<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="46">
<package pkgid="db08009370ebeceaaed0295ad7ed73eda60fd258d3937cb06964fe69517a9662" name="gettext-go-lint" arch="aarch64">
  <version epoch="0" ver="0.1.0" rel="150400.1.2"/>
  <changelog author="cbosdonnat@suse.com" date="1714478400">- Initial version of gettext-go-lint 0.0.1</changelog>
  <changelog author="cbosdonnat@suse.com" date="1714478401">- version 0.1.0-0
  * Detect similar strings
  * Detect use of three dots instead of ellipsis character
  * Detect multiple unnamed variables</changelog>
</package>
<package pkgid="b41af987f05d6359f541c8c0027846ddfe92c55f8dc858d8d708230548fb8513" name="gettext-go-lint" arch="ppc64le">
  <version epoch="0" ver="0.1.0" rel="150400.1.2"/>
  <changelog author="cbosdonnat@suse.com" date="1714478400">- Initial version of gettext-go-lint 0.0.1</changelog>
  <changelog author="cbosdonnat@suse.com" date="1714478401">- version 0.1.0-0
  * Detect similar strings
  * Detect use of three dots instead of ellipsis character
  * Detect multiple unnamed variables</changelog>
</package>
<package pkgid="1b4dd8aaa6c93a9dedbff62e85549bf20139c6a0225f2d045d4496dda8286935" name="gettext-go-lint" arch="s390x">
  <version epoch="0" ver="0.1.0" rel="150400.1.2"/>
  <changelog author="cbosdonnat@suse.com" date="1714478400">- Initial version of gettext-go-lint 0.0.1</changelog>
  <changelog author="cbosdonnat@suse.com" date="1714478401">- version 0.1.0-0
  * Detect similar strings
  * Detect use of three dots instead of ellipsis character
  * Detect multiple unnamed variables</changelog>
</package>
<package pkgid="42530a7778261e170538d3056b104bfe955d2d0b651114b5548d1af4e3eb61b3" name="gettext-go-lint" arch="src">
  <version epoch="0" ver="0.1.0" rel="150400.1.2"/>
  <changelog author="cbosdonnat@suse.com" date="1714478400">- Initial version of gettext-go-lint 0.0.1</changelog>
  <changelog author="cbosdonnat@suse.com" date="1714478401">- version 0.1.0-0
  * Detect similar strings
  * Detect use of three dots instead of ellipsis character
  * Detect multiple unnamed variables</changelog>
</package>
<package pkgid="a056e064dee3cfb96037b771f29f9ea940c7b5de8af0fe781d5d01004895068d" name="gettext-go-lint" arch="x86_64">
  <version epoch="0" ver="0.1.0" rel="150400.1.2"/>
  <changelog author="cbosdonnat@suse.com" date="1714478400">- Initial version of gettext-go-lint 0.0.1</changelog>
  <changelog author="cbosdonnat@suse.com" date="1714478401">- version 0.1.0-0
  * Detect similar strings
  * Detect use of three dots instead of ellipsis character
  * Detect multiple unnamed variables</changelog>
</package>
<package pkgid="7a9cb0bb82377740007eeef36fc7fafe15df09d7abf920b295ef01387e34df41" name="http-parser" arch="src">
  <version epoch="0" ver="2.7.1" rel="150400.4.6.4"/>
  <changelog author="p.drouand@gmail.com" date="1439035200">- Initial package (version 2.5.0) for build.opensuse.org</changelog>
  <changelog author="p.drouand@gmail.com" date="1447675200">- Update to version 2.6.0
  * No changelog available</changelog>
  <changelog author="zaitor@opensuse.org" date="1453982400">- Add baselibs.conf as source, in order to build
  libhttp-parser-suse0 32-bit compatability lib.</changelog>
  <changelog author="mpluskal@suse.com" date="1458993600">- Update to 2.6.2
  * No changelog available</changelog>
  <changelog author="p.drouand@gmail.com" date="1477051200">- Update to version 2.7.1
  * No changelog available</changelog>
  <changelog author="mimi.vx@gmail.com" date="1509710400">- move out from gyp
- use correct SONAME
- drop http-parser-gyp-sharedlib.patch
- add makefile.patch</changelog>
</package>
<package pkgid="0e1ce083e6a2fd21e290d0efc3d1131633932abd6066ce7aefb217d2458452ba" name="http-parser-devel" arch="aarch64">
  <version epoch="0" ver="2.7.1" rel="150400.4.6.4"/>
  <changelog author="p.drouand@gmail.com" date="1439035200">- Initial package (version 2.5.0) for build.opensuse.org</changelog>
  <changelog author="p.drouand@gmail.com" date="1447675200">- Update to version 2.6.0
  * No changelog available</changelog>
  <changelog author="zaitor@opensuse.org" date="1453982400">- Add baselibs.conf as source, in order to build
