messages when a packet is received outside the
    allowable counter window
  * Improve error messages and remove some unnecessary fatal conditions in the
    generic udp listener</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765022400">- Update to version 1.10.0:
  * Support for ipv6 and multiple ipv4/6 addresses in the overlay
  * Add the ability to mark packets on linux to better target nebula packets in
    iptables/nftables
  * Add ECMP support for unsafe_routes
  * PKCS11 support for P256 keys when built with pkcs11 tag
  * default_local_cidr_any now defaults to false
  * Improve logging when a relay is in use on an inbound packet
  * Avoid fatal errors if rountines is &gt; 1 on systems that &lt;= 1
  * Log a warning if a firewall rule contains an any that negates a more
    restrictive filter
  * Accept encrypted CA passphrase from an environment variable
  * Allow handshaking with any trusted remote
  * Log only the count of blocklisted certificate fingerprints instead of the
    entire list
  * Don't fatal when the ssh server is unable to be configured successfully
  * Improve lost packet statistics
  * Honor remote_allow_list in hole punch response
- remove patch fix-CVE-2025-22869.patch, fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768910400">- Update to version 1.10.1:
  * Fix a bug where an unsafe route derived from the system route table could
    be lost on a config reload
  * Fix the PEM banner for ECDSA P256 public keys
  * Fix a bug in handshake processing when a peer sends an unexpected public key
  * Add a config option to control accepting recv_error packets which defaults
    to always</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768996800">- Update to version 1.10.2:
  * Fix panic when using use_system_route_table</changelog>
  <changelog author="rrahl0@opensuse.org" date="1770984000">- Update to version 1.10.3:
  * Fix an issue where blocklist bypass is possible when using curve P256
    Any newly issued P256 based certificates will have their signature clamped
    to the low-s form.  Nebula will assert the low-s signature form when
    validating certificates in a future version</changelog>
  <changelog author="rrahl0@opensuse.org" date="1776168000">- add the nebula-service binary</changelog>
</package>
<package pkgid="5c7705d23a15698ec9a8a450580096b0ffdb7305f15ec1f2077b951eaea1bf5d" name="nebula-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.10.3" rel="150700.31.2"/>
  <changelog author="rrahl0@proton.me" date="1712664000">- initial packaging</changelog>
  <changelog author="rrahl0@disroot.org" date="1715860800">- update to version 1.9.0:
  * This release adds a new setting default_local_cidr_any that defaults to
    true to match previous behavior, but will default to false in the next
    release (1.10)
  * Added example service script for OpenRC
  * The SSH daemon now supports inlined host keys
  * The SSH daemon now supports certificates with sshd.trusted_cas
  * Config setting tun.unsafe_routes is now reloadable
  * Support for the deprecated local_range option has been removed
  * Remove the TCP round trip tracking metrics, as they never had correct data
  * Fixed a potential deadlock introduced in 1.8.1
  * Fixed support for Linux when IPv6 has been disabled at the OS level
  * DNS will return NXDOMAIN now when there are no results
  * Allow :: in lighthouse.dns.host
  * Capitalization of NotAfter fixed in DNS TXT response
  * Don't log invalid certificates. It is untrusted data and can cause a large
    volume of logs</changelog>
  <changelog author="rrahl0@disroot.org" date="1716984000">- update to version 1.9.1:
  * Fixed a potential deadlock in GetOrHandshake</changelog>
  <changelog author="rrahl0@disroot.org" date="1717416000">- update to version 1.9.2:
  * Ensure messageCounter is set before handshake is complete</changelog>
  <changelog author="rrahl0@disroot.org" date="1717761600">- update to version 1.9.3:
  * Initialize messageCounter to 2 instead of verifying later</changelog>
  <changelog author="rrahl0@opensuse.org" date="1725969600">- update to 1.9.4:
  * Support UDP dialing with gVisor
  * Make some Nebula state programmatically available via control object
  * Switch internal representation of IPs to netip, to prepare for IPv6 support
  * Various dependency updates
  * Fix a bug on big endian hosts, like mips
  * Fix a rare panic if a local index collision happens
  * Fix integer wraparound in the calculation of handshake timeouts on 32-bit
- build the binaries non statically
- remove enable-pie.patch as it's not needed anymore, since we build the binaries
  manually, not using the Makefile anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1733486400">- update to 1.9.5:
  * Backport reestablish relays from cert-v2 to release-1.9
  * do not panic when loading a V2 CA certificate</changelog>
  <changelog author="rrahl0@opensuse.org" date="1741780800">- add patch fix-CVE-2025-22869.patch, fixes bsc#1239387</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- update to version 1.9.6:
  * Support dropping inactive tunnels. This is disabled by default
  * Ensure the same relay tunnel is always used when multiple relay
    tunnels are present
  * Fix relay migration panic</changelog>
  <changelog author="rrahl0@opensuse.org" date="1760184000">- update to version 1.9.7:
  * Disable sending recv_error messages when a packet is received outside the
    allowable counter window
  * Improve error messages and remove some unnecessary fatal conditions in the
    generic udp listener</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765022400">- Update to version 1.10.0:
  * Support for ipv6 and multiple ipv4/6 addresses in the overlay
  * Add the ability to mark packets on linux to better target nebula packets in
    iptables/nftables
  * Add ECMP support for unsafe_routes
  * PKCS11 support for P256 keys when built with pkcs11 tag
  * default_local_cidr_any now defaults to false
  * Improve logging when a relay is in use on an inbound packet
  * Avoid fatal errors if rountines is &gt; 1 on systems that &lt;= 1
  * Log a warning if a firewall rule contains an any that negates a more
    restrictive filter
  * Accept encrypted CA passphrase from an environment variable
  * Allow handshaking with any trusted remote
  * Log only the count of blocklisted certificate fingerprints instead of the
    entire list
  * Don't fatal when the ssh server is unable to be configured successfully
  * Improve lost packet statistics
  * Honor remote_allow_list in hole punch response
- remove patch fix-CVE-2025-22869.patch, fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768910400">- Update to version 1.10.1:
  * Fix a bug where an unsafe route derived from the system route table could
    be lost on a config reload
  * Fix the PEM banner for ECDSA P256 public keys
  * Fix a bug in handshake processing when a peer sends an unexpected public key
  * Add a config option to control accepting recv_error packets which defaults
    to always</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768996800">- Update to version 1.10.2:
  * Fix panic when using use_system_route_table</changelog>
  <changelog author="rrahl0@opensuse.org" date="1770984000">- Update to version 1.10.3:
  * Fix an issue where blocklist bypass is possible when using curve P256
    Any newly issued P256 based certificates will have their signature clamped
    to the low-s form.  Nebula will assert the low-s signature form when
    validating certificates in a future version</changelog>
  <changelog author="rrahl0@opensuse.org" date="1776168000">- add the nebula-service binary</changelog>
</package>
<package pkgid="4df555e7f01862f09a58d2a02f7beaf669ce98016a48b268949d710be16c7ea3" name="openfortivpn" arch="src">
  <version epoch="0" ver="1.24.1" rel="150700.67.1"/>
  <changelog author="mardnh@gmx.de" date="1590235200">- Update to version 1.14.1
  * fix out of bounds array access</changelog>
  <changelog author="mardnh@gmx.de" date="1599652800">- Update to version 1.15.0
  * fix issue sending pin codes
  * add command line option to bind to specific interface
  * use different hints for OTP and 2FA
  * remove password from /proc/#/cmd
  * extend OTP to allow FTM push
  * add preliminary support for host checks
  * don't accept route to the vpn gateway
  * fix byte counter in pppd_write</changelog>
  <changelog author="mardnh@gmx.de" date="1613304000">- Update to version 1.16.0
  * support for user key pass phrase
  * add a space at the end of the OTP prompt
  * modify memory allocation in the tunnel configuration structure
  * openfortivpn returns the PPP exit status
  * print SSL socket options in log</changelog>
  <changelog author="mardnh@gmx.de" date="1626436800">- Update to version 1.17.0
  * make OpenSSL engines optional
  * document and favor --pinentry over plain text password in
    configuration file
  * fix buffer overflow and other errors in URI espcaping for
  - -pinentry
  * use different --pinentry hints for different hosts, usernames
    and realms
  * fix memory management errors related to --user-agent option</changelog>
  <changelog author="mardnh@gmx.de" date="1631188800">- Updat eto version 1.17.1
  * fix regression: enable OpenSSL engines by default
  * fix typos found by codespell
  * fix LGTM alerts</changelog>
  <changelog author="jsegitz@suse.com" date="1634126400">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_openfortivpn@.service.patch</changelog>
  <changelog author="mardnh@gmx.de" date="1648728000">- Update to version 1.17.2
  * fix memory leak when reading user input
  * improve calls to getsockopt() and associated debug output
  * allow reading config from process substitution
  * work around CodeQL false positives, improving code at the same
    time
  * change type of systemd.service from simple to notify</changelog>
  <changelog author="mardnh@gmx.de" date="1651924800">- Update to version 1.17.3
  * fix regression: spurious warning message after reading config</changelog>
  <changelog author="mardnh@gmx.de" date="1665576000">- Update to version 1.19.0
  * fix "Peer refused to agree to our IP address" message
  * avoid setting duplicate routes
  * remove obsolete code that reads non-XML config from FortiOS
  * improve warning message when reading options from config file
- Update to version 1.18.0
  * add new options to delegate the authentication to external
    programs
  * minor fixes in documentation</changelog>
  <changelog author="mardnh@gmx.de" date="1677499200">- Update to versoin 1.20.1
  * Bugfix release.
- Update to versoin 1.20.0
  * Discard invalid empty HDLC frame at end of buffer.
  * Prepend "SVPNCOOKIE=" to the given cookie if missing.</changelog>
  <changelog author="mardnh@gmx.de" date="1688385600">- Update to version 1.20.5
  * revert previous fix from 1.20.4, make it optional.
- Update to version 1.20.4
  * fix "Peer refused to agree to his IP address" message.
- Update to version 1.20.3
  * minor change in a warning message.
  * documentation improvement.
  * minor changes in build and test files.
- Update to version 1.20.2
  * fix regression: do attempt to apply duplicate routes, log
    INFO instead of WARN.
  * minor changes in log messages.
- Update patch:
  * harden_openfortivpn@.service.patch</changelog>
  <changelog author="mardnh@gmx.de" date="1693137600">- Compile with support for systemd (sd_notify)</changelog>
  <changelog author="stigpro@outlook.fr" date="1702555200">- Add openfortivpn-fix-usr-bin-env.patch to fix the shebang of files
  from env to bash.</changelog>
  <changelog author="mardnh@gmx.de" date="1702555201">- Update to version 1.21.0
  * fix "Peer refused to agree to his IP address" message, again.
  * deprecate option --plugin.
  * better masking of password in logs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mardnh@gmx.de" date="1713441600">- Update to version 1.22.0
  * do not print TLS socket options in log (revert change from
    1.16.0).
  * add option to specify SNI.
  * change most occurrences of "SSL" to "TLS" in user-visible text.</changelog>
  <changelog author="mli@suse.com" date="1718884800">- Update to version 1.22.1
  * do not advertise we talk compressed HTTP - we don't</changelog>
  <changelog author="rrahl0@opensuse.org" date="1732881600">- fix an issue where an error happened with certificate logins for
  FortiOS 7.4.4 by adding fix-certificate-login-error.patch
- fix SLE12
- use pkgconfig for devel packages</changelog>
  <changelog author="rrahl0@opensuse.org" date="1739880000">- update to 1.23.1:
  * Fix Coverity defect
- update to 1.23.0:
  * Clear otp after each run
  * Fix some compiler warnings
  * Support SAML login authentication
  * tests: update checkpatch.pl from Linux kernel
  * Clear otp after initial run
  * Add Alpine Linux package to README.md
  * Work around a new checkpatch.pl warning
  * Proper size and initialisation for array data
  * Patch certificate login error for FortiOS 7.4.4
  * Support older mac0S versions that lack vdprintf()
  * tests: update checkpatch.pl from Linux kernel
- remove patch fix-certificate-login-error.patch, as the commit is
  now integrated
- use more moacros
- remove Leap &lt; 1500</changelog>
  <changelog author="mardnh@gmx.de" date="1773662400">- Update to version 1.24.1
  * fix regression where the plugin was not passed to pppd.
- Update to version 1.24.0
  * add OpenSSL 3.0+ PKCS#11 support using OSSL_STORE API.
  * add OpenSSL Engine support (with OpenSSL &lt; 3.0).
  * update package links for distros in README.
  * remove deprecated option --plugin.
  * increase the maximum size of the proxy response.
  * route: always remove wrong pppd route to self.
  * fix several Coverity warnings.
  * fix a memory leak in new ipv4_drop_wrong_route method.
  * HTTP: fixes missing '\0' in debug.
  * IO: fixes a RC use after free.
  * SSL: Avoid leaking SSL context.</changelog>
</package>
<package pkgid="550bd75a96cba3e072df7cf2eee6fe4d5f3e838467dac053589320c902657dd8" name="openfortivpn" arch="x86_64">
  <version epoch="0" ver="1.24.1" rel="150700.67.1"/>
  <changelog author="mardnh@gmx.de" date="1590235200">- Update to version 1.14.1
  * fix out of bounds array access</changelog>
  <changelog author="mardnh@gmx.de" date="1599652800">- Update to version 1.15.0
  * fix issue sending pin codes
  * add command line option to bind to specific interface
  * use different hints for OTP and 2FA
  * remove password from /proc/#/cmd
  * extend OTP to allow FTM push
  * add preliminary support for host checks
  * don't accept route to the vpn gateway
  * fix byte counter in pppd_write</changelog>
  <changelog author="mardnh@gmx.de" date="1613304000">- Update to version 1.16.0
  * support for user key pass phrase
  * add a space at the end of the OTP prompt
  * modify memory allocation in the tunnel configuration structure
  * openfortivpn returns the PPP exit status
  * print SSL socket options in log</changelog>
  <changelog author="mardnh@gmx.de" date="1626436800">- Update to version 1.17.0
  * make OpenSSL engines optional
  * document and favor --pinentry over plain text password in
    configuration file
  * fix buffer overflow and other errors in URI espcaping for
  - -pinentry
  * use different --pinentry hints for different hosts, usernames
    and realms
  * fix memory management errors related to --user-agent option</changelog>
  <changelog author="mardnh@gmx.de" date="1631188800">- Updat eto version 1.17.1
  * fix regression: enable OpenSSL engines by default
  * fix typos found by codespell
  * fix LGTM alerts</changelog>
  <changelog author="jsegitz@suse.com" date="1634126400">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_openfortivpn@.service.patch</changelog>
  <changelog author="mardnh@gmx.de" date="1648728000">- Update to version 1.17.2
  * fix memory leak when reading user input
  * improve calls to getsockopt() and associated debug output
  * allow reading config from process substitution
  * work around CodeQL false positives, improving code at the same
    time
  * change type of systemd.service from simple to notify</changelog>
  <changelog author="mardnh@gmx.de" date="1651924800">- Update to version 1.17.3
  * fix regression: spurious warning message after reading config</changelog>
  <changelog author="mardnh@gmx.de" date="1665576000">- Update to version 1.19.0
  * fix "Peer refused to agree to our IP address" message
  * avoid setting duplicate routes
  * remove obsolete code that reads non-XML config from FortiOS
  * improve warning message when reading options from config file
- Update to version 1.18.0
  * add new options to delegate the authentication to external
    programs
  * minor fixes in documentation</changelog>
  <changelog author="mardnh@gmx.de" date="1677499200">- Update to versoin 1.20.1
  * Bugfix release.
- Update to versoin 1.20.0
  * Discard invalid empty HDLC frame at end of buffer.
  * Prepend "SVPNCOOKIE=" to the given cookie if missing.</changelog>
  <changelog author="mardnh@gmx.de" date="1688385600">- Update to version 1.20.5
  * revert previous fix from 1.20.4, make it optional.
- Update to version 1.20.4
  * fix "Peer refused to agree to his IP address" message.
- Update to version 1.20.3
  * minor change in a warning message.
  * documentation improvement.
  * minor changes in build and test files.
- Update to version 1.20.2
  * fix regression: do attempt to apply duplicate routes, log
    INFO instead of WARN.
  * minor changes in log messages.
- Update patch:
  * harden_openfortivpn@.service.patch</changelog>
  <changelog author="mardnh@gmx.de" date="1693137600">- Compile with support for systemd (sd_notify)</changelog>
  <changelog author="stigpro@outlook.fr" date="1702555200">- Add openfortivpn-fix-usr-bin-env.patch to fix the shebang of files
  from env to bash.</changelog>
  <changelog author="mardnh@gmx.de" date="1702555201">- Update to version 1.21.0
  * fix "Peer refused to agree to his IP address" message, again.
  * deprecate option --plugin.
  * better masking of password in logs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mardnh@gmx.de" date="1713441600">- Update to version 1.22.0
  * do not print TLS socket options in log (revert change from
    1.16.0).
  * add option to specify SNI.
  * change most occurrences of "SSL" to "TLS" in user-visible text.</changelog>
  <changelog author="mli@suse.com" date="1718884800">- Update to version 1.22.1
  * do not advertise we talk compressed HTTP - we don't</changelog>
  <changelog author="rrahl0@opensuse.org" date="1732881600">- fix an issue where an error happened with certificate logins for
  FortiOS 7.4.4 by adding fix-certificate-login-error.patch
- fix SLE12
- use pkgconfig for devel packages</changelog>
  <changelog author="rrahl0@opensuse.org" date="1739880000">- update to 1.23.1:
  * Fix Coverity defect
- update to 1.23.0:
  * Clear otp after each run
  * Fix some compiler warnings
  * Support SAML login authentication
  * tests: update checkpatch.pl from Linux kernel
  * Clear otp after initial run
  * Add Alpine Linux package to README.md
  * Work around a new checkpatch.pl warning
  * Proper size and initialisation for array data
  * Patch certificate login error for FortiOS 7.4.4
  * Support older mac0S versions that lack vdprintf()
  * tests: update checkpatch.pl from Linux kernel
- remove patch fix-certificate-login-error.patch, as the commit is
  now integrated
- use more moacros
- remove Leap &lt; 1500</changelog>
  <changelog author="mardnh@gmx.de" date="1773662400">- Update to version 1.24.1
  * fix regression where the plugin was not passed to pppd.
- Update to version 1.24.0
  * add OpenSSL 3.0+ PKCS#11 support using OSSL_STORE API.
  * add OpenSSL Engine support (with OpenSSL &lt; 3.0).
  * update package links for distros in README.
  * remove deprecated option --plugin.
  * increase the maximum size of the proxy response.
  * route: always remove wrong pppd route to self.
  * fix several Coverity warnings.
  * fix a memory leak in new ipv4_drop_wrong_route method.
  * HTTP: fixes missing '\0' in debug.
  * IO: fixes a RC use after free.
  * SSL: Avoid leaking SSL context.</changelog>
</package>
<package pkgid="3da258ead4b351517f6b39e63df8960ad9e5080d78ba1ba312d3030dcf6bd405" name="openfortivpn-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.24.1" rel="150700.67.1"/>
  <changelog author="mardnh@gmx.de" date="1590235200">- Update to version 1.14.1
  * fix out of bounds array access</changelog>
  <changelog author="mardnh@gmx.de" date="1599652800">- Update to version 1.15.0
  * fix issue sending pin codes
  * add command line option to bind to specific interface
  * use different hints for OTP and 2FA
  * remove password from /proc/#/cmd
  * extend OTP to allow FTM push
  * add preliminary support for host checks
  * don't accept route to the vpn gateway
  * fix byte counter in pppd_write</changelog>
  <changelog author="mardnh@gmx.de" date="1613304000">- Update to version 1.16.0
  * support for user key pass phrase
  * add a space at the end of the OTP prompt
  * modify memory allocation in the tunnel configuration structure
  * openfortivpn returns the PPP exit status
  * print SSL socket options in log</changelog>
  <changelog author="mardnh@gmx.de" date="1626436800">- Update to version 1.17.0
  * make OpenSSL engines optional
  * document and favor --pinentry over plain text password in
    configuration file
  * fix buffer overflow and other errors in URI espcaping for
  - -pinentry
  * use different --pinentry hints for different hosts, usernames
    and realms
  * fix memory management errors related to --user-agent option</changelog>
  <changelog author="mardnh@gmx.de" date="1631188800">- Updat eto version 1.17.1
  * fix regression: enable OpenSSL engines by default
  * fix typos found by codespell
  * fix LGTM alerts</changelog>
  <changelog author="jsegitz@suse.com" date="1634126400">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_openfortivpn@.service.patch</changelog>
  <changelog author="mardnh@gmx.de" date="1648728000">- Update to version 1.17.2
  * fix memory leak when reading user input
  * improve calls to getsockopt() and associated debug output
  * allow reading config from process substitution
  * work around CodeQL false positives, improving code at the same
    time
  * change type of systemd.service from simple to notify</changelog>
  <changelog author="mardnh@gmx.de" date="1651924800">- Update to version 1.17.3
  * fix regression: spurious warning message after reading config</changelog>
  <changelog author="mardnh@gmx.de" date="1665576000">- Update to version 1.19.0
  * fix "Peer refused to agree to our IP address" message
  * avoid setting duplicate routes
  * remove obsolete code that reads non-XML config from FortiOS
  * improve warning message when reading options from config file
- Update to version 1.18.0
  * add new options to delegate the authentication to external
    programs
  * minor fixes in documentation</changelog>
  <changelog author="mardnh@gmx.de" date="1677499200">- Update to versoin 1.20.1
  * Bugfix release.
- Update to versoin 1.20.0
  * Discard invalid empty HDLC frame at end of buffer.
  * Prepend "SVPNCOOKIE=" to the given cookie if missing.</changelog>
  <changelog author="mardnh@gmx.de" date="1688385600">- Update to version 1.20.5
  * revert previous fix from 1.20.4, make it optional.
- Update to version 1.20.4
  * fix "Peer refused to agree to his IP address" message.
- Update to version 1.20.3
  * minor change in a warning message.
  * documentation improvement.
  * minor changes in build and test files.
- Update to version 1.20.2
  * fix regression: do attempt to apply duplicate routes, log
    INFO instead of WARN.
  * minor changes in log messages.
- Update patch:
  * harden_openfortivpn@.service.patch</changelog>
  <changelog author="mardnh@gmx.de" date="1693137600">- Compile with support for systemd (sd_notify)</changelog>
  <changelog author="stigpro@outlook.fr" date="1702555200">- Add openfortivpn-fix-usr-bin-env.patch to fix the shebang of files
  from env to bash.</changelog>
  <changelog author="mardnh@gmx.de" date="1702555201">- Update to version 1.21.0
  * fix "Peer refused to agree to his IP address" message, again.
  * deprecate option --plugin.
  * better masking of password in logs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mardnh@gmx.de" date="1713441600">- Update to version 1.22.0
  * do not print TLS socket options in log (revert change from
    1.16.0).
  * add option to specify SNI.
  * change most occurrences of "SSL" to "TLS" in user-visible text.</changelog>
  <changelog author="mli@suse.com" date="1718884800">- Update to version 1.22.1
  * do not advertise we talk compressed HTTP - we don't</changelog>
  <changelog author="rrahl0@opensuse.org" date="1732881600">- fix an issue where an error happened with certificate logins for
  FortiOS 7.4.4 by adding fix-certificate-login-error.patch
- fix SLE12
- use pkgconfig for devel packages</changelog>
  <changelog author="rrahl0@opensuse.org" date="1739880000">- update to 1.23.1:
  * Fix Coverity defect
- update to 1.23.0:
  * Clear otp after each run
  * Fix some compiler warnings
  * Support SAML login authentication
  * tests: update checkpatch.pl from Linux kernel
  * Clear otp after initial run
  * Add Alpine Linux package to README.md
  * Work around a new checkpatch.pl warning
  * Proper size and initialisation for array data
  * Patch certificate login error for FortiOS 7.4.4
  * Support older mac0S versions that lack vdprintf()
  * tests: update checkpatch.pl from Linux kernel
- remove patch fix-certificate-login-error.patch, as the commit is
  now integrated
- use more moacros
- remove Leap &lt; 1500</changelog>
  <changelog author="mardnh@gmx.de" date="1773662400">- Update to version 1.24.1
  * fix regression where the plugin was not passed to pppd.
- Update to version 1.24.0
  * add OpenSSL 3.0+ PKCS#11 support using OSSL_STORE API.
  * add OpenSSL Engine support (with OpenSSL &lt; 3.0).
  * update package links for distros in README.
  * remove deprecated option --plugin.
  * increase the maximum size of the proxy response.
  * route: always remove wrong pppd route to self.
  * fix several Coverity warnings.
  * fix a memory leak in new ipv4_drop_wrong_route method.
  * HTTP: fixes missing '\0' in debug.
  * IO: fixes a RC use after free.
  * SSL: Avoid leaking SSL context.</changelog>
</package>
<package pkgid="4cbea58672e52324a90d1ba4c653b4d3583d3bc6c2b9bd005a8bc6fbdfc024dd" name="openfortivpn-debugsource" arch="x86_64">
  <version epoch="0" ver="1.24.1" rel="150700.67.1"/>
  <changelog author="mardnh@gmx.de" date="1590235200">- Update to version 1.14.1
  * fix out of bounds array access</changelog>
  <changelog author="mardnh@gmx.de" date="1599652800">- Update to version 1.15.0
  * fix issue sending pin codes
  * add command line option to bind to specific interface
  * use different hints for OTP and 2FA
  * remove password from /proc/#/cmd
  * extend OTP to allow FTM push
  * add preliminary support for host checks
  * don't accept route to the vpn gateway
  * fix byte counter in pppd_write</changelog>
  <changelog author="mardnh@gmx.de" date="1613304000">- Update to version 1.16.0
  * support for user key pass phrase
  * add a space at the end of the OTP prompt
  * modify memory allocation in the tunnel configuration structure
  * openfortivpn returns the PPP exit status
  * print SSL socket options in log</changelog>
  <changelog author="mardnh@gmx.de" date="1626436800">- Update to version 1.17.0
  * make OpenSSL engines optional
  * document and favor --pinentry over plain text password in
    configuration file
  * fix buffer overflow and other errors in URI espcaping for
  - -pinentry
  * use different --pinentry hints for different hosts, usernames
    and realms
  * fix memory management errors related to --user-agent option</changelog>
  <changelog author="mardnh@gmx.de" date="1631188800">- Updat eto version 1.17.1
  * fix regression: enable OpenSSL engines by default
  * fix typos found by codespell
  * fix LGTM alerts</changelog>
  <changelog author="jsegitz@suse.com" date="1634126400">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_openfortivpn@.service.patch</changelog>
  <changelog author="mardnh@gmx.de" date="1648728000">- Update to version 1.17.2
  * fix memory leak when reading user input
  * improve calls to getsockopt() and associated debug output
  * allow reading config from process substitution
  * work around CodeQL false positives, improving code at the same
    time
  * change type of systemd.service from simple to notify</changelog>
  <changelog author="mardnh@gmx.de" date="1651924800">- Update to version 1.17.3
  * fix regression: spurious warning message after reading config</changelog>
  <changelog author="mardnh@gmx.de" date="1665576000">- Update to version 1.19.0
  * fix "Peer refused to agree to our IP address" message
  * avoid setting duplicate routes
  * remove obsolete code that reads non-XML config from FortiOS
  * improve warning message when reading options from config file
- Update to version 1.18.0
  * add new options to delegate the authentication to external
    programs
  * minor fixes in documentation</changelog>
  <changelog author="mardnh@gmx.de" date="1677499200">- Update to versoin 1.20.1
  * Bugfix release.
- Update to versoin 1.20.0
  * Discard invalid empty HDLC frame at end of buffer.
  * Prepend "SVPNCOOKIE=" to the given cookie if missing.</changelog>
  <changelog author="mardnh@gmx.de" date="1688385600">- Update to version 1.20.5
  * revert previous fix from 1.20.4, make it optional.
- Update to version 1.20.4
  * fix "Peer refused to agree to his IP address" message.
- Update to version 1.20.3
  * minor change in a warning message.
  * documentation improvement.
  * minor changes in build and test files.
- Update to version 1.20.2
  * fix regression: do attempt to apply duplicate routes, log
    INFO instead of WARN.
  * minor changes in log messages.
- Update patch:
  * harden_openfortivpn@.service.patch</changelog>
  <changelog author="mardnh@gmx.de" date="1693137600">- Compile with support for systemd (sd_notify)</changelog>
  <changelog author="stigpro@outlook.fr" date="1702555200">- Add openfortivpn-fix-usr-bin-env.patch to fix the shebang of files
  from env to bash.</changelog>
  <changelog author="mardnh@gmx.de" date="1702555201">- Update to version 1.21.0
  * fix "Peer refused to agree to his IP address" message, again.
  * deprecate option --plugin.
  * better masking of password in logs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mardnh@gmx.de" date="1713441600">- Update to version 1.22.0
  * do not print TLS socket options in log (revert change from
    1.16.0).
  * add option to specify SNI.
  * change most occurrences of "SSL" to "TLS" in user-visible text.</changelog>
  <changelog author="mli@suse.com" date="1718884800">- Update to version 1.22.1
  * do not advertise we talk compressed HTTP - we don't</changelog>
  <changelog author="rrahl0@opensuse.org" date="1732881600">- fix an issue where an error happened with certificate logins for
  FortiOS 7.4.4 by adding fix-certificate-login-error.patch
- fix SLE12
- use pkgconfig for devel packages</changelog>
  <changelog author="rrahl0@opensuse.org" date="1739880000">- update to 1.23.1:
  * Fix Coverity defect
- update to 1.23.0:
  * Clear otp after each run
  * Fix some compiler warnings
  * Support SAML login authentication
  * tests: update checkpatch.pl from Linux kernel
  * Clear otp after initial run
  * Add Alpine Linux package to README.md
  * Work around a new checkpatch.pl warning
  * Proper size and initialisation for array data
  * Patch certificate login error for FortiOS 7.4.4
  * Support older mac0S versions that lack vdprintf()
  * tests: update checkpatch.pl from Linux kernel
- remove patch fix-certificate-login-error.patch, as the commit is
  now integrated
- use more moacros
- remove Leap &lt; 1500</changelog>
  <changelog author="mardnh@gmx.de" date="1773662400">- Update to version 1.24.1
  * fix regression where the plugin was not passed to pppd.
- Update to version 1.24.0
  * add OpenSSL 3.0+ PKCS#11 support using OSSL_STORE API.
  * add OpenSSL Engine support (with OpenSSL &lt; 3.0).
  * update package links for distros in README.
  * remove deprecated option --plugin.
  * increase the maximum size of the proxy response.
  * route: always remove wrong pppd route to self.
  * fix several Coverity warnings.
  * fix a memory leak in new ipv4_drop_wrong_route method.
  * HTTP: fixes missing '\0' in debug.
  * IO: fixes a RC use after free.
  * SSL: Avoid leaking SSL context.</changelog>
</package>
<package pkgid="43cd0097433e09be0922e6912a5b4ce72e8327c58692094e8cd75f47e6694921" name="openvpn" arch="src">
  <version epoch="0" ver="2.6.14" rel="150700.254.1"/>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
</package>
<package pkgid="bbea7fdc506b92b005ae7ec9adb7010292fdb1690d3bbaef2348d1938479cb95" name="openvpn" arch="x86_64">
  <version epoch="0" ver="2.6.14" rel="150700.254.1"/>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
</package>
<package pkgid="8b958bacedc553b592dc84b35610926bca70852109991fb4ad86f8dbda07ad49" name="openvpn-auth-pam-plugin" arch="x86_64">
  <version epoch="0" ver="2.6.14" rel="150700.254.1"/>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
</package>
<package pkgid="617cd6f3cb698fddcf729726764f5d5555a1783fc2300c4f906549187b715b9c" name="openvpn-auth-pam-plugin-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.6.14" rel="150700.254.1"/>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
</package>
<package pkgid="97a6c0f32e954140b8669d9a04558da8628ad5ff65d651d25d5ea7d44584d0c5" name="openvpn-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.6.14" rel="150700.254.1"/>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
</package>
<package pkgid="d11b2a62ae9f78ca8bbd4160572c2b786ccdf9f66a15a13ac2d2864b027e6cbe" name="openvpn-debugsource" arch="x86_64">
  <version epoch="0" ver="2.6.14" rel="150700.254.1"/>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
</package>
<package pkgid="ce6e9131d827ee4bce0fc680124b6fdbba7286dd44abab8adf98465c70f99b18" name="openvpn-devel" arch="x86_64">
  <version epoch="0" ver="2.6.14" rel="150700.254.1"/>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
</package>
<package pkgid="061809ac68c1dfd618f9dd72aa8af75ce2433a1e6cfc657cf091a125d722216a" name="openvpn-down-root-plugin" arch="x86_64">
  <version epoch="0" ver="2.6.14" rel="150700.254.1"/>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
</package>
<package pkgid="1ee7b3d7d3690ef12a0544d6b9dcef3fe97cc6a92da721d41624078f9b319815" name="openvpn-down-root-plugin-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.6.14" rel="150700.254.1"/>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
</package>
<package pkgid="86030941a4a5dc9234d040759eb1581238b857a3e518804e30c8ff17f726557a" name="ovpn-dco" arch="src">
  <version epoch="0" ver="0.2.20241216~git0.a08b2fd" rel="150700.21.6"/>
  <changelog author="jeffm@suse.com" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="jeffm@suse.com" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="jeffm@suse.com" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="jslaby@suse.cz" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="msuchanek@suse.de" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
</package>
<package pkgid="377113a22466cd4dbfe2be0740ff2e9a86998e3ab3200b95786a6b1ccef2c6d8" name="ovpn-dco-debugsource" arch="x86_64">
  <version epoch="0" ver="0.2.20241216~git0.a08b2fd" rel="150700.21.6"/>
  <changelog author="jeffm@suse.com" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="jeffm@suse.com" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="jeffm@suse.com" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="jslaby@suse.cz" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="msuchanek@suse.de" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
</package>
<package pkgid="46aebc1e570048b762a614d6357c68d2abadd2c3be5e2e17ff088b53bd4c79bc" name="ovpn-dco-kmp-default" arch="x86_64">
  <version epoch="0" ver="0.2.20241216~git0.a08b2fd_k6.4.0_150700.53.55" rel="150700.21.6"/>
  <changelog author="jeffm@suse.com" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="jeffm@suse.com" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="jeffm@suse.com" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="jslaby@suse.cz" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="msuchanek@suse.de" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
</package>
<package pkgid="ea53a6f489a1d738f3eae833bcd9d4147039d9caba0788c2bfad67169e7fb1af" name="ovpn-dco-kmp-default-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.2.20241216~git0.a08b2fd_k6.4.0_150700.53.55" rel="150700.21.6"/>
  <changelog author="jeffm@suse.com" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="jeffm@suse.com" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="jeffm@suse.com" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="jslaby@suse.cz" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="msuchanek@suse.de" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
</package>
<package pkgid="d661e363e264a7abcb5a9b3cf8b316e7c8ebed5779d0b4a2cd923b81e09c20f1" name="proton-vpn" arch="noarch">
  <version epoch="0" ver="4.15.0" rel="150700.20.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1707480000">- Initial revision</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1711022400">- Update to 4.2.0
  * Add overlay when connecting to server
  * Upon logging out or quitting, inform the user about the kill switch status
  * Apply kill switch settings immediately
  * Add permanent option to kill switch setting
  * Fix minor bug in country row initialization</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1716379200">- Add setup-data-files.patch to fix erroneous files being installed
- Update package
  * 4.3.2
  - We no longer call UsageReporting.init to initialize UsageReporting.
  - Only initialize sentry on first enable.
  - Forward SSL_CERT_FILE environment variable to sentry.
  * 4.3.1
  - Ensure behavioral consistency when opening settings window across different distributions
  - Update label alignment on disable kill switch widget at login
  - Missed the minimum python3-proton-vpn-api-core version in build_packages.py
  - Switch to using sessions module that is now bundled with vpn-api-core
  - Update wireguard certificate request when settings are changed
  - Add connection features to the wireguard certificate request
  - Periodically refresh certificate
  * 4.3.0
  - Provide the possibility to disable Kill Switch if user is logged out and Kill Switch is set to permanent
  - Ensure that protocol list in settings UI is properly capitalized and alphabetically ordered
  - Anonymous crash reports are now sent by default, this can be disabled in the settings
  - Change how we build debian and rpm packages. We now depend on a single versions.yml file to build everything
  - Increase minimum number of characters required for bug report description</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1731412800">- Update package to 4.7.4:
  * Fix bug when opening settings window, if installed via unsupported methods the early access toggle would crash.
  * Fix bug when opening the settings window and advanced kill switch is enabled the settings would crash.
  * Update kill switch and protocol label, clarifying that they can be switched only when disconnected from vpn
  * Fix introduced regression as it was no longer deactivating the selection of protocol and kill switch while being connected to VPN
  * Add start-app-minimized to settings window
  * Remove killswitch dependencies in setup.py as packages have been deprecated
  * Merge community MR to allow the app to start minimized based on CLI arguments
  * Drop secret service package
  * Drop logger package
  * Fix regression when moving refreshers
  * Move refreshers to core API
  * Add back scheduler after memory leak fix
  * When toggling IPv6 ensure that user is notified that a reconnection is necessary and prevent certificate refresh
  * Add IPv6 toggle to settings window
  * Switch back to old scheduler due to memory leak in new one
  * Show VPN accelerator setting disabled to free users
  * Don't display reconnect message when connected via WireGuard protocol and settings are switched
  * Changes due to api-core refactor
  * Request connection features via local agent if available.
  * Added a MaximumSessionsReached event to the list of events that can be emitted.
  * Update package URL used by early release settings toggle.
  * Refresh certificate whenever the app receives an expired certificate event.
  * Only display WireGuard protocol if already selected or if feature flag is enabled, otherwise hide it.
  * Fix wrong imports after core api refactor.
  * Implement and refresh feature flags.
  * When early access is toggled, ensure that repo package can be downloaded, otherwise display error message.
  * Add early access toggle to settings window.
  * Move the scripts for generating the changelogs into a separate repo.
  * Only allow kill switch settings modifications when disconnected from the VPN.
  * Log the user out on session expired error while updating certificate.
  * Implement exponential backoff when retrying to refresh certificate.
  * Fix task scheduler after suspending/resuming the computer.
  * Refactor settings to ensure the settings file isn't created when we retrieve it.
  * Disable protocol selection if user is connected to vpn.
- Remove setup-data-files.patch</changelog>
  <changelog author="raspherdev@pm.me" date="1743422400">- Update package to 4.9.5
  * [VPNLINUX-1066] Add custom dns setting to settings window.
  * [VPNLINUX-1080] Settings not opening due to early access toggle crashing.
  * [VPNLINUX-1076] Improve custom DNS.