  libhttp-parser-suse0 32-bit compatability lib.</changelog>
  <changelog author="mpluskal@suse.com" date="1458993600">- Update to 2.6.2
  * No changelog available</changelog>
  <changelog author="p.drouand@gmail.com" date="1477051200">- Update to version 2.7.1
  * No changelog available</changelog>
  <changelog author="mimi.vx@gmail.com" date="1509710400">- move out from gyp
- use correct SONAME
- drop http-parser-gyp-sharedlib.patch
- add makefile.patch</changelog>
</package>
<package pkgid="2a7fbe2f74c5a348a014249ce2754a05c050d1ce508d12f7d64b5a026d38532f" name="http-parser-devel" arch="ppc64le">
  <version epoch="0" ver="2.7.1" rel="150400.4.6.4"/>
  <changelog author="p.drouand@gmail.com" date="1439035200">- Initial package (version 2.5.0) for build.opensuse.org</changelog>
  <changelog author="p.drouand@gmail.com" date="1447675200">- Update to version 2.6.0
  * No changelog available</changelog>
  <changelog author="zaitor@opensuse.org" date="1453982400">- Add baselibs.conf as source, in order to build
  libhttp-parser-suse0 32-bit compatability lib.</changelog>
  <changelog author="mpluskal@suse.com" date="1458993600">- Update to 2.6.2
  * No changelog available</changelog>
  <changelog author="p.drouand@gmail.com" date="1477051200">- Update to version 2.7.1
  * No changelog available</changelog>
  <changelog author="mimi.vx@gmail.com" date="1509710400">- move out from gyp
- use correct SONAME
- drop http-parser-gyp-sharedlib.patch
- add makefile.patch</changelog>
</package>
<package pkgid="142bc7743110d0645db747a3cb35f1fc65516d9491153c6ae85899cf8935c808" name="http-parser-devel" arch="s390x">
  <version epoch="0" ver="2.7.1" rel="150400.4.6.4"/>
  <changelog author="p.drouand@gmail.com" date="1439035200">- Initial package (version 2.5.0) for build.opensuse.org</changelog>
  <changelog author="p.drouand@gmail.com" date="1447675200">- Update to version 2.6.0
  * No changelog available</changelog>
  <changelog author="zaitor@opensuse.org" date="1453982400">- Add baselibs.conf as source, in order to build
  libhttp-parser-suse0 32-bit compatability lib.</changelog>
  <changelog author="mpluskal@suse.com" date="1458993600">- Update to 2.6.2
  * No changelog available</changelog>
  <changelog author="p.drouand@gmail.com" date="1477051200">- Update to version 2.7.1
  * No changelog available</changelog>
  <changelog author="mimi.vx@gmail.com" date="1509710400">- move out from gyp
- use correct SONAME
- drop http-parser-gyp-sharedlib.patch
- add makefile.patch</changelog>
</package>
<package pkgid="498c8c4efccc81a8bcb2c04cc052c328498c611b31d5dfc8b6efe431df7094d6" name="http-parser-devel" arch="x86_64">
  <version epoch="0" ver="2.7.1" rel="150400.4.6.4"/>
  <changelog author="p.drouand@gmail.com" date="1439035200">- Initial package (version 2.5.0) for build.opensuse.org</changelog>
  <changelog author="p.drouand@gmail.com" date="1447675200">- Update to version 2.6.0
  * No changelog available</changelog>
  <changelog author="zaitor@opensuse.org" date="1453982400">- Add baselibs.conf as source, in order to build
  libhttp-parser-suse0 32-bit compatability lib.</changelog>
  <changelog author="mpluskal@suse.com" date="1458993600">- Update to 2.6.2
  * No changelog available</changelog>
  <changelog author="p.drouand@gmail.com" date="1477051200">- Update to version 2.7.1
  * No changelog available</changelog>
  <changelog author="mimi.vx@gmail.com" date="1509710400">- move out from gyp
- use correct SONAME
- drop http-parser-gyp-sharedlib.patch
- add makefile.patch</changelog>
</package>
<package pkgid="3b2f0795c5175f22e196a72780f6322d7ffe2ded3a38131376d160c5979ab0cd" name="libgit2" arch="src">
  <version epoch="0" ver="0.28.4" rel="150400.3.11.1"/>
  <changelog author="astieger@suse.com" date="1484136000">- libgit2 0.25.1
- New features and functionality:
  * repository discovery features
  * Support for reading and writing git index v4 files
  * Improve the performance of the revwalk
  * reference db concurrency improvements
  * Nanosecond resolution is now activated by default
  * restrict the set of ciphers used with OpenSSL by default.