  * [VPNLINUX-1055] Added semgrep scanning to CI
  * [VPNLINUX-1070] Introduce pop-up for conflicting features (netshield/custom dns)
  * [VPNLINUX-1086] Add reconnection warning when enabling custom DNS.
  * [VPNLINUX-1074] Drop support for Ubuntu 20.04
  * [VPNLINUX-1089] Fix kill switch leak on quit.
  * [VPNLINUX-1096] Add final URL to 'learn more' link buttons.
  * [VPNLINUX-1106] Update release package version used for beta toggle
  * [VPNLINUX-1079] Ensure UI is using latest feature flags after login.
  * [VPNLINUX-1132] Ensure app does not crash when attempting to logout after doing a search.
  * [VPNLINUX-1128] Display forwarded port if available.
  * [VPNLINUX-1128] Only display port if environment variable is set.
  * [VPNLINUX-1134] Display server load in search results
  * [VPNLINUX-1117] Include beta branch on version metadata.
  * [VPNLINUX-1116] Remove code related to old feature flags.
  * [VPNLINUX-1145] Re-implement tests and clean-up code.
  * [VPNLINUX-1144] Replace deprecated method.
  * Remove save_setting when building UI.
  * [VPNLINUX-949] Fix cancel connection button
  * [VPNLINUX-949] update changelog
  * [VPNLINUX-1129] Show port forwarding desktop notification
  * [VPNLINUX-1169] Switch DisplayPortForwarding env var to Feature Flag
  * [VPNLINUX-1168] Customize Port Forwarding notification
  * [VPNLINUX-1167] Update api-core dependency
  * [VPNLINUX-1168] Minor changes to wording of port forwarding user interface
  * [VPNLINUX-1181] add linux referral to sign-up URL
  * [VPNLINUX-1176] Fix crash when quitting the app while connected and PF is enabled</changelog>
  <changelog author="rrahl0@opensuse.org" date="1744113600">- update to 4.9.6:
  * nothing of relevance
- update spec file:
  * switch to autosetup
  * remove update-dekstop-files
  * switch to pyproject macros
  * use sle15 macros for defining which python version</changelog>
  <changelog author="i@guoyunhe.me" date="1762084800">- Update to 4.12.0:
  * feat: Support 2fa hard-jailing (Luke Titley)
  * fix: Update spec file (Alexandru Cheltuitor)
  * feat: Handle U2F PIN (Pep Llaneras)
- Update to 4.11.0:
  * feat: add 2fa security device verification (Alexandru Cheltuitor, Luke Titley, Pep Llaneras)
  * fix: change ST toaster for include mode (Pep Llaneras)
  * fix: fix add window title word duplication (Alexandru Cheltuitor)
  * fix: ensure label mode is updated when switching modes (Alexandru Cheltuitor)
  * feat: add include mode (Alexandru Cheltuitor, Luke Titley, Pep Llaneras)
  * fix: hide proton vpn app from st (Alexandru Cheltuitor)
- Update to 4.10.0:
  * Implement app based split tunneling (Alexandru Cheltuitor, Josep Llaneras, Luke Titley)
- Update to 4.9.7:
  * Update early access stable and beta packages
  * Ensures beta toggling uses correct apt command for debian based distributions
  * Fixes beta toggle activating with incoherent distribution detection
  * Fixes server button not reflecting current connection state
  * Removes reconnect message for Netshield, port forwarding, vpn accelerator and Moderate NAT settings changes</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774180800">= Update to version 4.15.0:
  * fix: [VPNLINUX-1563] Accessibility improvements
  * feat: [VPNLINUX-1571] show connect button on hover
  * fix: [VPNLINUX-1584] tray detection
  * fix: [VPNLINUX-1570] preserve expanded rows on server list refresh
  * fix: [VPNLINUX-1571] show upgrade link on hover
  * feat: [VPNLINUX-1565] show secure core servers group
  * fix: [VPNLINUX-1576] make menu button visible on KDE
  * fix: [VPNLINUX-1565] show paid servers first to paid users
  * feat: [VPNLINUX-1565] add double flag icon to secure core rows
  * fix: [VPNLINUX-1565] customize button tooltips for secure core
  * fix: [VPNLINUX-1565] smoothen row collapse
- Update to version 4.14.2
  * feat: [VPNLINUX-1538] Add cities
  * feat: [VPNLINUX-1562] add search by city
  * [VPNLINUX-1599] Feature flag cleanup
- Update to version 4.14.1:
  * fix: [VPNLINUX-1524] Log failed sign in attempt
- Update to version 4.14.0:
  * [VPNLINUX-1488] migrate to GTK4
  * [VPNLINUX-1520] fix memory leak
- Update to version 4.13.1:
  * fix: [VPNLINUX-1439] Handle desktop file parsing errors
- Update to version 4.13.0:
  * fix: [VPNLINUX-1427] Clear keyring on cancelled 2FA
  * fix: [VPNLINUX-1427] Fix login stack GTK warnings
  * fix: [VPNLINUX-1412] Show security key as default 2FA option
  * chore: [VPNLINUX-735] Remove outdated tests
  * chore: [VPNLINUX-1310] Switch to new versioning strategy
  * fix: [VPNLINUX-1412] Hide security key form when no keys are registered
  * fix: [VPNLINUX-1418] remove environment variable that limits security
- remove deprecated group
- remove proton-vpn-network-manager as a build and runtime dep, as
  that got deprecated (gets replaced by proton-vpn-api-core)</changelog>
  <changelog author="rrahl0@opensuse.org" date="1777636800">- Fix SLE 15 SP7 build, by adding python-wheel as a dependency</changelog>
</package>
<package pkgid="bd9cf4a8b066422b843375cf15a0194c4517f8d37a59c6b9a9dd9e56c79fd69f" name="proton-vpn" arch="src">
  <version epoch="0" ver="4.15.0" rel="150700.20.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1707480000">- Initial revision</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1711022400">- Update to 4.2.0
  * Add overlay when connecting to server
  * Upon logging out or quitting, inform the user about the kill switch status
  * Apply kill switch settings immediately
  * Add permanent option to kill switch setting
  * Fix minor bug in country row initialization</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1716379200">- Add setup-data-files.patch to fix erroneous files being installed
- Update package
  * 4.3.2
  - We no longer call UsageReporting.init to initialize UsageReporting.
  - Only initialize sentry on first enable.
  - Forward SSL_CERT_FILE environment variable to sentry.
  * 4.3.1
  - Ensure behavioral consistency when opening settings window across different distributions
  - Update label alignment on disable kill switch widget at login
  - Missed the minimum python3-proton-vpn-api-core version in build_packages.py
  - Switch to using sessions module that is now bundled with vpn-api-core
  - Update wireguard certificate request when settings are changed
  - Add connection features to the wireguard certificate request
  - Periodically refresh certificate
  * 4.3.0
  - Provide the possibility to disable Kill Switch if user is logged out and Kill Switch is set to permanent
  - Ensure that protocol list in settings UI is properly capitalized and alphabetically ordered
  - Anonymous crash reports are now sent by default, this can be disabled in the settings
  - Change how we build debian and rpm packages. We now depend on a single versions.yml file to build everything
  - Increase minimum number of characters required for bug report description</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1731412800">- Update package to 4.7.4:
  * Fix bug when opening settings window, if installed via unsupported methods the early access toggle would crash.
  * Fix bug when opening the settings window and advanced kill switch is enabled the settings would crash.
  * Update kill switch and protocol label, clarifying that they can be switched only when disconnected from vpn
  * Fix introduced regression as it was no longer deactivating the selection of protocol and kill switch while being connected to VPN
  * Add start-app-minimized to settings window
  * Remove killswitch dependencies in setup.py as packages have been deprecated
  * Merge community MR to allow the app to start minimized based on CLI arguments
  * Drop secret service package
  * Drop logger package
  * Fix regression when moving refreshers
  * Move refreshers to core API
  * Add back scheduler after memory leak fix
  * When toggling IPv6 ensure that user is notified that a reconnection is necessary and prevent certificate refresh
  * Add IPv6 toggle to settings window
  * Switch back to old scheduler due to memory leak in new one
  * Show VPN accelerator setting disabled to free users
  * Don't display reconnect message when connected via WireGuard protocol and settings are switched
  * Changes due to api-core refactor
  * Request connection features via local agent if available.
  * Added a MaximumSessionsReached event to the list of events that can be emitted.
  * Update package URL used by early release settings toggle.
  * Refresh certificate whenever the app receives an expired certificate event.
  * Only display WireGuard protocol if already selected or if feature flag is enabled, otherwise hide it.
  * Fix wrong imports after core api refactor.
  * Implement and refresh feature flags.
  * When early access is toggled, ensure that repo package can be downloaded, otherwise display error message.
  * Add early access toggle to settings window.
  * Move the scripts for generating the changelogs into a separate repo.
  * Only allow kill switch settings modifications when disconnected from the VPN.
  * Log the user out on session expired error while updating certificate.
  * Implement exponential backoff when retrying to refresh certificate.
  * Fix task scheduler after suspending/resuming the computer.
  * Refactor settings to ensure the settings file isn't created when we retrieve it.
  * Disable protocol selection if user is connected to vpn.
- Remove setup-data-files.patch</changelog>
  <changelog author="raspherdev@pm.me" date="1743422400">- Update package to 4.9.5
  * [VPNLINUX-1066] Add custom dns setting to settings window.
  * [VPNLINUX-1080] Settings not opening due to early access toggle crashing.
  * [VPNLINUX-1076] Improve custom DNS.
  * [VPNLINUX-1055] Added semgrep scanning to CI
  * [VPNLINUX-1070] Introduce pop-up for conflicting features (netshield/custom dns)
  * [VPNLINUX-1086] Add reconnection warning when enabling custom DNS.
  * [VPNLINUX-1074] Drop support for Ubuntu 20.04
  * [VPNLINUX-1089] Fix kill switch leak on quit.
  * [VPNLINUX-1096] Add final URL to 'learn more' link buttons.
  * [VPNLINUX-1106] Update release package version used for beta toggle
  * [VPNLINUX-1079] Ensure UI is using latest feature flags after login.
  * [VPNLINUX-1132] Ensure app does not crash when attempting to logout after doing a search.
  * [VPNLINUX-1128] Display forwarded port if available.
  * [VPNLINUX-1128] Only display port if environment variable is set.
  * [VPNLINUX-1134] Display server load in search results
  * [VPNLINUX-1117] Include beta branch on version metadata.
  * [VPNLINUX-1116] Remove code related to old feature flags.
  * [VPNLINUX-1145] Re-implement tests and clean-up code.
  * [VPNLINUX-1144] Replace deprecated method.
  * Remove save_setting when building UI.
  * [VPNLINUX-949] Fix cancel connection button
  * [VPNLINUX-949] update changelog
  * [VPNLINUX-1129] Show port forwarding desktop notification
  * [VPNLINUX-1169] Switch DisplayPortForwarding env var to Feature Flag
  * [VPNLINUX-1168] Customize Port Forwarding notification
  * [VPNLINUX-1167] Update api-core dependency
  * [VPNLINUX-1168] Minor changes to wording of port forwarding user interface
  * [VPNLINUX-1181] add linux referral to sign-up URL
  * [VPNLINUX-1176] Fix crash when quitting the app while connected and PF is enabled</changelog>
  <changelog author="rrahl0@opensuse.org" date="1744113600">- update to 4.9.6:
  * nothing of relevance
- update spec file:
  * switch to autosetup
  * remove update-dekstop-files
  * switch to pyproject macros
  * use sle15 macros for defining which python version</changelog>
  <changelog author="i@guoyunhe.me" date="1762084800">- Update to 4.12.0:
  * feat: Support 2fa hard-jailing (Luke Titley)
  * fix: Update spec file (Alexandru Cheltuitor)
  * feat: Handle U2F PIN (Pep Llaneras)
- Update to 4.11.0:
  * feat: add 2fa security device verification (Alexandru Cheltuitor, Luke Titley, Pep Llaneras)
  * fix: change ST toaster for include mode (Pep Llaneras)
  * fix: fix add window title word duplication (Alexandru Cheltuitor)
  * fix: ensure label mode is updated when switching modes (Alexandru Cheltuitor)
  * feat: add include mode (Alexandru Cheltuitor, Luke Titley, Pep Llaneras)
  * fix: hide proton vpn app from st (Alexandru Cheltuitor)
- Update to 4.10.0:
  * Implement app based split tunneling (Alexandru Cheltuitor, Josep Llaneras, Luke Titley)
- Update to 4.9.7:
  * Update early access stable and beta packages
  * Ensures beta toggling uses correct apt command for debian based distributions
  * Fixes beta toggle activating with incoherent distribution detection
  * Fixes server button not reflecting current connection state
  * Removes reconnect message for Netshield, port forwarding, vpn accelerator and Moderate NAT settings changes</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774180800">= Update to version 4.15.0:
  * fix: [VPNLINUX-1563] Accessibility improvements
  * feat: [VPNLINUX-1571] show connect button on hover
  * fix: [VPNLINUX-1584] tray detection
  * fix: [VPNLINUX-1570] preserve expanded rows on server list refresh
  * fix: [VPNLINUX-1571] show upgrade link on hover
  * feat: [VPNLINUX-1565] show secure core servers group
  * fix: [VPNLINUX-1576] make menu button visible on KDE
  * fix: [VPNLINUX-1565] show paid servers first to paid users
  * feat: [VPNLINUX-1565] add double flag icon to secure core rows
  * fix: [VPNLINUX-1565] customize button tooltips for secure core
  * fix: [VPNLINUX-1565] smoothen row collapse
- Update to version 4.14.2
  * feat: [VPNLINUX-1538] Add cities
  * feat: [VPNLINUX-1562] add search by city
  * [VPNLINUX-1599] Feature flag cleanup
- Update to version 4.14.1:
  * fix: [VPNLINUX-1524] Log failed sign in attempt
- Update to version 4.14.0:
  * [VPNLINUX-1488] migrate to GTK4
  * [VPNLINUX-1520] fix memory leak
- Update to version 4.13.1:
  * fix: [VPNLINUX-1439] Handle desktop file parsing errors
- Update to version 4.13.0:
  * fix: [VPNLINUX-1427] Clear keyring on cancelled 2FA
  * fix: [VPNLINUX-1427] Fix login stack GTK warnings
  * fix: [VPNLINUX-1412] Show security key as default 2FA option
  * chore: [VPNLINUX-735] Remove outdated tests
  * chore: [VPNLINUX-1310] Switch to new versioning strategy
  * fix: [VPNLINUX-1412] Hide security key form when no keys are registered
  * fix: [VPNLINUX-1418] remove environment variable that limits security
- remove deprecated group
- remove proton-vpn-network-manager as a build and runtime dep, as
  that got deprecated (gets replaced by proton-vpn-api-core)</changelog>
  <changelog author="rrahl0@opensuse.org" date="1777636800">- Fix SLE 15 SP7 build, by adding python-wheel as a dependency</changelog>
</package>
<package pkgid="873d7dc7257cd327bf4449f28fd9f13ab8010a9ed743b3224483405db3f64c1a" name="proton-vpn-local-agent" arch="x86_64">
  <version epoch="0" ver="1.6.0" rel="150700.2.2"/>
  <changelog author="rrahl0@opensuse.org" date="1738411200">- initial packaging</changelog>
  <changelog author="rrahl0@opensuse.org" date="1740657600">- enable builds only for aarch64 and x86_64
- enable Leap builds</changelog>
  <changelog author="raspherdev@pm.me" date="1743076800">- Update to 1.4.4:
  * Forward the rust log to python log</changelog>
  <changelog author="rrahl0@opensuse.org" date="1744632000">- update to 1.4.5:
  * local_agent_rs/Cargo.toml: Relax on dependency versions
  * python-proton-vpn-local-agent/src: replaced pyo3_asyncio_0_21 by pyo3_async_runtimes
  * python-proton-vpn-local-agent/Cargo.toml
  * Improve how pyo3-async-runtimes is used
  * fix: [VPNLINUX-1195] merge community update</changelog>
  <changelog author="rrahl0@opensuse.org" date="1747483200">- use pythons macro for identiying which python versions exist for
  each distribution</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753099200">- fix build. had accidently changed the library name which we copy
  to the correct location</changelog>
  <changelog author="daniel.garcia@suse.com" date="1763985600">- Update to 1.6.0 (boo#1253255):
  * chore!: [VPNLINUX-1430] Debug info for expired certificate
  * 2FA Hardjail
  * fix: [VPNLINUX-1234] Explicitly validate the certificate expiration time
  * fix: [VPNLINUX-1234] UnexpectedEof in tls connect
  * Bump python module version.
  * Support fetching NetShield statistics
  * Expose AgentFeatures and StatusMessage via uniffi
  * [VPNLINUX-1257-Procure] Parameterize the project name in ci-libraries-rust</changelog>
  <changelog author="rrahl0@opensuse.org" date="1766577600">- fixing Leap16.0, by locating the correct directory of the library</changelog>
</package>
<package pkgid="b5c83576fe70f170adfdbaf62101ccbac38150df3b0017e500b23a68aa5dc505" name="proton-vpn-local-agent-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.6.0" rel="150700.2.2"/>
  <changelog author="rrahl0@opensuse.org" date="1738411200">- initial packaging</changelog>
  <changelog author="rrahl0@opensuse.org" date="1740657600">- enable builds only for aarch64 and x86_64
- enable Leap builds</changelog>
  <changelog author="raspherdev@pm.me" date="1743076800">- Update to 1.4.4:
  * Forward the rust log to python log</changelog>
  <changelog author="rrahl0@opensuse.org" date="1744632000">- update to 1.4.5:
  * local_agent_rs/Cargo.toml: Relax on dependency versions
  * python-proton-vpn-local-agent/src: replaced pyo3_asyncio_0_21 by pyo3_async_runtimes
  * python-proton-vpn-local-agent/Cargo.toml
  * Improve how pyo3-async-runtimes is used
  * fix: [VPNLINUX-1195] merge community update</changelog>
  <changelog author="rrahl0@opensuse.org" date="1747483200">- use pythons macro for identiying which python versions exist for
  each distribution</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753099200">- fix build. had accidently changed the library name which we copy
  to the correct location</changelog>
  <changelog author="daniel.garcia@suse.com" date="1763985600">- Update to 1.6.0 (boo#1253255):
  * chore!: [VPNLINUX-1430] Debug info for expired certificate
  * 2FA Hardjail
  * fix: [VPNLINUX-1234] Explicitly validate the certificate expiration time
  * fix: [VPNLINUX-1234] UnexpectedEof in tls connect
  * Bump python module version.
  * Support fetching NetShield statistics
  * Expose AgentFeatures and StatusMessage via uniffi
  * [VPNLINUX-1257-Procure] Parameterize the project name in ci-libraries-rust</changelog>
  <changelog author="rrahl0@opensuse.org" date="1766577600">- fixing Leap16.0, by locating the correct directory of the library</changelog>
</package>
<package pkgid="40ff80f2fa60dc9dd95f7bc30b73473991a7a8844b6fe94ce63295b4ad019690" name="python-proton-client" arch="src">
  <version epoch="0" ver="0.7.1" rel="150700.2.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1627041600">- Initial revision</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1635249600">- Update to 0.7.1:
  * Bug fixes and improvments</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1695643200">- Add urllib3-v2-migration.patch to fix authentication errors.</changelog>
  <changelog author="mcepl@suse.com" date="1695643201">- Clean up the SPEC file</changelog>
  <changelog author="steven.kowalik@suse.com" date="1727352000">- Add missing BuildRequires on pyOpenSSL.</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1778500800">- Add drop-long-password-test.patch to fix build issue with bcrypt 5.0
  caused by https://github.com/pyca/bcrypt/commit/d50ab05b2bece07d5c8d6a4179064fc714fd9126</changelog>
</package>
<package pkgid="981b510ecf2436eb7900fb07744d850628d616c3828dda1fcc4a2619bc5bcef8" name="python-proton-core" arch="src">
  <version epoch="0" ver="0.7.0" rel="150700.2.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1707393600">- Initial revision</changelog>
  <changelog author="mcepl@cepl.eu" date="1707998400">- Clean up the SPEC file</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1710504000">- Update source tarball URL
- Build package for Leap</changelog>
  <changelog author="dmueller@suse.com" date="1722859200">- update to 0.2.0:
  * Add dynamic module validation
  * Sanitize DNS response
  * Fix invalid modulus error when logging in
  * Session forking</changelog>
  <changelog author="dmueller@suse.com" date="1727697600">- update to 0.3.3:
  * Amend type hinting
  * ProtonSSO : allow selecting the keyring backend (unspecified:
    load default keyring)
  * External contribution from 'wesinator' : fix hostname segment
    regex
  * Minor changes following feedback/review
  * Allow clients to support 'If-Modified-Since'
  * Make logs less verbose</changelog>
  <changelog author="raspherdev@pm.me" date="1743076800">- update to 0.4.0:
  * Require python &gt;= 3.9 to allow libraries using newer language features</changelog>
  <changelog author="i@guoyunhe.me" date="1762084800">- Update to 0.7.0:
  * No upstream changelog</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1778500800">- Add drop-long-password-test.patch to fix build issue with bcrypt 5.0
  caused by https://github.com/pyca/bcrypt/commit/d50ab05b2bece07d5c8d6a4179064fc714fd9126</changelog>
</package>
<package pkgid="4284fdb6fc8b22a3248a5bfe40933da9928f6404ff7ab67ecb0aa1ac2847b90e" name="python-proton-keyring-linux" arch="src">
  <version epoch="0" ver="0.2.0" rel="150700.2.1"/>
  <changelog author="rrahl0@opensuse.org" date="1738411200">- initial package</changelog>
  <changelog author="rrahl0@opensuse.org" date="1740571200">- enable tests</changelog>
</package>
<package pkgid="74414212f67c7fe645085ee02dfbc0e20edb4a28b981bf40f65527089bf415f6" name="python-proton-vpn-api-core" arch="src">
  <version epoch="0" ver="4.16.0" rel="150700.2.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1707480000">- Initial revision</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1710849600">- Build for Leap</changelog>
  <changelog author="i@guoyunhe.me" date="1711022400">- Update to version 0.21.0
  * Apply kill switch setting immediately</changelog>
  <changelog author="dmueller@suse.com" date="1715083200">- update to 0.23.1:
  * Added missing pip dependencies.
  * Merged proton-vpn-api-session package into this one.
  * Pass requested features through to session login and two
    factor submit.
  * Provide method to update certificate.
  * Ensure that crash reporting state is preserved between
    restarts.
  * Explicitly state the sentry integrations we want. Dont
    include the ExceptHookIntegration
  * Change url for sentry, dont send server_name, use older
    sentry api
  * Add mechanism to send errors anonymously to sentry.
  * Return list of protocol plugins for a specific backend
    instead of returning a list of protocols names
  * Add WireGuard ports</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1716379200">- Update to 0.24.4
  * Filter OSError not just FileNotFound error in sentry.
  * Set the sentry user id based on a hash of /etc/machine-id
  * Fix deprecation warning when calculatin WireGuard certificate validity period.
  * Fix error saving cache file when parent directory does not exist
  * Only initialize sentry on first enable.
  * Forward SSL_CERT_FILE environment variable to sentry.</changelog>
  <changelog author="i@guoyunhe.me" date="1729771200">- Conflicts python-proton-vpn-connection
- Conflicts python-proton-vpn-killswitch
- Conflicts python-proton-vpn-logger
- Update to 0.35.5
  * Fix regression sending errors to sentry.
  * Fix to rpm package.spec, added accidentally removed Obsoletes statement.
  * Send all errors to sentry, but swallow api errors.
  * Merge logger package into this one.
  * Fix refregresion (logout user on 401 API error).
  * Catch and send LA errors to sentry.
  * Import refreshers from app.
  * Ensure there is a way to disable IPv6.
  * Change IPv6 default value and move out of the features dict.
  * Properly configure OpenVPN with IPv6 value.
  * Pass IPv6 value.
  * Put changes to fetching with timestamp (If-Modified-Since), behind a feature flag.
  * Fixes support for 'If-Modified-Since', expiration times.
  * Fixes support for 'If-Modified-Since' header in server list requests.
  * This adds support for 'If-Modified-Since' header in server list requests.
  * Make sure features cant be request after connection as well.
  * Expose property in VPNConnection to know if features can be applied on active connections.
  * Tier 0 level users can't control the features they have. So don't send any feature requests for them.
  * Fix crash after logout
  * Get rid of VPNConnectorWrapper.
  * Enable wireguard feature flag by default.
  * Handle UnicodeDecodeError when loading persisted VPN connection.
  * Update connection features via local agent if available.
  * Disconnect and notify the user when the maximum number of sessions is reached.
  * Handle ExpiredCertificate events.
  * Update default feature flags and update feature flags interface.
  * Update credentials in the background
  * Fix crash initializing VPN connector.
  * Update VPN credentials when an active VPN connection is found at startup.
  * Merge connection and kill switch packages into this one.
  * Improve testing to capture when default value is being passed.
  * Implement and expose feature flags.
  * Move local agent management into wireguard backend.
  * Send CPU architecture following semver's specs.
  * Switched over to async local agent api.
  * Attempt to use external local agent package, otherwise fallback to existent one.
  * Add the architecture in the appversion field for ProtonSSO.
  * Switch over to automatically generated changelogs for debian and rpm.
  * Fix sentry error sanitization crash.
  * Fix certificate duration regression.
  * Send wireguard certificate to server via local agent.
  * Increase certificate duration.
  * Refactor of Settings to ensure settings are only saved when they are changed.
  * Stop raising exceptions when getting wireguard certificate and it is expired.</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1731412800">- Enable sentry-sdk only in Tumbleweed
  * Not available in Leap/SLE</changelog>
  <changelog author="raspherdev@pm.me" date="1743076800">- Update to 0.42.3:
  * Expose method to get DNS IPs based on provided IP version
  * Always load feature flag cache/defaults
  * Add a breaks/conflicts clause for python3-proton-vpn-network-manager &lt; 0.12.10
  * Fix Certificate Expired error when requesting certificate in pem format
  * Switch DisplayPortForwarding env var to Feature Flag
  * Added local agent to OpenVPN, minor bug fix
  * Added local agent to OpenVPN
  * Manage file containing forwarded port
  * Encrypt openvpn certificate private key
  * Notify connecting/disconnecting state early
  * Notify subscribers when state context changes
  * Fix sentry event username masking
  * Cleanup old feature flags
  * Update event context so that it passes a forwarded port
  * Ensure default settings use feature flags even after login the next time they are fetched
  * Switch default protocol to WireGuard if feature flag is present
  * Ensure no crash occurs if cache files are non-decodable
  * Set default expiration time for features flags to expired, so that they're fetched from the API and cached as soon as possible
  * Emit connection state update after state tasks are completed
  * Update how time is calculated in logging module
  * Drop Ubuntu 20.04 support
  * Added semgrep scanning to CI
  * Refactor custom DNS
  * Introduce custom DNS
  * Automatically generate the changelog files for debian and fedora
  * Switch to /vpn/v2 API
  * Use versioned API endpoints
  * Fix for certificate based authentication for openvpn, feature flag was out of date
  * Fix certificate expired regression
  * Enable certificate based authentication for openvpn
  * Improve logic on when to update location details
  * Use a 'before_send' callback in sentry to sanitize events in sentry
  * Update location object after successfully connecting to VPN server via local agent</changelog>
  <changelog author="rrahl0@opensuse.org" date="1744632000">- update to 0.42.4:
  * fix: [VPNLINUX-1191] swallow&amp;re-schedule server refresh when we receive HTTP code 429
  * fix: [VPNLINUX-1191] swallow&amp;re-schedule when we receive HTTP code 429 from refreshers</changelog>
  <changelog author="i@guoyunhe.me" date="1762084800">- Update to 4.13.1:
  * fix: Fix fedora 43 upgrade process</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774180800">- Update to version 4.16.0:
  * feat: [VPNLINUX-1565] group secure core servers
- Update to version 4.15.2:
  * feat: [VPNLINUX-1471] Preprocess country/city features
  * [VPNLINUX-1599] Feature flag cleanup
  * fix: app break clause version
- Update to version 4.14.3:
  * feat: [VPNLINUX-1492-1493-1494] Add composable filters to ServerList
  * feat: [VPNLINUX-1507] add citites to country dataclass
- Update to version 4.14.1:
  * Create NetworkManager backend
- be more explicit in the files section
- remove deprecated Group
- As this package now integrates the NetworkManager backend obsolete
  the old package</changelog>
  <changelog author="daniel.garcia@suse.com" date="1774872000">- Add missing requirements, bsc#1260991</changelog>
</package>
<package pkgid="46f1be81e4aa8868b6552b86339295947e9f684c4c61217def23396c5ad7ea23" name="python-proton-vpn-local-agent" arch="src">
  <version epoch="0" ver="1.6.0" rel="150700.2.2"/>
  <changelog author="rrahl0@opensuse.org" date="1738411200">- initial packaging</changelog>
  <changelog author="rrahl0@opensuse.org" date="1740657600">- enable builds only for aarch64 and x86_64
- enable Leap builds</changelog>
  <changelog author="raspherdev@pm.me" date="1743076800">- Update to 1.4.4:
  * Forward the rust log to python log</changelog>
  <changelog author="rrahl0@opensuse.org" date="1744632000">- update to 1.4.5:
  * local_agent_rs/Cargo.toml: Relax on dependency versions
  * python-proton-vpn-local-agent/src: replaced pyo3_asyncio_0_21 by pyo3_async_runtimes
  * python-proton-vpn-local-agent/Cargo.toml
  * Improve how pyo3-async-runtimes is used
  * fix: [VPNLINUX-1195] merge community update</changelog>
  <changelog author="rrahl0@opensuse.org" date="1747483200">- use pythons macro for identiying which python versions exist for
  each distribution</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753099200">- fix build. had accidently changed the library name which we copy
  to the correct location</changelog>
  <changelog author="daniel.garcia@suse.com" date="1763985600">- Update to 1.6.0 (boo#1253255):
  * chore!: [VPNLINUX-1430] Debug info for expired certificate
  * 2FA Hardjail
  * fix: [VPNLINUX-1234] Explicitly validate the certificate expiration time
  * fix: [VPNLINUX-1234] UnexpectedEof in tls connect
  * Bump python module version.
  * Support fetching NetShield statistics
  * Expose AgentFeatures and StatusMessage via uniffi
  * [VPNLINUX-1257-Procure] Parameterize the project name in ci-libraries-rust</changelog>
  <changelog author="rrahl0@opensuse.org" date="1766577600">- fixing Leap16.0, by locating the correct directory of the library</changelog>
</package>
<package pkgid="3ecfd94b49186e78ef0ea36628aded34b4bb2402466312bfb3274c07782ca216" name="python-proton-vpn-local-agent-debugsource" arch="x86_64">
  <version epoch="0" ver="1.6.0" rel="150700.2.2"/>
  <changelog author="rrahl0@opensuse.org" date="1738411200">- initial packaging</changelog>
  <changelog author="rrahl0@opensuse.org" date="1740657600">- enable builds only for aarch64 and x86_64
- enable Leap builds</changelog>
  <changelog author="raspherdev@pm.me" date="1743076800">- Update to 1.4.4:
  * Forward the rust log to python log</changelog>
  <changelog author="rrahl0@opensuse.org" date="1744632000">- update to 1.4.5:
  * local_agent_rs/Cargo.toml: Relax on dependency versions
  * python-proton-vpn-local-agent/src: replaced pyo3_asyncio_0_21 by pyo3_async_runtimes
  * python-proton-vpn-local-agent/Cargo.toml
  * Improve how pyo3-async-runtimes is used
  * fix: [VPNLINUX-1195] merge community update</changelog>
  <changelog author="rrahl0@opensuse.org" date="1747483200">- use pythons macro for identiying which python versions exist for
  each distribution</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753099200">- fix build. had accidently changed the library name which we copy
  to the correct location</changelog>
  <changelog author="daniel.garcia@suse.com" date="1763985600">- Update to 1.6.0 (boo#1253255):
  * chore!: [VPNLINUX-1430] Debug info for expired certificate
  * 2FA Hardjail
  * fix: [VPNLINUX-1234] Explicitly validate the certificate expiration time
  * fix: [VPNLINUX-1234] UnexpectedEof in tls connect
  * Bump python module version.
  * Support fetching NetShield statistics
  * Expose AgentFeatures and StatusMessage via uniffi
  * [VPNLINUX-1257-Procure] Parameterize the project name in ci-libraries-rust</changelog>
  <changelog author="rrahl0@opensuse.org" date="1766577600">- fixing Leap16.0, by locating the correct directory of the library</changelog>
</package>
<package pkgid="e15742791ad22f9052ebc26fc7dd18352d9a0873f3760448362deb4be6a67e19" name="python3-proton-client" arch="noarch">
  <version epoch="0" ver="0.7.1" rel="150700.2.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1627041600">- Initial revision</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1635249600">- Update to 0.7.1:
  * Bug fixes and improvments</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1695643200">- Add urllib3-v2-migration.patch to fix authentication errors.</changelog>
  <changelog author="mcepl@suse.com" date="1695643201">- Clean up the SPEC file</changelog>
  <changelog author="steven.kowalik@suse.com" date="1727352000">- Add missing BuildRequires on pyOpenSSL.</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1778500800">- Add drop-long-password-test.patch to fix build issue with bcrypt 5.0
  caused by https://github.com/pyca/bcrypt/commit/d50ab05b2bece07d5c8d6a4179064fc714fd9126</changelog>
</package>
<package pkgid="e5d68dc262ee9915b42568b446207ab2ebe1a1a4584a46d1ea81829c21ef3ee7" name="python311-proton-core" arch="noarch">
  <version epoch="0" ver="0.7.0" rel="150700.2.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1707393600">- Initial revision</changelog>
  <changelog author="mcepl@cepl.eu" date="1707998400">- Clean up the SPEC file</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1710504000">- Update source tarball URL
- Build package for Leap</changelog>
  <changelog author="dmueller@suse.com" date="1722859200">- update to 0.2.0:
  * Add dynamic module validation
  * Sanitize DNS response
  * Fix invalid modulus error when logging in
  * Session forking</changelog>
  <changelog author="dmueller@suse.com" date="1727697600">- update to 0.3.3:
  * Amend type hinting
  * ProtonSSO : allow selecting the keyring backend (unspecified:
    load default keyring)
  * External contribution from 'wesinator' : fix hostname segment
    regex
  * Minor changes following feedback/review
  * Allow clients to support 'If-Modified-Since'
  * Make logs less verbose</changelog>
  <changelog author="raspherdev@pm.me" date="1743076800">- update to 0.4.0:
  * Require python &gt;= 3.9 to allow libraries using newer language features</changelog>
  <changelog author="i@guoyunhe.me" date="1762084800">- Update to 0.7.0:
  * No upstream changelog</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1778500800">- Add drop-long-password-test.patch to fix build issue with bcrypt 5.0
  caused by https://github.com/pyca/bcrypt/commit/d50ab05b2bece07d5c8d6a4179064fc714fd9126</changelog>
</package>
<package pkgid="18ad09b94e0adea936f1e4ebda373aa835a6b2dfdb6480799e18f50f5faf01ca" name="python311-proton-keyring-linux" arch="noarch">
  <version epoch="0" ver="0.2.0" rel="150700.2.1"/>
  <changelog author="rrahl0@opensuse.org" date="1738411200">- initial package</changelog>
  <changelog author="rrahl0@opensuse.org" date="1740571200">- enable tests</changelog>
</package>
<package pkgid="874ff22cdca90e0ebafb054f62d99f3a00e10796280bea35d4abfed9daf57642" name="python311-proton-vpn-api-core" arch="noarch">
  <version epoch="0" ver="4.16.0" rel="150700.2.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1707480000">- Initial revision</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1710849600">- Build for Leap</changelog>
  <changelog author="i@guoyunhe.me" date="1711022400">- Update to version 0.21.0
  * Apply kill switch setting immediately</changelog>
  <changelog author="dmueller@suse.com" date="1715083200">- update to 0.23.1:
  * Added missing pip dependencies.
  * Merged proton-vpn-api-session package into this one.
  * Pass requested features through to session login and two
    factor submit.
  * Provide method to update certificate.
  * Ensure that crash reporting state is preserved between
    restarts.
  * Explicitly state the sentry integrations we want. Dont
    include the ExceptHookIntegration
  * Change url for sentry, dont send server_name, use older
    sentry api
  * Add mechanism to send errors anonymously to sentry.
  * Return list of protocol plugins for a specific backend
    instead of returning a list of protocols names
  * Add WireGuard ports</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1716379200">- Update to 0.24.4
  * Filter OSError not just FileNotFound error in sentry.
  * Set the sentry user id based on a hash of /etc/machine-id
  * Fix deprecation warning when calculatin WireGuard certificate validity period.
  * Fix error saving cache file when parent directory does not exist
  * Only initialize sentry on first enable.
  * Forward SSL_CERT_FILE environment variable to sentry.</changelog>
  <changelog author="i@guoyunhe.me" date="1729771200">- Conflicts python-proton-vpn-connection
- Conflicts python-proton-vpn-killswitch
- Conflicts python-proton-vpn-logger
- Update to 0.35.5
  * Fix regression sending errors to sentry.
  * Fix to rpm package.spec, added accidentally removed Obsoletes statement.
  * Send all errors to sentry, but swallow api errors.
  * Merge logger package into this one.
  * Fix refregresion (logout user on 401 API error).
  * Catch and send LA errors to sentry.
  * Import refreshers from app.
  * Ensure there is a way to disable IPv6.
  * Change IPv6 default value and move out of the features dict.
  * Properly configure OpenVPN with IPv6 value.
  * Pass IPv6 value.
  * Put changes to fetching with timestamp (If-Modified-Since), behind a feature flag.
  * Fixes support for 'If-Modified-Since', expiration times.
  * Fixes support for 'If-Modified-Since' header in server list requests.
  * This adds support for 'If-Modified-Since' header in server list requests.
  * Make sure features cant be request after connection as well.
  * Expose property in VPNConnection to know if features can be applied on active connections.
  * Tier 0 level users can't control the features they have. So don't send any feature requests for them.
  * Fix crash after logout
  * Get rid of VPNConnectorWrapper.
  * Enable wireguard feature flag by default.
  * Handle UnicodeDecodeError when loading persisted VPN connection.
  * Update connection features via local agent if available.
  * Disconnect and notify the user when the maximum number of sessions is reached.
  * Handle ExpiredCertificate events.
  * Update default feature flags and update feature flags interface.
  * Update credentials in the background
  * Fix crash initializing VPN connector.
  * Update VPN credentials when an active VPN connection is found at startup.
  * Merge connection and kill switch packages into this one.
  * Improve testing to capture when default value is being passed.
  * Implement and expose feature flags.