  * user-registered merge drivers
  * built-in support for the union merge driver
  * callers can now specify proxy settings
  * New API for creating signed commits
  * New API for creating blobs from streams
  * New flags for opening repositories
  * New functions for various git operations
- Removed API:
  * git_blob_create_fromchunks() has been removed in  favour of
    git_blob_create_fromstream()
- Changed API:
  * git_packbuilder_object_count and git_packbuilder_written now
    return a size_t instead of a uint32_t for more thorough
    compatibility with the rest of the library.
  * git_packbuiler_progress now provides explicitly sized uint32_t
    values instead of unsigned int.
  * git_diff_file now includes an id_abbrev field that reflects the
    number of nibbles set in the id field.
  * git_odb_backend now has a freshen function pointer
  * git_remote_connect() now accepts proxy options.</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- libgit2 0.26.0:
  * Support for opening, creating and modifying worktrees.
  * Can now detect SHA1 collisions resulting from the SHAttered
    attack CVE-2005-4900
  * Fix for missing implementation of `git_merge_driver_source` getters
  * Fix for installed pkg-config file being broken when the prefix
    contains spaces
  * Can now detect when the hashsum of on-disk objects does not
    match their expected hashsum.
  * Support open-ended ranges (e.g. "master..", "...master") in
    revision range parsing code.
  * Correctly compute ignores with leading "/" in subdirectories.
  * Optionally call `fsync` on loose objects, packfiles and their
    indexes, loose references and packed reference files.
  * Builds against OpenSSL v1.1 and against LibreSSL.
  * Improvements for reading index v4 files.
  * API additions and incompatible API changes</changelog>
  <changelog author="mimi.vx@gmail.com" date="1510574400">- remove unneeded dependency (python is used only for testsuite, which
    isn't used during build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="kbabioch@suse.com" date="1521028800">- Update to 0.26.3:
  * Fix cloning of the libgit2 project with git clone --recursive by removing an
    invalid submodule from our testing data.
  * Fix endianness of the port in p_getaddrinfo().
  * Fix handling of negative gitignore rules with wildcards.
  * Fix handling of case-insensitive negative gitignore rules.
  * Fix resolving references to a tag if the reference is stored with its fully
    resolved OID in the packed-refs file.
  * Fix checkout not treating worktree files as modified when only their mode has
    changed.
  * Fix rename detection with GIT_DIFF_FIND_RENAMES_FROM_REWRITES.
  * Fixes memory handling issues when reading crafted repository index files.
    The issues allow for possible denial of service due to allocation of large
    memory and out-of-bound reads.
    (CVE-2018-8098 bnc#1085257 CVE-2018-8099 bnc#1085256)
  * Updates the bundled zlib to 1.2.11. Users who build the bundled zlib are
    vulnerable to security issues in the prior version.</changelog>
  <changelog author="mrueckert@suse.de" date="1524484800">- update to 0.27.0:
  - Changes or improvements
  - Improved p_unlink in posix_w32.c to try and make a file
    writable before sleeping in the retry loop to prevent
    unnecessary calls to sleep.
  - The CMake build infrastructure has been improved to speed up
    building time.