  * Move local agent management into wireguard backend.
  * Send CPU architecture following semver's specs.
  * Switched over to async local agent api.
  * Attempt to use external local agent package, otherwise fallback to existent one.
  * Add the architecture in the appversion field for ProtonSSO.
  * Switch over to automatically generated changelogs for debian and rpm.
  * Fix sentry error sanitization crash.
  * Fix certificate duration regression.
  * Send wireguard certificate to server via local agent.
  * Increase certificate duration.
  * Refactor of Settings to ensure settings are only saved when they are changed.
  * Stop raising exceptions when getting wireguard certificate and it is expired.</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1731412800">- Enable sentry-sdk only in Tumbleweed
  * Not available in Leap/SLE</changelog>
  <changelog author="raspherdev@pm.me" date="1743076800">- Update to 0.42.3:
  * Expose method to get DNS IPs based on provided IP version
  * Always load feature flag cache/defaults
  * Add a breaks/conflicts clause for python3-proton-vpn-network-manager &lt; 0.12.10
  * Fix Certificate Expired error when requesting certificate in pem format
  * Switch DisplayPortForwarding env var to Feature Flag
  * Added local agent to OpenVPN, minor bug fix
  * Added local agent to OpenVPN
  * Manage file containing forwarded port
  * Encrypt openvpn certificate private key
  * Notify connecting/disconnecting state early
  * Notify subscribers when state context changes
  * Fix sentry event username masking
  * Cleanup old feature flags
  * Update event context so that it passes a forwarded port
  * Ensure default settings use feature flags even after login the next time they are fetched
  * Switch default protocol to WireGuard if feature flag is present
  * Ensure no crash occurs if cache files are non-decodable
  * Set default expiration time for features flags to expired, so that they're fetched from the API and cached as soon as possible
  * Emit connection state update after state tasks are completed
  * Update how time is calculated in logging module
  * Drop Ubuntu 20.04 support
  * Added semgrep scanning to CI
  * Refactor custom DNS
  * Introduce custom DNS
  * Automatically generate the changelog files for debian and fedora
  * Switch to /vpn/v2 API
  * Use versioned API endpoints
  * Fix for certificate based authentication for openvpn, feature flag was out of date
  * Fix certificate expired regression
  * Enable certificate based authentication for openvpn
  * Improve logic on when to update location details
  * Use a 'before_send' callback in sentry to sanitize events in sentry
  * Update location object after successfully connecting to VPN server via local agent</changelog>
  <changelog author="rrahl0@opensuse.org" date="1744632000">- update to 0.42.4:
  * fix: [VPNLINUX-1191] swallow&amp;re-schedule server refresh when we receive HTTP code 429
  * fix: [VPNLINUX-1191] swallow&amp;re-schedule when we receive HTTP code 429 from refreshers</changelog>
  <changelog author="i@guoyunhe.me" date="1762084800">- Update to 4.13.1:
  * fix: Fix fedora 43 upgrade process</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774180800">- Update to version 4.16.0:
  * feat: [VPNLINUX-1565] group secure core servers
- Update to version 4.15.2:
  * feat: [VPNLINUX-1471] Preprocess country/city features
  * [VPNLINUX-1599] Feature flag cleanup
  * fix: app break clause version
- Update to version 4.14.3:
  * feat: [VPNLINUX-1492-1493-1494] Add composable filters to ServerList
  * feat: [VPNLINUX-1507] add citites to country dataclass
- Update to version 4.14.1:
  * Create NetworkManager backend
- be more explicit in the files section
- remove deprecated Group
- As this package now integrates the NetworkManager backend obsolete
  the old package</changelog>
  <changelog author="daniel.garcia@suse.com" date="1774872000">- Add missing requirements, bsc#1260991</changelog>
</package>
<package pkgid="aa9ab30f3358c75cb7ea95c671ae211faa5c1e2c196428a12dba18f62d980a8e" name="python311-proton-vpn-local-agent" arch="x86_64">
  <version epoch="0" ver="1.6.0" rel="150700.2.2"/>
  <changelog author="rrahl0@opensuse.org" date="1738411200">- initial packaging</changelog>
  <changelog author="rrahl0@opensuse.org" date="1740657600">- enable builds only for aarch64 and x86_64
- enable Leap builds</changelog>
  <changelog author="raspherdev@pm.me" date="1743076800">- Update to 1.4.4:
  * Forward the rust log to python log</changelog>
  <changelog author="rrahl0@opensuse.org" date="1744632000">- update to 1.4.5:
  * local_agent_rs/Cargo.toml: Relax on dependency versions
  * python-proton-vpn-local-agent/src: replaced pyo3_asyncio_0_21 by pyo3_async_runtimes
  * python-proton-vpn-local-agent/Cargo.toml
  * Improve how pyo3-async-runtimes is used
  * fix: [VPNLINUX-1195] merge community update</changelog>
  <changelog author="rrahl0@opensuse.org" date="1747483200">- use pythons macro for identiying which python versions exist for
  each distribution</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753099200">- fix build. had accidently changed the library name which we copy
  to the correct location</changelog>
  <changelog author="daniel.garcia@suse.com" date="1763985600">- Update to 1.6.0 (boo#1253255):
  * chore!: [VPNLINUX-1430] Debug info for expired certificate
  * 2FA Hardjail
  * fix: [VPNLINUX-1234] Explicitly validate the certificate expiration time
  * fix: [VPNLINUX-1234] UnexpectedEof in tls connect
  * Bump python module version.
  * Support fetching NetShield statistics
  * Expose AgentFeatures and StatusMessage via uniffi
  * [VPNLINUX-1257-Procure] Parameterize the project name in ci-libraries-rust</changelog>
  <changelog author="rrahl0@opensuse.org" date="1766577600">- fixing Leap16.0, by locating the correct directory of the library</changelog>
</package>
<package pkgid="fa07e9f0b17025ae88999561437d8aeeae916ffa6e1b37e78e65148e58e6daf5" name="strongswan" arch="src">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="bcda8887e87275aa350eee33dc71dcb7261ac9862da2e22aaaf75a3fec8d1e66" name="strongswan" arch="x86_64">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="b09293ca295123c1e359146e670afe5882b553588262883f360e6f4795ee4d6c" name="strongswan-debuginfo" arch="x86_64">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="abfbdbeec439719b7b3e480225796ffd99878815094b7f0c2a431d3ca757fc3b" name="strongswan-debugsource" arch="x86_64">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="28e28de886a0adac33a5f5a5180b421d9a0fad229458e2c1f23c8ce28438f8e9" name="strongswan-doc" arch="noarch">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="57f645f148777d42c816385632024ffe0b8a7853ae17da01abb7b16d59db4262" name="strongswan-fips" arch="x86_64">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="5a0d32c3c9937fb51504dcca16ff1207ac16ce57c7fb1ac90fe7df3c69b93ece" name="strongswan-ipsec" arch="x86_64">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="35b0ec892835cb50bdb0ca1d630825fba9e082dcff0eb75a87726ee7f887cf6a" name="strongswan-ipsec-debuginfo" arch="x86_64">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="39be69717132130d53cb7f34072e5b050139361054aaebaab22aba265bb36246" name="strongswan-mysql" arch="x86_64">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="6c55ea52314c6892df3cccde32194042a28844a923413e44cb2b74fa7eec5869" name="strongswan-mysql-debuginfo" arch="x86_64">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="f375d6be225ce043c36d217608114384f1428e1bd9fe1a3bf91ca46cdfafb868" name="strongswan-nm" arch="x86_64">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="60231b92b832933dae9abc69013de4e41a5eaf9775f9a640bda3116c5f30ae22" name="strongswan-nm-debuginfo" arch="x86_64">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="cbea312884033a9efbee6ec5ad49e0f3749750d8e6e3b6c10b59543d66041e10" name="strongswan-sqlite" arch="x86_64">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="068aa33b8fb4e60e409c44c04101c2363106431ed97c1e2918f17182eb5640eb" name="strongswan-sqlite-debuginfo" arch="x86_64">
  <version epoch="0" ver="6.0.6" rel="150700.6.2"/>
  <changelog author="mohd.saquib@suse.com" date="1680696000">- Allow to use stroke aka ipsec interface by default instead of
  vici aka swanctl interface which is current upstream's default.
  strongswan.service which enables swanctl interface is masked to
  stop interfering with the ipsec interface (bsc#1184144)
- Removes deprecated SysV support</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686571200">- Update to release 5.9.11
  * A deadlock in the vici plugin has been fixed
  * Per RFC 5280, CRLs now have to be signed by a certificate that
    either encodes the cRLSign keyUsage bit (even if it is a CA
    certificate), or is a CA certificate without a keyUsage
    extension.
  * Support for optional CA labels in EST server URIs was added to
    the pki --est and pki --estca commands.
  * The pkcs7 and openssl plugins now support CMS-style signatures
    in PKCS#7 containers, which allows verifying RSA-PSS and ECDSA
    signatures.
  * Fixed a regression in the server implementation of EAP-TLS when
    using TLS &lt;=1.2.
  * The EAP-TLS client does now enforce that the TLS handshake is
    complete when using TLS &lt;=1.2.
  * On Linux, the kernel-libipsec plugin can now optionally handle
    ESP packets without UDP encapsulation.
  * The dhcp plugin uses an alternative method to determine the
    source address when sending unicast DHCP requests.
  * ECDSA and EdDSA public keys are supported by the ipseckey
    plugin when parsing RFC 4025 IPSECKEY resource records.</changelog>
  <changelog author="jengelh@inai.de" date="1686571201">- Remove pre-SLE15 build logic</changelog>
  <changelog author="mohd.saquib@suse.com" date="1687435200">- Removed .hmac files + hmac integrity check logic from strongswan-hmac
  package as it is not mandated anymore by FIPS (boo#1185116)
- Removed folliwng files:
  [- strongswan_fipscheck.patch]
  [- fipscheck.sh.in]
  Note: strongswan-hmac package is not removed as it still provides a
  config file that doesn't allow non-fips approved algorithms</changelog>
  <changelog author="jengelh@inai.de" date="1700481600">- Update to release 5.9.12
  * Fixed a buffer overflow in charon-tkm [CVEV-2023-41913]
  * Support for ``nameConstraints`` of type ``iPAddress`` are now
    supported by the "x509", "openssl" and "constraints" plugins
  * Support for encoding subjectAlternativeName extensions of type
    uniformResourceIdentifier in X.509 certificates has been added.
  * Make the NetworkManager plugin (charon-nm) actually use the
    XFRM interface it creates since 5.9.10. This involves setting
    interface IDs on SAs and policies, and installing routes via
    the interface. To avoid routing loops if the remote traffic
    selectors include the VPN server, IKE and ESP packets are
    marked to bypass the routing table that contains the routes via
    XFRM interface.
  * The kernel-libipsec plugin now always installs routes to remote
    networks even if no address is found in the local traffic
    selectors, which allows forwarding traffic from networks the
    VPN host is not part of.
  * Fixed issues while reestablishing multiple CHILD_SAs (e.g.
    after a DPD timeout) that could cause a reqid to get assigned
    to multiple CHILD_SAs with unrelated traffic selectors.</changelog>
  <changelog author="jengelh@inai.de" date="1701432000">- Update to release 5.9.13
  * OCSP error responses are now dropped immediately instead of
    trying to verify a non-existent signature.</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="jengelh@inai.de" date="1710849600">- Update to release 5.9.14
  * Support for the IKEv2 OCSP extensions (RFC 4806) has been
    added, which allows peers to request and send OCSP responses
    directly in IKEv2.
  * Validation of X.509 name constraints in the constraints plugin
    has been refactored to align with RFC 5280.
  * Fail SA installation on Linux if replay protection is disabled
    while ESN is enabled, which the kernel currently doesn't
    support.</changelog>
  <changelog author="dimstar@opensuse.org" date="1718884800">- Update description of ipsec package: no longer mention
  /etc/init.d, which is not there for a long time anymore.
- Drop legacy rc* -&gt; sbin/service symlink. This was compatibilty
  boilerplate to transparently move between SySV and systemd
  [jsc#PED-264].</changelog>
  <changelog author="dmueller@suse.com" date="1732622400">- rename -hmac subpackage to -fips because it isn't providing
  the hmac files, it provides the configuration drop in to
  enforce fips mode.</changelog>
  <changelog author="jengelh@inai.de" date="1733227200">- /usr/sbin/ipsec is deprecated since 5.2.0 and will be removed
  in the future.
- Update to release 6.0.0
  * Support for multiple IKEv2 key exchanges (RFC 9370)
  * Support for the Module-Lattice-Based Key-Encapsulation
    Mechanism (ML-KEM, FIPS 203)
  * AF_VSOCK socket support
  * The file logger can optionally log messages as JSON objects
  * Handling of CHILD_SA rekey collisions has been improved
  * The kernel-netlink plugin explicitly configures the direction
    of IPsec SAs when running on 6.10+ kernels
  * The NetworkManager plugin (charon-nm) now uses a different
    routing table than the regular IKE daemon to avoid conflicts
    if both are running
  * The following crypto plugins are no longer built:
    aes, curve25519, des, fips-prf, gmp, hmac, md5, pkcs12, rc2,
    sha1, sha2. (Their replacement is the "openssl" plugin.)
  * The following deprecated plugins have been removed: bliss
    (signature scheme), newhope (key exchange method), ntru (key
    exchange method).
- Add init.patch</changelog>
  <changelog author="jengelh@inai.de" date="1741694400">- Update to release 6.0.1
  * The `dhcp` plugin has gained a new `interface_receive` option
  * The `eap-radius` plugin hsa gained a new `source` option
  * The NetworkManager plugin (charon-nm) received an option to
    configure the local traffic selectors.
  * The `ha` plugin now supports synchronizing IKE and Child SAs
    with multiple key exchanges
  * Self-signed root CAs that do not contain policies are now
    excluded from policy validation.
  * When deciding whether to send a DPD, inbound traffic on Child
    SAs is now ignored unless UDP-encapsulation is used.
  * When connecting to port 4500 or a custom server port, the
    initial IKE_SA_INIT request is now sent from the NAT-T
    socket.
  * The NetworkManager backend (charon-nm) now enables
    charon-nm.check_current_path to force a DPD after
    connectivity changes without IP change.
- Ensure build recipe is POSIX sh compatible</changelog>
  <changelog author="hsk17@mail.de" date="1746532800">- Add patches from upstream github.com/strongswan/strongswan
  to fix gcc-15 compile-time errors:
  * strongswan-gcc15-part1.patch
  * strongswan-gcc15-part2.patch
  * strongswan-gcc15-part3.patch</changelog>
  <changelog author="mgorse@suse.com" date="1748952000">- Disable soup fetcher. It is redundant with the curl fetcher, and
  this allows us to drop the dependency on libsoup2.</changelog>
  <changelog author="jengelh@inai.de" date="1749124800">- Add pkgconfig(libxml-2.0) BuildRequire which was previously
  implicitly pulled in through SOUP. Move everything else to
  pkgconfig() symbols as well.</changelog>
  <changelog author="jengelh@inai.de" date="1752494400">- Update to release 6.0.2
  * Support for per-CPU SAs (RFC 9611) has been added on Linux
    6.13+. The new per_cpu_sas setting enables the installation of
    special trap policies (start_action=trap) that instruct the
    kernel to consider the CPU from which a packet originates.
  * Basic support for IP-TFS's (RFC 9347) new AGGFRAG mode has been
    added on Linux 6.14+. It's similar to tunnel mode but allows
    aggregating small IP packets into single ESP packets and
    fragmenting large IP packets into multiple ESP packets.
  * POSIX regular expressions are now supported to match remote
    identities. They must start with an explicit type prefix,
    followed by a caret character (^), and end with a dollar sign
    ($) to indicate an anchored pattern. Regular expressions are
    always matched case insensitive against the string
    representation of other identities, however, the type must
    match as well.
  * Switching configs based on EAP-Identities is supported. This
    changes how configured EAP identities are used. Instead of
    statically setting and using a configured remote.eap_id !=
    %any, an EAP-Identity exchange is now always initiated (and
    required). If the received identity doesn't match the
    configuration, the peer config is switched to one with a
    matching identity (wildcards and regular expressions are
    supported for that match).
  * ML-KEM is now supported via OpenSSL 3.5+ by the openssl plugin.
- Delete init.patch (merged), strongswan-gcc15-part1.patch
  strongswan-gcc15-part2.patch, strongswan-gcc15-part3.patch</changelog>
  <changelog author="jengelh@inai.de" date="1761652800">- Update to release 6.0.3
  * Fixed a heap buffer overflow [CVE-2025-62291] in the
    eap-mschapv2 plugin.
  * Improved the detection of already unwrapped CKA_EC_POINTs in
    the pkcs11 plugin, because the previous check could cause false
    positives that resulted in mangled EC points.
  * Initiated IKE SAs tracked by the controller (if initiated
    manually or via start action) or the trap-manager (if initiated
    via acquire) are now migrated if the SA is redirected during
    IKE_AUTH (which creates a new IKE SA object).
  * Fallback to the IKE identity if the client does not provide an
    EAP-Identity.</changelog>
  <changelog author="jengelh@inai.de" date="1765627200">- Update to release 6.0.4
  * Fixed a vulnerability in the NetworkManager plugin that
    potentially allows using credentials of other local users. This
    vulnerability has been registered as [CVE-2025-9615].
  * Prevent a crash if a confused peer rekeys a Child SA twice
    before sending a delete.
  * Fixed a memory leak if a peer's self-signed certificate is
    untrusted.</changelog>
  <changelog author="jengelh@inai.de" date="1774267200">- Update to release 6.0.5
  * Fixed a vulnerability in the eap-ttls plugin related to
    processing EAP-TTLS AVPs that can lead to resource exhaustion
    or a crash. [CVE-2026-25075]
  * The new `icmp` option enables the forwarding of certain ICMP
    error messages (e.g. Fragmentation Needed), even if their
    source address doesn't match the negotiated traffic selectors,
    when running on Linux kernels that support this (v6.9+).
  * charon-cmd now supports childless IKE SA initiation with the
    `--childless` option.
  * The dhcp plugin now keeps track of address leases across
    make-before-break reauthentications to avoid releasing the
    address when the old SA is terminated
  * Added support for `organizationIdentifier` RDNs, which are used
    in e.g. eIDAS certificates, when parsing ASN.1 DN identities
    from strings.</changelog>
  <changelog author="jengelh@inai.de" date="1776859200">- Update to release 6.0.6
  * Added the unique ID to the log messages when creating an IKE SA
    as responder and when deleting such a half-open SA.
  * IKEv2 fragments with a total fragment count lower than before
    are now dropped as mandated by the RFC.
  * It now updates the address family in the SA selector when the
    addresses of a tunnel mode IPsec SA change in the
    kernel-netlink plugin.
  * CVE-2026-35328, CVE-2026-35329, CVE-2026-35330, CVE-2026-35331,
    CVE-2026-35332, CVE-2026-35333, CVE-2026-35334 were fixed.</changelog>
</package>
<package pkgid="6882451f502e3b298f544e6bba62f4a8c18a07513c03a9c8d0efd4480f90f285" name="tailscale" arch="src">
  <version epoch="0" ver="1.98.4" rel="150700.116.1"/>
  <changelog author="rrahl0@opensuse.org" date="1756468800">- add patch fix-CVE-2025-58058.patch, fixing bsc#1248920</changelog>
  <changelog author="rrahl0@opensuse.org" date="1757678400">- update to version 1.88.1:
  * Tailscale CLI prompts users to confirm impactful actions
  * Tailscale SSH works as expected when using an IP address instead of a
    hostname and MagicDNS is disabled
  * fixed: Taildrive sharing when su not present
  * Taildrive files remain consistently accessible
  * new: Tailscale tray GUI
  * DERP IPs changed for Singapore and Tokyo
- remove fix-CVE-2025-58058.patch, fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1759320000">- update to version 1.88.3:
  * cmd/tailscale/cli: add ts2021 debug flag to set a dial plan
  * control/controlhttp: simplify, fix race dialing, remove priority concept
- update to version 1.88.2:
  * k8s-operator: reset service status before append
- require the minimum go version directly, in comparison to using the golang(API)
  symbol</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761307200">- Upate to version 1.90.1:
  * Clients can use configured DNS resolvers for all domains
  * Node keys will be renewed seamlessly
  * Unnecessary path discovery packets over DERP servers are suppressed
  * Node key sealing is GA (generally available) and enabled by default</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761307201">- Update to version 1.90.2:
  * util/linuxfw: fix 32-bit arm regression with iptables
  * health: compare warnable codes to avoid errors on release branch
  * feature/tpm: check TPM family data for compatibility</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761652800">- Update to version 1.90.3:
  * tailscaled shuts down as expected and without panic
  * tailscaled starts up as expected in a no router configuration environment</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761739200">- Update to version 1.90.4:
  * deadlock issue no longer occurs in the client when checking
    for the network to be available
  * tailscaled no longer sporadically panics when a
    Trusted Platform Module (TPM) device is present</changelog>
  <changelog author="rrahl0@opensuse.org" date="1762084800">- Update to version 1.90.6:
  * Routes no longer stall and fail to apply when updated repeatedly in a short
    period of time
  * Tailscale SSH no longer hangs for 10s when connecting to tsrecorder. This
    affected tailnets that use Tailscale SSH recording</changelog>
  <changelog author="rrahl0@opensuse.org" date="1763553600">- Update to version 1.90.8:
  * tka: move RemoveAll() to CompactableChonk
- Update to version 1.90.7:
  * wgengine/magicsock: validate endpoint.derpAddr
  * wgengine/magicsock: fix UDPRelayAllocReq/Resp deadlock
  * net/udprelay: replace VNI pool with selection algorithm
  * feature/relayserver,ipn/ipnlocal,net/udprelay: plumb DERPMap
  * feature/relayserver: fix Shutdown() deadlock
  * net/netmon: do not abandon a subscriber when exiting early
  * tka: don't try to read AUMs which are partway through being written
  * tka: rename a mutex to mu instead of single-letter l
  * ipn/ipnlocal: use an in-memory TKA store if FS is unavailable</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765022400">- Update to version 1.92.1:
  * fix LocalBackend deadlock when packet arrives during profile switch
  * wgengine: fix TSMP/ICMP callback leak
- Update to version 1.92.0:
  * no changelog provided
- Update to version 1.90.9:
  * tailscaled no longer deadlocks during event bursts
  * The client no longer hangs after wake up</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765540800">- Update to version 1.92.2:
  * cmd/derper: add GCP Certificate Manager support</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765972800">- Update to version 1.92.3:
  * WireGuard configuration that occurs automatically in the client, no longer
    results in a panic</changelog>
  <changelog author="rrahl0@opensuse.org" date="1767960000">- Update to version 1.92.5:
  * types/persist: omit Persist.AttestationKey based on IsZero
  * disable hardware attestation for kubernetes
  * allow opting out of ACME order replace extension
- Update to version 1.92.4:
  * nothing of importance</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768996800">- Update to version 1.94.0:
  * derp/derpserver: add a unique sender cardinality estimate
  * syncs: add means of declare locking assumptions for debug mode
  * cmd/k8s-operator: add support for taiscale.com/http-redirect
  * cmd/k8s-operator fix populateTLSSecret on tests
  * feature/posture: log method and full URL for posture identity requests
  * k8s-operator: Fix typos in egress-pod-readiness.go
  * cmd/tailscale,ipn: add Unix socket support for serve
  * client/systray: change systray to start after graphical.target
  * cmd/k8s-operator: warn if users attempt to expose a headless Service
  * cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles
  * tsnet: ensure funnel listener cleans up after itself when closed
  * ipn/store/kubestore: don't load write replica certs in memory
  * tsnet: allow for automatic ID token generation</changelog>
  <changelog author="rrahl0@opensuse.org" date="1769774400">- Update to version 1.94.1:
  * IS SET and NOT SET have been added as device posture operators
  * India DERP Region City Name updated
  * Custom DERP servers support GCP Certificate Manager
  * Tailscale SSH authentication, when successful, results in LOGIN audit
    messages being sent to the kernel audit subsystem
  * Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket
    option is supported on multi-core systems
  * Tailscale Peer Relay server handshake transmission is guarded against
    routing loops over Tailscale
  * MagicDNS always resolves when using resolv.conf without a DNS manager
  * tailscaled_peer_relay_forwarded_packets_total and
    tailscaled_peer_relay_forwarded_bytes_total client metrics are available for
    Tailscale Peer Relays
  * Identity tokens are automatically generated for workload identities
  * --audience flag added to tailscale up command to support auto generation of
    ID tokens for workload identity
  * tsnet nodes can host Tailscale Services
  * The tailscale lock status -json command returns tailnet key authority (TKA)
    data in a stable format
  * Tailscale Peer Relays deliver improved throughput through monotonic time
    comparison optimizations and reduced lock contention
  * Tailscale Services virtual IPs are now automatically accepted by clients
    across all platforms regardless of the status of the --accept-routes
    feature</changelog>
  <changelog author="rrahl0@opensuse.org" date="1771848000">- Update to version 1.94.2:
  * Memory leak caused by high network map response rates is resolved
- fix typo in changelog (version)</changelog>
  <changelog author="rrahl0@opensuse.org" date="1773835200">- Update to version 1.96.2:
  * tailscale dns query|status command supports --json flag to return JSON
    output
  * tailscale wait [flags] command waits for Tailscale resources to become
    available for binding
  * tailscale ip command supports --assert=&lt;specific-ip-address&gt; flag to assert
    that one or more of the node's IP addresses matches the specified IP
    address
  * Tailscale Peer Relays advertise addresses discovered via Amazon EC2
    Instance Metadata Service
  * tailscaled_peer_relay_endpoints gauge user metrics are available for
    Tailscale Peer Relays
  * The AuthKey system policy applies only when a user is not in a logged in
    state
  * UPnP routes as expected during long lived port mapping sessions scenarios,
    including hard NAT
  * Launch the systray application on startup using autostart file with the
    tailscale configure systray --enable-startup=freedesktop command
  * Scaling of Tailscale Peer Relays UDP sockets is gated by container-aware
    GOMAXPROCS defaults
  * Firewall rules created on Linux platforms correctly mark their traffic,
    avoiding reverse path filtering dropping connections and producing health
    warnings and risk prompts</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774008000">- Update to version 1.96.3:
  * DNS resolution issue caused by NRPT rule formatting is resolved</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774612800">- Update to verison 1.96.4:
  * An issue on forks of Linux caused by fallback-on-ENOSYS logic is resolved
  * An issue that could cause a segmentation violation during startup on MIPS
    devices is resolved
- add patch fix-CVE-2026-33747.patch, fixing bsc#1260968</changelog>
  <changelog author="rrahl0@opensuse.org" date="1780056000">- Update to version 1.98.4:
  + An issue causing a deadlock when processing peer changes and disconnecting
    from the Tailscale control server is resolved
- Update to version 1.98.3:
  + An issue where netfilter rules could be applied inconsistently after a
    netfilter mode change failed has been resolved
- Update to version 1.98.2:
  + Ensure MagicDNS resolves tailnet hostnames after a network change
- Update to version 1.98.1:
  + Expired preferred peer addresses are cleared, reducing the time to elect an
    alternative
  + IP forwarding for subnet routers and exit nodes is reported as a health check
  + src_valid_mark sysctl is set in addition to connmark firewall rules to
    improve reverse path filtering and prevent dropped packets
- Remove patch fix-CVE-2026-33747.patch, fixed upstream</changelog>
</package>
<package pkgid="1f3721cc3682ac7a70c8e9d450e97141248774948bb035d0f49317c09ada9ca2" name="tailscale" arch="x86_64">
  <version epoch="0" ver="1.98.4" rel="150700.116.1"/>
  <changelog author="rrahl0@opensuse.org" date="1756468800">- add patch fix-CVE-2025-58058.patch, fixing bsc#1248920</changelog>
  <changelog author="rrahl0@opensuse.org" date="1757678400">- update to version 1.88.1:
  * Tailscale CLI prompts users to confirm impactful actions
  * Tailscale SSH works as expected when using an IP address instead of a
    hostname and MagicDNS is disabled
  * fixed: Taildrive sharing when su not present
  * Taildrive files remain consistently accessible
  * new: Tailscale tray GUI
  * DERP IPs changed for Singapore and Tokyo
- remove fix-CVE-2025-58058.patch, fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1759320000">- update to version 1.88.3:
  * cmd/tailscale/cli: add ts2021 debug flag to set a dial plan
  * control/controlhttp: simplify, fix race dialing, remove priority concept
- update to version 1.88.2:
  * k8s-operator: reset service status before append
- require the minimum go version directly, in comparison to using the golang(API)
  symbol</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761307200">- Upate to version 1.90.1:
  * Clients can use configured DNS resolvers for all domains
  * Node keys will be renewed seamlessly
  * Unnecessary path discovery packets over DERP servers are suppressed
  * Node key sealing is GA (generally available) and enabled by default</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761307201">- Update to version 1.90.2:
  * util/linuxfw: fix 32-bit arm regression with iptables
  * health: compare warnable codes to avoid errors on release branch
  * feature/tpm: check TPM family data for compatibility</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761652800">- Update to version 1.90.3:
  * tailscaled shuts down as expected and without panic
  * tailscaled starts up as expected in a no router configuration environment</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761739200">- Update to version 1.90.4:
  * deadlock issue no longer occurs in the client when checking
    for the network to be available
  * tailscaled no longer sporadically panics when a
    Trusted Platform Module (TPM) device is present</changelog>
  <changelog author="rrahl0@opensuse.org" date="1762084800">- Update to version 1.90.6:
  * Routes no longer stall and fail to apply when updated repeatedly in a short
    period of time
  * Tailscale SSH no longer hangs for 10s when connecting to tsrecorder. This
    affected tailnets that use Tailscale SSH recording</changelog>
  <changelog author="rrahl0@opensuse.org" date="1763553600">- Update to version 1.90.8:
  * tka: move RemoveAll() to CompactableChonk
- Update to version 1.90.7:
  * wgengine/magicsock: validate endpoint.derpAddr
  * wgengine/magicsock: fix UDPRelayAllocReq/Resp deadlock
  * net/udprelay: replace VNI pool with selection algorithm
  * feature/relayserver,ipn/ipnlocal,net/udprelay: plumb DERPMap
  * feature/relayserver: fix Shutdown() deadlock
  * net/netmon: do not abandon a subscriber when exiting early
  * tka: don't try to read AUMs which are partway through being written
  * tka: rename a mutex to mu instead of single-letter l
  * ipn/ipnlocal: use an in-memory TKA store if FS is unavailable</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765022400">- Update to version 1.92.1:
  * fix LocalBackend deadlock when packet arrives during profile switch
  * wgengine: fix TSMP/ICMP callback leak
- Update to version 1.92.0:
  * no changelog provided
- Update to version 1.90.9:
  * tailscaled no longer deadlocks during event bursts
  * The client no longer hangs after wake up</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765540800">- Update to version 1.92.2:
  * cmd/derper: add GCP Certificate Manager support</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765972800">- Update to version 1.92.3:
  * WireGuard configuration that occurs automatically in the client, no longer
    results in a panic</changelog>
  <changelog author="rrahl0@opensuse.org" date="1767960000">- Update to version 1.92.5:
  * types/persist: omit Persist.AttestationKey based on IsZero
  * disable hardware attestation for kubernetes
  * allow opting out of ACME order replace extension
- Update to version 1.92.4:
  * nothing of importance</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768996800">- Update to version 1.94.0:
  * derp/derpserver: add a unique sender cardinality estimate
  * syncs: add means of declare locking assumptions for debug mode
  * cmd/k8s-operator: add support for taiscale.com/http-redirect
  * cmd/k8s-operator fix populateTLSSecret on tests
  * feature/posture: log method and full URL for posture identity requests
  * k8s-operator: Fix typos in egress-pod-readiness.go
  * cmd/tailscale,ipn: add Unix socket support for serve
  * client/systray: change systray to start after graphical.target
  * cmd/k8s-operator: warn if users attempt to expose a headless Service
  * cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles
  * tsnet: ensure funnel listener cleans up after itself when closed
  * ipn/store/kubestore: don't load write replica certs in memory
  * tsnet: allow for automatic ID token generation</changelog>
  <changelog author="rrahl0@opensuse.org" date="1769774400">- Update to version 1.94.1:
  * IS SET and NOT SET have been added as device posture operators
  * India DERP Region City Name updated
  * Custom DERP servers support GCP Certificate Manager
  * Tailscale SSH authentication, when successful, results in LOGIN audit
    messages being sent to the kernel audit subsystem
  * Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket
    option is supported on multi-core systems
  * Tailscale Peer Relay server handshake transmission is guarded against
    routing loops over Tailscale
  * MagicDNS always resolves when using resolv.conf without a DNS manager
  * tailscaled_peer_relay_forwarded_packets_total and
    tailscaled_peer_relay_forwarded_bytes_total client metrics are available for
    Tailscale Peer Relays
  * Identity tokens are automatically generated for workload identities
  * --audience flag added to tailscale up command to support auto generation of
    ID tokens for workload identity
  * tsnet nodes can host Tailscale Services
  * The tailscale lock status -json command returns tailnet key authority (TKA)
    data in a stable format
  * Tailscale Peer Relays deliver improved throughput through monotonic time
    comparison optimizations and reduced lock contention
  * Tailscale Services virtual IPs are now automatically accepted by clients
    across all platforms regardless of the status of the --accept-routes
    feature</changelog>
  <changelog author="rrahl0@opensuse.org" date="1771848000">- Update to version 1.94.2:
  * Memory leak caused by high network map response rates is resolved
- fix typo in changelog (version)</changelog>
  <changelog author="rrahl0@opensuse.org" date="1773835200">- Update to version 1.96.2:
  * tailscale dns query|status command supports --json flag to return JSON
    output
  * tailscale wait [flags] command waits for Tailscale resources to become
    available for binding
  * tailscale ip command supports --assert=&lt;specific-ip-address&gt; flag to assert
    that one or more of the node's IP addresses matches the specified IP
    address
  * Tailscale Peer Relays advertise addresses discovered via Amazon EC2
    Instance Metadata Service
  * tailscaled_peer_relay_endpoints gauge user metrics are available for
    Tailscale Peer Relays
  * The AuthKey system policy applies only when a user is not in a logged in
    state
  * UPnP routes as expected during long lived port mapping sessions scenarios,
    including hard NAT
  * Launch the systray application on startup using autostart file with the
    tailscale configure systray --enable-startup=freedesktop command
  * Scaling of Tailscale Peer Relays UDP sockets is gated by container-aware
    GOMAXPROCS defaults
  * Firewall rules created on Linux platforms correctly mark their traffic,
    avoiding reverse path filtering dropping connections and producing health
    warnings and risk prompts</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774008000">- Update to version 1.96.3:
  * DNS resolution issue caused by NRPT rule formatting is resolved</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774612800">- Update to verison 1.96.4:
  * An issue on forks of Linux caused by fallback-on-ENOSYS logic is resolved
  * An issue that could cause a segmentation violation during startup on MIPS
    devices is resolved
- add patch fix-CVE-2026-33747.patch, fixing bsc#1260968</changelog>
  <changelog author="rrahl0@opensuse.org" date="1780056000">- Update to version 1.98.4:
  + An issue causing a deadlock when processing peer changes and disconnecting
    from the Tailscale control server is resolved
- Update to version 1.98.3:
  + An issue where netfilter rules could be applied inconsistently after a
    netfilter mode change failed has been resolved
- Update to version 1.98.2:
  + Ensure MagicDNS resolves tailnet hostnames after a network change
- Update to version 1.98.1:
  + Expired preferred peer addresses are cleared, reducing the time to elect an
    alternative
  + IP forwarding for subnet routers and exit nodes is reported as a health check
  + src_valid_mark sysctl is set in addition to connmark firewall rules to
    improve reverse path filtering and prevent dropped packets
- Remove patch fix-CVE-2026-33747.patch, fixed upstream</changelog>
</package>
<package pkgid="6361746a3dd6d5f39892e4792be40feee57e3ad10ab5ff4cd6f685145cb91f7e" name="tailscale-bash-completion" arch="noarch">
  <version epoch="0" ver="1.98.4" rel="150700.116.1"/>
  <changelog author="rrahl0@opensuse.org" date="1756468800">- add patch fix-CVE-2025-58058.patch, fixing bsc#1248920</changelog>
  <changelog author="rrahl0@opensuse.org" date="1757678400">- update to version 1.88.1:
  * Tailscale CLI prompts users to confirm impactful actions
  * Tailscale SSH works as expected when using an IP address instead of a
    hostname and MagicDNS is disabled
  * fixed: Taildrive sharing when su not present
  * Taildrive files remain consistently accessible
  * new: Tailscale tray GUI
  * DERP IPs changed for Singapore and Tokyo
- remove fix-CVE-2025-58058.patch, fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1759320000">- update to version 1.88.3:
  * cmd/tailscale/cli: add ts2021 debug flag to set a dial plan
  * control/controlhttp: simplify, fix race dialing, remove priority concept
- update to version 1.88.2:
  * k8s-operator: reset service status before append
- require the minimum go version directly, in comparison to using the golang(API)
  symbol</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761307200">- Upate to version 1.90.1:
  * Clients can use configured DNS resolvers for all domains
  * Node keys will be renewed seamlessly
  * Unnecessary path discovery packets over DERP servers are suppressed
  * Node key sealing is GA (generally available) and enabled by default</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761307201">- Update to version 1.90.2:
  * util/linuxfw: fix 32-bit arm regression with iptables
  * health: compare warnable codes to avoid errors on release branch
  * feature/tpm: check TPM family data for compatibility</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761652800">- Update to version 1.90.3:
  * tailscaled shuts down as expected and without panic
  * tailscaled starts up as expected in a no router configuration environment</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761739200">- Update to version 1.90.4:
  * deadlock issue no longer occurs in the client when checking
    for the network to be available
  * tailscaled no longer sporadically panics when a
    Trusted Platform Module (TPM) device is present</changelog>
  <changelog author="rrahl0@opensuse.org" date="1762084800">- Update to version 1.90.6:
  * Routes no longer stall and fail to apply when updated repeatedly in a short
    period of time
  * Tailscale SSH no longer hangs for 10s when connecting to tsrecorder. This
    affected tailnets that use Tailscale SSH recording</changelog>
  <changelog author="rrahl0@opensuse.org" date="1763553600">- Update to version 1.90.8:
  * tka: move RemoveAll() to CompactableChonk
- Update to version 1.90.7:
  * wgengine/magicsock: validate endpoint.derpAddr
  * wgengine/magicsock: fix UDPRelayAllocReq/Resp deadlock
  * net/udprelay: replace VNI pool with selection algorithm
  * feature/relayserver,ipn/ipnlocal,net/udprelay: plumb DERPMap
  * feature/relayserver: fix Shutdown() deadlock
  * net/netmon: do not abandon a subscriber when exiting early
  * tka: don't try to read AUMs which are partway through being written
  * tka: rename a mutex to mu instead of single-letter l
  * ipn/ipnlocal: use an in-memory TKA store if FS is unavailable</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765022400">- Update to version 1.92.1:
  * fix LocalBackend deadlock when packet arrives during profile switch
  * wgengine: fix TSMP/ICMP callback leak
- Update to version 1.92.0:
  * no changelog provided
- Update to version 1.90.9:
  * tailscaled no longer deadlocks during event bursts
  * The client no longer hangs after wake up</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765540800">- Update to version 1.92.2:
  * cmd/derper: add GCP Certificate Manager support</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765972800">- Update to version 1.92.3:
  * WireGuard configuration that occurs automatically in the client, no longer
    results in a panic</changelog>
  <changelog author="rrahl0@opensuse.org" date="1767960000">- Update to version 1.92.5:
  * types/persist: omit Persist.AttestationKey based on IsZero
  * disable hardware attestation for kubernetes
  * allow opting out of ACME order replace extension
- Update to version 1.92.4:
  * nothing of importance</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768996800">- Update to version 1.94.0:
  * derp/derpserver: add a unique sender cardinality estimate
  * syncs: add means of declare locking assumptions for debug mode
  * cmd/k8s-operator: add support for taiscale.com/http-redirect
  * cmd/k8s-operator fix populateTLSSecret on tests
  * feature/posture: log method and full URL for posture identity requests
  * k8s-operator: Fix typos in egress-pod-readiness.go
  * cmd/tailscale,ipn: add Unix socket support for serve
  * client/systray: change systray to start after graphical.target
  * cmd/k8s-operator: warn if users attempt to expose a headless Service
  * cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles
  * tsnet: ensure funnel listener cleans up after itself when closed
  * ipn/store/kubestore: don't load write replica certs in memory
  * tsnet: allow for automatic ID token generation</changelog>
  <changelog author="rrahl0@opensuse.org" date="1769774400">- Update to version 1.94.1:
  * IS SET and NOT SET have been added as device posture operators
  * India DERP Region City Name updated
  * Custom DERP servers support GCP Certificate Manager
  * Tailscale SSH authentication, when successful, results in LOGIN audit
    messages being sent to the kernel audit subsystem
  * Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket
    option is supported on multi-core systems
  * Tailscale Peer Relay server handshake transmission is guarded against
    routing loops over Tailscale
  * MagicDNS always resolves when using resolv.conf without a DNS manager
  * tailscaled_peer_relay_forwarded_packets_total and
    tailscaled_peer_relay_forwarded_bytes_total client metrics are available for
    Tailscale Peer Relays
  * Identity tokens are automatically generated for workload identities
  * --audience flag added to tailscale up command to support auto generation of
    ID tokens for workload identity
  * tsnet nodes can host Tailscale Services
  * The tailscale lock status -json command returns tailnet key authority (TKA)
    data in a stable format
  * Tailscale Peer Relays deliver improved throughput through monotonic time
    comparison optimizations and reduced lock contention
  * Tailscale Services virtual IPs are now automatically accepted by clients
    across all platforms regardless of the status of the --accept-routes
    feature</changelog>
  <changelog author="rrahl0@opensuse.org" date="1771848000">- Update to version 1.94.2:
  * Memory leak caused by high network map response rates is resolved
- fix typo in changelog (version)</changelog>
  <changelog author="rrahl0@opensuse.org" date="1773835200">- Update to version 1.96.2:
  * tailscale dns query|status command supports --json flag to return JSON
    output
  * tailscale wait [flags] command waits for Tailscale resources to become
    available for binding
  * tailscale ip command supports --assert=&lt;specific-ip-address&gt; flag to assert
    that one or more of the node's IP addresses matches the specified IP
    address
  * Tailscale Peer Relays advertise addresses discovered via Amazon EC2
    Instance Metadata Service
  * tailscaled_peer_relay_endpoints gauge user metrics are available for
    Tailscale Peer Relays
  * The AuthKey system policy applies only when a user is not in a logged in
    state
  * UPnP routes as expected during long lived port mapping sessions scenarios,
    including hard NAT
  * Launch the systray application on startup using autostart file with the
    tailscale configure systray --enable-startup=freedesktop command
  * Scaling of Tailscale Peer Relays UDP sockets is gated by container-aware
    GOMAXPROCS defaults
  * Firewall rules created on Linux platforms correctly mark their traffic,
    avoiding reverse path filtering dropping connections and producing health
    warnings and risk prompts</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774008000">- Update to version 1.96.3:
  * DNS resolution issue caused by NRPT rule formatting is resolved</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774612800">- Update to verison 1.96.4:
  * An issue on forks of Linux caused by fallback-on-ENOSYS logic is resolved
  * An issue that could cause a segmentation violation during startup on MIPS
    devices is resolved
- add patch fix-CVE-2026-33747.patch, fixing bsc#1260968</changelog>
  <changelog author="rrahl0@opensuse.org" date="1780056000">- Update to version 1.98.4:
  + An issue causing a deadlock when processing peer changes and disconnecting
    from the Tailscale control server is resolved
- Update to version 1.98.3:
  + An issue where netfilter rules could be applied inconsistently after a
    netfilter mode change failed has been resolved
- Update to version 1.98.2:
  + Ensure MagicDNS resolves tailnet hostnames after a network change
- Update to version 1.98.1:
  + Expired preferred peer addresses are cleared, reducing the time to elect an
    alternative
  + IP forwarding for subnet routers and exit nodes is reported as a health check
  + src_valid_mark sysctl is set in addition to connmark firewall rules to
    improve reverse path filtering and prevent dropped packets
- Remove patch fix-CVE-2026-33747.patch, fixed upstream</changelog>
</package>
<package pkgid="1909a7a7699e11503eb5248d2e83d8a7d5f007b300648d54139bc731d03a91be" name="tailscale-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.98.4" rel="150700.116.1"/>
  <changelog author="rrahl0@opensuse.org" date="1756468800">- add patch fix-CVE-2025-58058.patch, fixing bsc#1248920</changelog>
  <changelog author="rrahl0@opensuse.org" date="1757678400">- update to version 1.88.1:
  * Tailscale CLI prompts users to confirm impactful actions
  * Tailscale SSH works as expected when using an IP address instead of a
    hostname and MagicDNS is disabled
  * fixed: Taildrive sharing when su not present
  * Taildrive files remain consistently accessible
  * new: Tailscale tray GUI
  * DERP IPs changed for Singapore and Tokyo
- remove fix-CVE-2025-58058.patch, fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1759320000">- update to version 1.88.3:
  * cmd/tailscale/cli: add ts2021 debug flag to set a dial plan
  * control/controlhttp: simplify, fix race dialing, remove priority concept
- update to version 1.88.2:
  * k8s-operator: reset service status before append
- require the minimum go version directly, in comparison to using the golang(API)
  symbol</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761307200">- Upate to version 1.90.1:
  * Clients can use configured DNS resolvers for all domains
  * Node keys will be renewed seamlessly
  * Unnecessary path discovery packets over DERP servers are suppressed
  * Node key sealing is GA (generally available) and enabled by default</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761307201">- Update to version 1.90.2:
  * util/linuxfw: fix 32-bit arm regression with iptables
  * health: compare warnable codes to avoid errors on release branch
  * feature/tpm: check TPM family data for compatibility</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761652800">- Update to version 1.90.3:
  * tailscaled shuts down as expected and without panic
  * tailscaled starts up as expected in a no router configuration environment</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761739200">- Update to version 1.90.4:
  * deadlock issue no longer occurs in the client when checking
    for the network to be available
  * tailscaled no longer sporadically panics when a
    Trusted Platform Module (TPM) device is present</changelog>
  <changelog author="rrahl0@opensuse.org" date="1762084800">- Update to version 1.90.6:
  * Routes no longer stall and fail to apply when updated repeatedly in a short
    period of time
  * Tailscale SSH no longer hangs for 10s when connecting to tsrecorder. This
    affected tailnets that use Tailscale SSH recording</changelog>
  <changelog author="rrahl0@opensuse.org" date="1763553600">- Update to version 1.90.8:
  * tka: move RemoveAll() to CompactableChonk
- Update to version 1.90.7:
  * wgengine/magicsock: validate endpoint.derpAddr
  * wgengine/magicsock: fix UDPRelayAllocReq/Resp deadlock
  * net/udprelay: replace VNI pool with selection algorithm
  * feature/relayserver,ipn/ipnlocal,net/udprelay: plumb DERPMap
  * feature/relayserver: fix Shutdown() deadlock
  * net/netmon: do not abandon a subscriber when exiting early
  * tka: don't try to read AUMs which are partway through being written
  * tka: rename a mutex to mu instead of single-letter l
  * ipn/ipnlocal: use an in-memory TKA store if FS is unavailable</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765022400">- Update to version 1.92.1:
  * fix LocalBackend deadlock when packet arrives during profile switch
  * wgengine: fix TSMP/ICMP callback leak
- Update to version 1.92.0:
  * no changelog provided
- Update to version 1.90.9:
  * tailscaled no longer deadlocks during event bursts
  * The client no longer hangs after wake up</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765540800">- Update to version 1.92.2:
  * cmd/derper: add GCP Certificate Manager support</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765972800">- Update to version 1.92.3:
  * WireGuard configuration that occurs automatically in the client, no longer
    results in a panic</changelog>
  <changelog author="rrahl0@opensuse.org" date="1767960000">- Update to version 1.92.5:
  * types/persist: omit Persist.AttestationKey based on IsZero
  * disable hardware attestation for kubernetes
  * allow opting out of ACME order replace extension
- Update to version 1.92.4:
  * nothing of importance</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768996800">- Update to version 1.94.0:
  * derp/derpserver: add a unique sender cardinality estimate
  * syncs: add means of declare locking assumptions for debug mode
  * cmd/k8s-operator: add support for taiscale.com/http-redirect
  * cmd/k8s-operator fix populateTLSSecret on tests
  * feature/posture: log method and full URL for posture identity requests
  * k8s-operator: Fix typos in egress-pod-readiness.go
  * cmd/tailscale,ipn: add Unix socket support for serve
  * client/systray: change systray to start after graphical.target
  * cmd/k8s-operator: warn if users attempt to expose a headless Service
  * cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles
  * tsnet: ensure funnel listener cleans up after itself when closed
  * ipn/store/kubestore: don't load write replica certs in memory
  * tsnet: allow for automatic ID token generation</changelog>
  <changelog author="rrahl0@opensuse.org" date="1769774400">- Update to version 1.94.1:
  * IS SET and NOT SET have been added as device posture operators
  * India DERP Region City Name updated
  * Custom DERP servers support GCP Certificate Manager
  * Tailscale SSH authentication, when successful, results in LOGIN audit
    messages being sent to the kernel audit subsystem
  * Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket
    option is supported on multi-core systems
  * Tailscale Peer Relay server handshake transmission is guarded against
    routing loops over Tailscale
  * MagicDNS always resolves when using resolv.conf without a DNS manager
  * tailscaled_peer_relay_forwarded_packets_total and
    tailscaled_peer_relay_forwarded_bytes_total client metrics are available for
    Tailscale Peer Relays
  * Identity tokens are automatically generated for workload identities
  * --audience flag added to tailscale up command to support auto generation of
    ID tokens for workload identity
  * tsnet nodes can host Tailscale Services
  * The tailscale lock status -json command returns tailnet key authority (TKA)
    data in a stable format
  * Tailscale Peer Relays deliver improved throughput through monotonic time
    comparison optimizations and reduced lock contention
  * Tailscale Services virtual IPs are now automatically accepted by clients
    across all platforms regardless of the status of the --accept-routes
    feature</changelog>
  <changelog author="rrahl0@opensuse.org" date="1771848000">- Update to version 1.94.2:
  * Memory leak caused by high network map response rates is resolved
- fix typo in changelog (version)</changelog>
  <changelog author="rrahl0@opensuse.org" date="1773835200">- Update to version 1.96.2:
  * tailscale dns query|status command supports --json flag to return JSON
    output
  * tailscale wait [flags] command waits for Tailscale resources to become
    available for binding
  * tailscale ip command supports --assert=&lt;specific-ip-address&gt; flag to assert
    that one or more of the node's IP addresses matches the specified IP
    address
  * Tailscale Peer Relays advertise addresses discovered via Amazon EC2
    Instance Metadata Service
  * tailscaled_peer_relay_endpoints gauge user metrics are available for
    Tailscale Peer Relays
  * The AuthKey system policy applies only when a user is not in a logged in
    state
  * UPnP routes as expected during long lived port mapping sessions scenarios,
    including hard NAT
  * Launch the systray application on startup using autostart file with the
    tailscale configure systray --enable-startup=freedesktop command
  * Scaling of Tailscale Peer Relays UDP sockets is gated by container-aware
    GOMAXPROCS defaults
  * Firewall rules created on Linux platforms correctly mark their traffic,
    avoiding reverse path filtering dropping connections and producing health
    warnings and risk prompts</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774008000">- Update to version 1.96.3:
  * DNS resolution issue caused by NRPT rule formatting is resolved</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774612800">- Update to verison 1.96.4:
  * An issue on forks of Linux caused by fallback-on-ENOSYS logic is resolved
  * An issue that could cause a segmentation violation during startup on MIPS
    devices is resolved
- add patch fix-CVE-2026-33747.patch, fixing bsc#1260968</changelog>
  <changelog author="rrahl0@opensuse.org" date="1780056000">- Update to version 1.98.4:
  + An issue causing a deadlock when processing peer changes and disconnecting
    from the Tailscale control server is resolved
- Update to version 1.98.3:
  + An issue where netfilter rules could be applied inconsistently after a
    netfilter mode change failed has been resolved
- Update to version 1.98.2:
  + Ensure MagicDNS resolves tailnet hostnames after a network change
- Update to version 1.98.1:
  + Expired preferred peer addresses are cleared, reducing the time to elect an
    alternative
  + IP forwarding for subnet routers and exit nodes is reported as a health check
  + src_valid_mark sysctl is set in addition to connmark firewall rules to
    improve reverse path filtering and prevent dropped packets
- Remove patch fix-CVE-2026-33747.patch, fixed upstream</changelog>
</package>
<package pkgid="3099f71fc59fc75a40c576c8fdbb841ce9f31d0b63235607c5fd648a8239cf6e" name="tailscale-fish-completion" arch="noarch">
  <version epoch="0" ver="1.98.4" rel="150700.116.1"/>
  <changelog author="rrahl0@opensuse.org" date="1756468800">- add patch fix-CVE-2025-58058.patch, fixing bsc#1248920</changelog>
  <changelog author="rrahl0@opensuse.org" date="1757678400">- update to version 1.88.1:
  * Tailscale CLI prompts users to confirm impactful actions
  * Tailscale SSH works as expected when using an IP address instead of a
    hostname and MagicDNS is disabled
  * fixed: Taildrive sharing when su not present
  * Taildrive files remain consistently accessible
  * new: Tailscale tray GUI
  * DERP IPs changed for Singapore and Tokyo
- remove fix-CVE-2025-58058.patch, fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1759320000">- update to version 1.88.3:
  * cmd/tailscale/cli: add ts2021 debug flag to set a dial plan
  * control/controlhttp: simplify, fix race dialing, remove priority concept
- update to version 1.88.2:
  * k8s-operator: reset service status before append
- require the minimum go version directly, in comparison to using the golang(API)
  symbol</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761307200">- Upate to version 1.90.1:
  * Clients can use configured DNS resolvers for all domains
  * Node keys will be renewed seamlessly
  * Unnecessary path discovery packets over DERP servers are suppressed
  * Node key sealing is GA (generally available) and enabled by default</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761307201">- Update to version 1.90.2:
  * util/linuxfw: fix 32-bit arm regression with iptables
  * health: compare warnable codes to avoid errors on release branch
  * feature/tpm: check TPM family data for compatibility</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761652800">- Update to version 1.90.3:
  * tailscaled shuts down as expected and without panic
  * tailscaled starts up as expected in a no router configuration environment</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761739200">- Update to version 1.90.4:
  * deadlock issue no longer occurs in the client when checking
    for the network to be available
  * tailscaled no longer sporadically panics when a
    Trusted Platform Module (TPM) device is present</changelog>
  <changelog author="rrahl0@opensuse.org" date="1762084800">- Update to version 1.90.6:
  * Routes no longer stall and fail to apply when updated repeatedly in a short
    period of time
  * Tailscale SSH no longer hangs for 10s when connecting to tsrecorder. This
    affected tailnets that use Tailscale SSH recording</changelog>
  <changelog author="rrahl0@opensuse.org" date="1763553600">- Update to version 1.90.8:
  * tka: move RemoveAll() to CompactableChonk
- Update to version 1.90.7:
  * wgengine/magicsock: validate endpoint.derpAddr
  * wgengine/magicsock: fix UDPRelayAllocReq/Resp deadlock
  * net/udprelay: replace VNI pool with selection algorithm
  * feature/relayserver,ipn/ipnlocal,net/udprelay: plumb DERPMap
  * feature/relayserver: fix Shutdown() deadlock
  * net/netmon: do not abandon a subscriber when exiting early
  * tka: don't try to read AUMs which are partway through being written
  * tka: rename a mutex to mu instead of single-letter l
  * ipn/ipnlocal: use an in-memory TKA store if FS is unavailable</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765022400">- Update to version 1.92.1:
  * fix LocalBackend deadlock when packet arrives during profile switch
  * wgengine: fix TSMP/ICMP callback leak
- Update to version 1.92.0:
  * no changelog provided
- Update to version 1.90.9:
  * tailscaled no longer deadlocks during event bursts
  * The client no longer hangs after wake up</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765540800">- Update to version 1.92.2:
  * cmd/derper: add GCP Certificate Manager support</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765972800">- Update to version 1.92.3:
  * WireGuard configuration that occurs automatically in the client, no longer
    results in a panic</changelog>
  <changelog author="rrahl0@opensuse.org" date="1767960000">- Update to version 1.92.5:
  * types/persist: omit Persist.AttestationKey based on IsZero
  * disable hardware attestation for kubernetes
  * allow opting out of ACME order replace extension
- Update to version 1.92.4:
  * nothing of importance</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768996800">- Update to version 1.94.0:
  * derp/derpserver: add a unique sender cardinality estimate
  * syncs: add means of declare locking assumptions for debug mode
  * cmd/k8s-operator: add support for taiscale.com/http-redirect
  * cmd/k8s-operator fix populateTLSSecret on tests
  * feature/posture: log method and full URL for posture identity requests
  * k8s-operator: Fix typos in egress-pod-readiness.go
  * cmd/tailscale,ipn: add Unix socket support for serve