  - A new CMake option "-DUSE_HTTPS=" makes it possible to
    explicitly choose an HTTP backend.
  - A new CMake option "-DSHA1_BACKEND=" makes it possible to
    explicitly choose an SHA1 backend. The collision-detecting
    backend is now the default.
  - A new CMake option "-DUSE_BUNDLED_ZLIB" makes it possible to
    explicitly use the bundled zlib library.
  - A new CMake option "-DENABLE_REPRODUCIBLE_BUILDS" makes it
    possible to generate a reproducible static archive. This
    requires support from your toolchain.
  - The minimum required CMake version has been bumped to 2.8.11.
  - Writing to a configuration file now preserves the case of the
    key given by the caller for the case-insensitive portions of
    the key (existing sections are used even if they don't
    match).
  - We now support conditional includes in configuration files.
  - Fix for handling re-reading of configuration files with
    includes.
  - Fix for reading patches which contain exact renames only.
  - Fix for reading patches with whitespace in the compared
    files' paths.
  - We will now fill FETCH_HEAD from all passed refspecs instead
    of overwriting with the last one.
  - There is a new diff option, GIT_DIFF_INDENT_HEURISTIC which
    activates a heuristic which takes into account whitespace and
    indentation in order to produce better diffs when dealing
    with ambiguous diff hunks.
  - Fix for pattern-based ignore rules where files ignored by a
    rule cannot be un-ignored by another rule.
  - Sockets opened by libgit2 are now being closed on exec(3) if
    the platform supports it.
  - Fix for peeling annotated tags from packed-refs files.
  - Fix reading huge loose objects from the object database.
  - Fix files not being treated as modified when only the file
    mode has changed.
  - We now explicitly reject adding submodules to the index via
    git_index_add_frombuffer.
  - Fix handling of GIT_DIFF_FIND_RENAMES_FROM_REWRITES raising
    SIGABRT when one file has been deleted and another file has
    been rewritten.
  - Fix for WinHTTP not properly handling NTLM and Negotiate
    challenges.
  - When using SSH-based transports, we now repeatedly ask for
    the passphrase to decrypt the private key in case a wrong
    passphrase is being provided.
  - When generating conflict markers, they will now use the same
    line endings as the rest of the file.
  - API additions
  - The git_merge_file_options structure now contains a new
    setting, marker_size. This allows users to set the size of
    markers that delineate the sides of merged files in the
    output conflict file.  By default this is 7
    (GIT_MERGE_CONFLICT_MARKER_SIZE), which produces output
    markers like &lt;&lt;&lt;&lt;&lt;&lt;&lt; and &gt;&gt;&gt;&gt;&gt;&gt;&gt;.
  - git_remote_create_detached() creates a remote that is not
    associated to any repository (and does not apply
    configuration like 'insteadof' rules).  This is mostly useful
    for e.g. emulating git ls-remote behavior.
  - git_diff_patchid() lets you generate patch IDs for diffs.
  - git_status_options now has an additional field baseline to
    allow creating status lists against different trees.
  - New family of functions to allow creating notes for a
    specific notes commit instead of for a notes reference.
  - New family of functions to allow parsing message trailers.
    This API is still experimental and may change in future
    releases.
  - Breaking API changes
  - Signatures now distinguish between +0000 and -0000 UTC offsets.
  - The certificate check callback in the WinHTTP transport will
    now receive the message_cb_payload instead of the
    cred_acquire_payload.
  - We are now reading symlinked directories under .git/refs.
  - We now refuse creating branches named "HEAD".
  - We now refuse reading and writing all-zero object IDs into
    the object database.
  - We now read the effective user's configuration file instead
    of the real user's configuration in case libgit2 runs as part
    of a setuid binary.