  * client/systray: change systray to start after graphical.target
  * cmd/k8s-operator: warn if users attempt to expose a headless Service
  * cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles
  * tsnet: ensure funnel listener cleans up after itself when closed
  * ipn/store/kubestore: don't load write replica certs in memory
  * tsnet: allow for automatic ID token generation</changelog>
  <changelog author="rrahl0@opensuse.org" date="1769774400">- Update to version 1.94.1:
  * IS SET and NOT SET have been added as device posture operators
  * India DERP Region City Name updated
  * Custom DERP servers support GCP Certificate Manager
  * Tailscale SSH authentication, when successful, results in LOGIN audit
    messages being sent to the kernel audit subsystem
  * Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket
    option is supported on multi-core systems
  * Tailscale Peer Relay server handshake transmission is guarded against
    routing loops over Tailscale
  * MagicDNS always resolves when using resolv.conf without a DNS manager
  * tailscaled_peer_relay_forwarded_packets_total and
    tailscaled_peer_relay_forwarded_bytes_total client metrics are available for
    Tailscale Peer Relays
  * Identity tokens are automatically generated for workload identities
  * --audience flag added to tailscale up command to support auto generation of
    ID tokens for workload identity
  * tsnet nodes can host Tailscale Services
  * The tailscale lock status -json command returns tailnet key authority (TKA)
    data in a stable format
  * Tailscale Peer Relays deliver improved throughput through monotonic time
    comparison optimizations and reduced lock contention
  * Tailscale Services virtual IPs are now automatically accepted by clients
    across all platforms regardless of the status of the --accept-routes
    feature</changelog>
  <changelog author="rrahl0@opensuse.org" date="1771848000">- Update to version 1.94.2:
  * Memory leak caused by high network map response rates is resolved
- fix typo in changelog (version)</changelog>
  <changelog author="rrahl0@opensuse.org" date="1773835200">- Update to version 1.96.2:
  * tailscale dns query|status command supports --json flag to return JSON
    output
  * tailscale wait [flags] command waits for Tailscale resources to become
    available for binding
  * tailscale ip command supports --assert=&lt;specific-ip-address&gt; flag to assert
    that one or more of the node's IP addresses matches the specified IP
    address
  * Tailscale Peer Relays advertise addresses discovered via Amazon EC2
    Instance Metadata Service
  * tailscaled_peer_relay_endpoints gauge user metrics are available for
    Tailscale Peer Relays
  * The AuthKey system policy applies only when a user is not in a logged in
    state
  * UPnP routes as expected during long lived port mapping sessions scenarios,
    including hard NAT
  * Launch the systray application on startup using autostart file with the
    tailscale configure systray --enable-startup=freedesktop command
  * Scaling of Tailscale Peer Relays UDP sockets is gated by container-aware
    GOMAXPROCS defaults
  * Firewall rules created on Linux platforms correctly mark their traffic,
    avoiding reverse path filtering dropping connections and producing health
    warnings and risk prompts</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774008000">- Update to version 1.96.3:
  * DNS resolution issue caused by NRPT rule formatting is resolved</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774612800">- Update to verison 1.96.4:
  * An issue on forks of Linux caused by fallback-on-ENOSYS logic is resolved
  * An issue that could cause a segmentation violation during startup on MIPS
    devices is resolved
- add patch fix-CVE-2026-33747.patch, fixing bsc#1260968</changelog>
  <changelog author="rrahl0@opensuse.org" date="1780056000">- Update to version 1.98.4:
  + An issue causing a deadlock when processing peer changes and disconnecting
    from the Tailscale control server is resolved
- Update to version 1.98.3:
  + An issue where netfilter rules could be applied inconsistently after a
    netfilter mode change failed has been resolved
- Update to version 1.98.2:
  + Ensure MagicDNS resolves tailnet hostnames after a network change
- Update to version 1.98.1:
  + Expired preferred peer addresses are cleared, reducing the time to elect an
    alternative
  + IP forwarding for subnet routers and exit nodes is reported as a health check
  + src_valid_mark sysctl is set in addition to connmark firewall rules to
    improve reverse path filtering and prevent dropped packets
- Remove patch fix-CVE-2026-33747.patch, fixed upstream</changelog>
</package>
<package pkgid="cdc798cf2f6820c1a806c4e801b15ccd2fb976c284f49eb51369eef10232fe0a" name="tailscale-zsh-completion" arch="noarch">
  <version epoch="0" ver="1.98.4" rel="150700.116.1"/>
  <changelog author="rrahl0@opensuse.org" date="1756468800">- add patch fix-CVE-2025-58058.patch, fixing bsc#1248920</changelog>
  <changelog author="rrahl0@opensuse.org" date="1757678400">- update to version 1.88.1:
  * Tailscale CLI prompts users to confirm impactful actions
  * Tailscale SSH works as expected when using an IP address instead of a
    hostname and MagicDNS is disabled
  * fixed: Taildrive sharing when su not present
  * Taildrive files remain consistently accessible
  * new: Tailscale tray GUI
  * DERP IPs changed for Singapore and Tokyo
- remove fix-CVE-2025-58058.patch, fixed upstream</changelog>
  <changelog author="rrahl0@opensuse.org" date="1759320000">- update to version 1.88.3:
  * cmd/tailscale/cli: add ts2021 debug flag to set a dial plan
  * control/controlhttp: simplify, fix race dialing, remove priority concept
- update to version 1.88.2:
  * k8s-operator: reset service status before append
- require the minimum go version directly, in comparison to using the golang(API)
  symbol</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761307200">- Upate to version 1.90.1:
  * Clients can use configured DNS resolvers for all domains
  * Node keys will be renewed seamlessly
  * Unnecessary path discovery packets over DERP servers are suppressed
  * Node key sealing is GA (generally available) and enabled by default</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761307201">- Update to version 1.90.2:
  * util/linuxfw: fix 32-bit arm regression with iptables
  * health: compare warnable codes to avoid errors on release branch
  * feature/tpm: check TPM family data for compatibility</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761652800">- Update to version 1.90.3:
  * tailscaled shuts down as expected and without panic
  * tailscaled starts up as expected in a no router configuration environment</changelog>
  <changelog author="rrahl0@opensuse.org" date="1761739200">- Update to version 1.90.4:
  * deadlock issue no longer occurs in the client when checking
    for the network to be available
  * tailscaled no longer sporadically panics when a
    Trusted Platform Module (TPM) device is present</changelog>
  <changelog author="rrahl0@opensuse.org" date="1762084800">- Update to version 1.90.6:
  * Routes no longer stall and fail to apply when updated repeatedly in a short
    period of time
  * Tailscale SSH no longer hangs for 10s when connecting to tsrecorder. This
    affected tailnets that use Tailscale SSH recording</changelog>
  <changelog author="rrahl0@opensuse.org" date="1763553600">- Update to version 1.90.8:
  * tka: move RemoveAll() to CompactableChonk
- Update to version 1.90.7:
  * wgengine/magicsock: validate endpoint.derpAddr
  * wgengine/magicsock: fix UDPRelayAllocReq/Resp deadlock
  * net/udprelay: replace VNI pool with selection algorithm
  * feature/relayserver,ipn/ipnlocal,net/udprelay: plumb DERPMap
  * feature/relayserver: fix Shutdown() deadlock
  * net/netmon: do not abandon a subscriber when exiting early
  * tka: don't try to read AUMs which are partway through being written
  * tka: rename a mutex to mu instead of single-letter l
  * ipn/ipnlocal: use an in-memory TKA store if FS is unavailable</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765022400">- Update to version 1.92.1:
  * fix LocalBackend deadlock when packet arrives during profile switch
  * wgengine: fix TSMP/ICMP callback leak
- Update to version 1.92.0:
  * no changelog provided
- Update to version 1.90.9:
  * tailscaled no longer deadlocks during event bursts
  * The client no longer hangs after wake up</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765540800">- Update to version 1.92.2:
  * cmd/derper: add GCP Certificate Manager support</changelog>
  <changelog author="rrahl0@opensuse.org" date="1765972800">- Update to version 1.92.3:
  * WireGuard configuration that occurs automatically in the client, no longer
    results in a panic</changelog>
  <changelog author="rrahl0@opensuse.org" date="1767960000">- Update to version 1.92.5:
  * types/persist: omit Persist.AttestationKey based on IsZero
  * disable hardware attestation for kubernetes
  * allow opting out of ACME order replace extension
- Update to version 1.92.4:
  * nothing of importance</changelog>
  <changelog author="rrahl0@opensuse.org" date="1768996800">- Update to version 1.94.0:
  * derp/derpserver: add a unique sender cardinality estimate
  * syncs: add means of declare locking assumptions for debug mode
  * cmd/k8s-operator: add support for taiscale.com/http-redirect
  * cmd/k8s-operator fix populateTLSSecret on tests
  * feature/posture: log method and full URL for posture identity requests
  * k8s-operator: Fix typos in egress-pod-readiness.go
  * cmd/tailscale,ipn: add Unix socket support for serve
  * client/systray: change systray to start after graphical.target
  * cmd/k8s-operator: warn if users attempt to expose a headless Service
  * cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles
  * tsnet: ensure funnel listener cleans up after itself when closed
  * ipn/store/kubestore: don't load write replica certs in memory
  * tsnet: allow for automatic ID token generation</changelog>
  <changelog author="rrahl0@opensuse.org" date="1769774400">- Update to version 1.94.1:
  * IS SET and NOT SET have been added as device posture operators
  * India DERP Region City Name updated
  * Custom DERP servers support GCP Certificate Manager
  * Tailscale SSH authentication, when successful, results in LOGIN audit
    messages being sent to the kernel audit subsystem
  * Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket
    option is supported on multi-core systems
  * Tailscale Peer Relay server handshake transmission is guarded against
    routing loops over Tailscale
  * MagicDNS always resolves when using resolv.conf without a DNS manager
  * tailscaled_peer_relay_forwarded_packets_total and
    tailscaled_peer_relay_forwarded_bytes_total client metrics are available for
    Tailscale Peer Relays
  * Identity tokens are automatically generated for workload identities
  * --audience flag added to tailscale up command to support auto generation of
    ID tokens for workload identity
  * tsnet nodes can host Tailscale Services
  * The tailscale lock status -json command returns tailnet key authority (TKA)
    data in a stable format
  * Tailscale Peer Relays deliver improved throughput through monotonic time
    comparison optimizations and reduced lock contention
  * Tailscale Services virtual IPs are now automatically accepted by clients
    across all platforms regardless of the status of the --accept-routes
    feature</changelog>
  <changelog author="rrahl0@opensuse.org" date="1771848000">- Update to version 1.94.2:
  * Memory leak caused by high network map response rates is resolved
- fix typo in changelog (version)</changelog>
  <changelog author="rrahl0@opensuse.org" date="1773835200">- Update to version 1.96.2:
  * tailscale dns query|status command supports --json flag to return JSON
    output
  * tailscale wait [flags] command waits for Tailscale resources to become
    available for binding
  * tailscale ip command supports --assert=&lt;specific-ip-address&gt; flag to assert
    that one or more of the node's IP addresses matches the specified IP
    address
  * Tailscale Peer Relays advertise addresses discovered via Amazon EC2
    Instance Metadata Service
  * tailscaled_peer_relay_endpoints gauge user metrics are available for
    Tailscale Peer Relays
  * The AuthKey system policy applies only when a user is not in a logged in
    state
  * UPnP routes as expected during long lived port mapping sessions scenarios,
    including hard NAT
  * Launch the systray application on startup using autostart file with the
    tailscale configure systray --enable-startup=freedesktop command
  * Scaling of Tailscale Peer Relays UDP sockets is gated by container-aware
    GOMAXPROCS defaults
  * Firewall rules created on Linux platforms correctly mark their traffic,
    avoiding reverse path filtering dropping connections and producing health
    warnings and risk prompts</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774008000">- Update to version 1.96.3:
  * DNS resolution issue caused by NRPT rule formatting is resolved</changelog>
  <changelog author="rrahl0@opensuse.org" date="1774612800">- Update to verison 1.96.4:
  * An issue on forks of Linux caused by fallback-on-ENOSYS logic is resolved
  * An issue that could cause a segmentation violation during startup on MIPS
    devices is resolved
- add patch fix-CVE-2026-33747.patch, fixing bsc#1260968</changelog>
  <changelog author="rrahl0@opensuse.org" date="1780056000">- Update to version 1.98.4:
  + An issue causing a deadlock when processing peer changes and disconnecting
    from the Tailscale control server is resolved
- Update to version 1.98.3:
  + An issue where netfilter rules could be applied inconsistently after a
    netfilter mode change failed has been resolved
- Update to version 1.98.2:
  + Ensure MagicDNS resolves tailnet hostnames after a network change
- Update to version 1.98.1:
  + Expired preferred peer addresses are cleared, reducing the time to elect an
    alternative
  + IP forwarding for subnet routers and exit nodes is reported as a health check
  + src_valid_mark sysctl is set in addition to connmark firewall rules to
    improve reverse path filtering and prevent dropped packets
- Remove patch fix-CVE-2026-33747.patch, fixed upstream</changelog>
</package>
<package pkgid="d1f5f27177e85a0ebd4700d12d1099a96154cecd89fd37d075e55d74c957b5e5" name="tinc" arch="src">
  <version epoch="0" ver="1.0.37" rel="150700.42.1"/>
  <changelog author="michele.bologna@suse.com" date="1518004800">- Initial package creation</changelog>
  <changelog author="abergmann@suse.com" date="1539000000">- Security update to version 1.0.35.
  * Prevent oracle attacks (CVE-2018-16737, CVE-2018-16738).
  * Prevent a MITM from forcing a NULL cipher for UDP (CVE-2018-16758).</changelog>
  <changelog author="abergmann@suse.com" date="1539000001">- Fix systemd path problem.
  * Add tinc-1.0.35-systemd-path-fix.patch</changelog>
  <changelog author="palica@liguros.net" date="1555675200">- Adding tinc.service and tinc@.service</changelog>
  <changelog author="christophe@krop.fr" date="1558353600">- Add the missing zlib requirement.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="Michele.Bologna@suse.com" date="1580817600">- Update to tinc 1.0.36
- Rename tinc-1.0.35-systemd-path-fix.patch to tinc-systemd-path-fix.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_tinc.service.patch
  * harden_tinc@.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1673611200">- Removed PrivateDevices setting and allow access to /dev/net/tun for the
  service. Updated harden_tinc@.service.patch (also harden_tinc.service.patch
  to keep it in sync, even thought nothing really happens in there)
  (bsc#1181400)</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="rrahl0@opensuse.org" date="1773403200">- Update to version 1.0.37:
  * Minor fixes
  * Drop support for Linux ethertap devices
  * Ensure tinc compiles cleanly on modern systems
- Drop patches tinc-systemd-path-fix.patch, harden_tinc@.service.patch
  harden_tinc.service.patch
- Attach the signature and keyring for verifying the source</changelog>
</package>
<package pkgid="0191d00ef975f20767a63e4a926b2cccb800f0c812bdaffdfcbb6444d48dc054" name="tinc" arch="x86_64">
  <version epoch="0" ver="1.0.37" rel="150700.42.1"/>
  <changelog author="michele.bologna@suse.com" date="1518004800">- Initial package creation</changelog>
  <changelog author="abergmann@suse.com" date="1539000000">- Security update to version 1.0.35.
  * Prevent oracle attacks (CVE-2018-16737, CVE-2018-16738).
  * Prevent a MITM from forcing a NULL cipher for UDP (CVE-2018-16758).</changelog>
  <changelog author="abergmann@suse.com" date="1539000001">- Fix systemd path problem.
  * Add tinc-1.0.35-systemd-path-fix.patch</changelog>
  <changelog author="palica@liguros.net" date="1555675200">- Adding tinc.service and tinc@.service</changelog>
  <changelog author="christophe@krop.fr" date="1558353600">- Add the missing zlib requirement.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="Michele.Bologna@suse.com" date="1580817600">- Update to tinc 1.0.36
- Rename tinc-1.0.35-systemd-path-fix.patch to tinc-systemd-path-fix.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_tinc.service.patch
  * harden_tinc@.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1673611200">- Removed PrivateDevices setting and allow access to /dev/net/tun for the
  service. Updated harden_tinc@.service.patch (also harden_tinc.service.patch
  to keep it in sync, even thought nothing really happens in there)
  (bsc#1181400)</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="rrahl0@opensuse.org" date="1773403200">- Update to version 1.0.37:
  * Minor fixes
  * Drop support for Linux ethertap devices
  * Ensure tinc compiles cleanly on modern systems
- Drop patches tinc-systemd-path-fix.patch, harden_tinc@.service.patch
  harden_tinc.service.patch
- Attach the signature and keyring for verifying the source</changelog>
</package>
<package pkgid="1f3fa37d338462eece544826c0a57e65a9a133bd02ccf135d1d22f6ee93842a7" name="tinc-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.0.37" rel="150700.42.1"/>
  <changelog author="michele.bologna@suse.com" date="1518004800">- Initial package creation</changelog>
  <changelog author="abergmann@suse.com" date="1539000000">- Security update to version 1.0.35.
  * Prevent oracle attacks (CVE-2018-16737, CVE-2018-16738).
  * Prevent a MITM from forcing a NULL cipher for UDP (CVE-2018-16758).</changelog>
  <changelog author="abergmann@suse.com" date="1539000001">- Fix systemd path problem.
  * Add tinc-1.0.35-systemd-path-fix.patch</changelog>
  <changelog author="palica@liguros.net" date="1555675200">- Adding tinc.service and tinc@.service</changelog>
  <changelog author="christophe@krop.fr" date="1558353600">- Add the missing zlib requirement.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="Michele.Bologna@suse.com" date="1580817600">- Update to tinc 1.0.36
- Rename tinc-1.0.35-systemd-path-fix.patch to tinc-systemd-path-fix.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_tinc.service.patch
  * harden_tinc@.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1673611200">- Removed PrivateDevices setting and allow access to /dev/net/tun for the
  service. Updated harden_tinc@.service.patch (also harden_tinc.service.patch
  to keep it in sync, even thought nothing really happens in there)
  (bsc#1181400)</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="rrahl0@opensuse.org" date="1773403200">- Update to version 1.0.37:
  * Minor fixes
  * Drop support for Linux ethertap devices
  * Ensure tinc compiles cleanly on modern systems
- Drop patches tinc-systemd-path-fix.patch, harden_tinc@.service.patch
  harden_tinc.service.patch
- Attach the signature and keyring for verifying the source</changelog>
</package>
<package pkgid="653abdfca280e8f2c887c47a626ea6321f9e243c81d156f78edc2fd2322cc6e7" name="tinc-debugsource" arch="x86_64">
  <version epoch="0" ver="1.0.37" rel="150700.42.1"/>
  <changelog author="michele.bologna@suse.com" date="1518004800">- Initial package creation</changelog>
  <changelog author="abergmann@suse.com" date="1539000000">- Security update to version 1.0.35.
  * Prevent oracle attacks (CVE-2018-16737, CVE-2018-16738).
  * Prevent a MITM from forcing a NULL cipher for UDP (CVE-2018-16758).</changelog>
  <changelog author="abergmann@suse.com" date="1539000001">- Fix systemd path problem.
  * Add tinc-1.0.35-systemd-path-fix.patch</changelog>
  <changelog author="palica@liguros.net" date="1555675200">- Adding tinc.service and tinc@.service</changelog>
  <changelog author="christophe@krop.fr" date="1558353600">- Add the missing zlib requirement.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="Michele.Bologna@suse.com" date="1580817600">- Update to tinc 1.0.36
- Rename tinc-1.0.35-systemd-path-fix.patch to tinc-systemd-path-fix.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_tinc.service.patch
  * harden_tinc@.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1673611200">- Removed PrivateDevices setting and allow access to /dev/net/tun for the
  service. Updated harden_tinc@.service.patch (also harden_tinc.service.patch
  to keep it in sync, even thought nothing really happens in there)
  (bsc#1181400)</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="rrahl0@opensuse.org" date="1773403200">- Update to version 1.0.37:
  * Minor fixes
  * Drop support for Linux ethertap devices
  * Ensure tinc compiles cleanly on modern systems
- Drop patches tinc-systemd-path-fix.patch, harden_tinc@.service.patch
  harden_tinc.service.patch
- Attach the signature and keyring for verifying the source</changelog>
</package>
</otherdata>