  - The git_odb_open_rstream function and its readstream callback
    in the git_odb_backend interface have changed their
    signatures to allow providing the object's size and type to
    the caller.</changelog>
  <changelog author="astieger@suse.com" date="1531224000">- libgit2 0.27.3:
  * CVE-2018-10887 (bsc#1100613), CVE-2018-10888 (bsc#1100612):
    Specially crafted delta object in packfiles could trigger an
    integer overflow, bypassing input validation and causing the
    object database to contain copies of system memory. This may
    allow denial of service or, potentially, an information leak
- includes changes from 0.27.2:
  * various API and correctnes fixes
  * Fixes related to handling of .gitmodules
- includes changes from 0.27.1:
  * CVE-2018-11235: insufficient validation of submodule names from
    .gitmodules allowed writes to arbitrary paths (bsc#1095219)
  * disallow .gitmodules files as symlinks.</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- libgit2 0.27.4:
  * fix out-of-bounds reads when processing smart-protocol "ng"
    packets (bsc#1104641)</changelog>
  <changelog author="mpluskal@suse.com" date="1534852800">- Use pkgconfig style of dependencies, refresh dependencies
- Use more of cmake macros</changelog>
  <changelog author="astieger@suse.com" date="1538913600">- libgit2 0.27.5:
  * CVE-2018-17456: Submodule URLs and paths with a leading "-"
    are now ignored to avoid injecting options into library
    consumers that perform recursive clones (bsc#1110949)
  * Avoid a buffer overflow when running repack
  * Avoid stack overflow from unbounded recursion in configuration
    file parser
  * Avoid heap-buffer overflow when parsing "ok" packets
  * Fix heap-buffer overflows in smart protocol parsing code
  * Fix potential integer overflows on platforms with 16 bit ints
  * Fix potential NULL pointer dereference when parsing
    configuration files</changelog>
  <changelog author="astieger@suse.com" date="1541419200">- libgit2 0.27.7:
  * Various improvements for handling repositories
  * Various API correctness fixes
- includes changess from 0.27.6:
  * Various security fixes for parsing integers from buffers,
    and buffer handling bsc#1114729</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550059200">- Update to version 0.28.0:
  * Changes or improvements:
  - The library is now always built with cdecl calling
    conventions on Windows; the ability to build a stdcall
    library has been removed.
  - Reference log creation now honors
    core.logallrefupdates=always.
  - Fix some issues with the error-reporting in the OpenSSL
    backend.
  - HTTP proxy support is now builtin; libcurl is no longer used
    to support proxies and is removed as a dependency.
  - Certificate and credential callbacks can now return
    GIT_PASSTHROUGH to decline to act; libgit2 will behave as if
    there was no callback set in the first place.
  - The line-ending filtering logic - when checking out files -
    has been updated to match newer git (&gt;= git 2.9) for proper
    interoperability.
  - Symbolic links are now supported on Windows when
    core.symlinks is set to true.
  - Submodules with names which attempt to perform path traversal
    now have their configuration ignored. Such names were blindly
    appended to the $GIT_DIR/modules and a malicious name could
    lead to an attacker writing to an arbitrary location. This
    matches git's handling of CVE-2018-11235.
  - Object validation is now performed during tree creation in
    the git_index_write_tree_to API.
  - Configuration variable may now be specified on the same line
    as a section header; previously this was erroneously a parser
    error.
  - When an HTTP server supports both NTLM and Negotiate
    authentication mechanisms, we would previously fail to
    authenticate with any mechanism.
  - The GIT_OPT_SET_PACK_MAX_OBJECTS option can now set the
    maximum number of objects allowed in a packfile being
    downloaded; this can help limit the maximum memory used when
    fetching from an untrusted remote.
  - Line numbers in diffs loaded from patch files were not being
    populated; they are now included in the results.
  - The repository's index is reloaded from disk at the beginning
    of git_merge operations to ensure that it is up-to-date.
  - Mailmap handling APIs have been introduced, and the new
    commit APIs git_commit_committer_with_mailmap and
    git_commit_author_with_mailmap will use the mailmap to
    resolve the committer and author information. In addition,
    blame will use the mailmap given when the
    GIT_BLAME_USE_MAILMAP option.
  - Ignore handling for files in ignored folders would be
    ignored.
  - Worktrees can now be backed by bare repositories.
  - Trailing spaces are supported in .gitignore files, these
    spaces were previously (and erroneously) treated as part of
    the pattern.
  - The library can now be built with mbedTLS support for HTTPS.
  - The diff status character 'T' will now be presented by the
    git_diff_status_char API for diff entries that change type.
  - Revision walks previously would sometimes include commits
    that should have been ignored; this is corrected.
  - Revision walks are now more efficient when the output is
    unsorted; we now avoid walking all the way to the beginning
    of history unnecessarily.
  - Error-handling around index extension loading has been fixed.
    We were previously always misreporting a truncated index.
  * API additions:
  - The index may now be iterated atomically using
    git_index_iterator.
  - Remote objects can now be created with extended options using
    the git_remote_create_with_opts API.
  - Diff objects can now be applied as changes to the working
    directory, index or both, emulating the git apply command.
    Additionally, git_apply_to_tree can apply those changes to a
    tree object as a fully in-memory operation.
  - You can now swap out memory allocators via the
    GIT_OPT_SET_ALLOCATOR option with git_libgit2_opts().
  - You can now ensure that functions do not discard unwritten
    changes to the index via the
    GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY option to
    git_libgit2_opts(). This will cause functions that implicitly
    re-read the index (eg, git_checkout) to fail if you have
    staged changes to the index but you have not written the
    index to disk. (Unless the checkout has the FORCE flag
    specified.)
  - At present, this defaults to off, but we intend to enable
    this more broadly in the future, as a warning or error. We
    encourage you to examine your code to ensure that you are not
    relying on the current behavior that implicitly removes
    staged changes.
  - Reference specifications can be parsed from an arbitrary
    string with the git_refspec_parse API.
  - You can now get the name and path of worktrees using the
    git_worktree_name and git_worktree_path APIs, respectively.
  - The ref field has been added to git_worktree_add_options to
    enable the creation of a worktree from a pre-existing branch.
  - It's now possible to analyze merge relationships between any
    two references, not just against HEAD, using
    git_merge_analysis_for_ref.
  * API removals:
  - The git_buf_free API is deprecated; it has been renamed to
    git_buf_dispose for consistency. The git_buf_free API will be
    retained for backward compatibility for the foreseeable
    future.
  - The git_otype enumeration and its members are deprecated and
    have been renamed for consistency. The GIT_OBJ_ enumeration
    values are now prefixed with GIT_OBJECT_. The old
    enumerations and macros will be retained for backward
    compatibility for the foreseeable future.
  - Several index-related APIs have been renamed for consistency.
    The GIT_IDXENTRY_ enumeration values and macros have been
    renamed to be prefixed with GIT_INDEX_ENTRY_. The
    GIT_INDEXCAP enumeration values are now prefixed with
    GIT_INDEX_CAPABILITY_. The old enumerations and macros will
    be retained for backward compatibility for the foreseeable
    future.
  - The error functions and enumeration values have been renamed
    for consistency. The giterr_ functions and values prefix have
    been renamed to be prefixed with git_error_; similarly,
    the GITERR_ constants have been renamed to be prefixed with
    GIT_ERROR_. The old enumerations and macros will be retained
    for backward compatibility for the foreseeable future.
  * Breaking API changes:
  - The default checkout strategy changed from DRY_RUN to SAFE.
  - Adding a symlink as .gitmodules into the index from the
    workdir or checking out such files is not allowed as this can
    make a Git implementation write outside of the repository and
    bypass the fsck checks for CVE-2018-11235.
- Bump sover to 28 following upstreams changes.</changelog>
  <changelog author="mrueckert@suse.de" date="1550145600">-  Update to version 0.28.1:
  - The deprecated functions (git_buf_free and the giterr_ family
    of functions) are now exported properly. In the v0.28 release,
    they were not given the correct external attributes and they
    did not have the correct linkage visibility in the v0.28
    library.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 0.28.2:
  * Fix include directory ordering when using bundled dependencies.
  * Fix infinite loop when searching for a non-existing repository with
    Windows-style paths including drive prefixes.
  * Fix symlinks to directories on Windows.
  * Fix paths with a trailing "/" not always being treated as
    directories when computing ignores.
  * Fix false negatives when computing ignores where ignore rules
    that are a prefix to a negative ignore rule exist.
  * Fix patches with CRLF line endings not being parsed correctly.
  * Fix segfault when parsing patches with file addition (deletion)
    where the added (deleted) file name contains a space.
  * Fix assertion failure when trying to write to a non-existent
    locked configuration file.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065600">- libgit2 0.28.3:
  * A carefully constructed commit object with a very large number
    of parents may have lead to out-of-bounds writes or potential
    denial of service (boo#1158981)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065601">- libgit2 0.28.4:
  * CVE-2019-1348: the fast-import stream command "feature
    export-marks=path" allows writing to arbitrary file paths. As
    libgit2 does not offer any interface for fast-import, it is not
    susceptible to this vulnerability. (boo#1158785)
  * CVE-2019-1349: by using NTFS 8.3 short names, backslashes or
    alternate filesystreams, it is possible to cause submodules to
    be written into pre-existing directories during a recursive
    clone using git. As libgit2 rejects cloning into non-empty
    directories by default, it is not susceptible to this
    vulnerability. (boo#1158787)
  * CVE-2019-1350: recursive clones may lead to arbitrary remote
    code executing due to improper quoting of command line
    arguments. As libgit2 uses libssh2, which does not require us
    to perform command line parsing, it is not susceptible to this
    vulnerability. (boo#1158788)
  * CVE-2019-1351: Windows provides the ability to substitute
    drive letters with arbitrary letters, including multi-byte
    Unicode letters. To fix any potential issues arising from
    interpreting such paths as relative paths, we have extended
    detection of DOS drive prefixes to accomodate for such cases.
    (boo#1158790)
  * CVE-2019-1352: by using NTFS-style alternative file streams for
    the ".git" directory, it is possible to overwrite parts of the
    repository. While this has been fixed in the past for Windows,
    the same vulnerability may also exist on other systems that
    write to NTFS filesystems. We now reject any paths starting
    with ".git:" on all systems. (boo#1158790)
  * CVE-2019-1353: by using NTFS-style 8.3 short names, it was
    possible to write to the ".git" directory and thus overwrite
    parts of the repository, leading to possible remote code
    execution. While this problem was already fixed in the past for
    Windows, other systems accessing NTFS filesystems are
    vulnerable to this issue too. We now enable NTFS protecions by
    default on all systems to fix this attack vector. (boo#1158791)
  * CVE-2019-1354: on Windows, backslashes are not a valid part of
    a filename but are instead interpreted as directory separators.
    As other platforms allowed to use such paths, it was possible
    to write such invalid entries into a Git repository and was
    thus an attack vector to write into the ".git" dierctory. We
    now reject any entries starting with ".git" on all systems.
    (boo#1158792)
  * CVE-2019-1387: it is possible to let a submodule's git
    directory point into a sibling's submodule directory, which may
    result in overwriting parts of the Git repository and thus lead
    to arbitrary command execution. As libgit2 doesn't provide any
    way to do submodule clones natively, it is not susceptible to
    this vulnerability. Users of libgit2 that have implemented
    recursive submodule clones manually are encouraged to review
    their implementation for this vulnerability. (boo#1158793)</changelog>
  <changelog author="alarrosa@suse.com" date="1661342400">- Add patches backported from the upstream v1.3 branch to fix
  CVE-2022-29187, CVE-2022-24765 (bsc#1201431, bsc#1198234):
  * 0001-buffer-git_buf_sanitize-should-return-a-value.patch
  * 0001-path-refactor-ownership-checks-into-current-user-and.patch
  * 0002-repo-ensure-that-repo-dir-is-owned-by-current-user.patch
  * 0003-fs_path-mock-ownership-checks.patch
  * 0004-repo-test-configuration-ownership-validation.patch
  * 0005-repo-refactor-global-config-loader-function.patch
  * 0006-repo-honor-safe.directory-during-ownership-checks.patch
  * 0007-repo-make-ownership-checks-optional.patch
  * 0010-revparse-Remove-error-prone-redundant-test.patch
  * 0014-repo-add-tests-for-bare-repo-permissions.patch
  * 0015-fs-remove-mock-naming-from-change-ownership-constant.patch
  * 0016-fs-refactor-file-ownership-checks.patch
  * 0017-fs-allow-ownership-match-if-user-is-in-admin-group.patch
  * 0018-repo-allow-admin-owned-configs-by-admin-users.patch
  * 0019-repo-validate-gitdir-and-gitlink-ownership.patch
  * 0020-repo-allow-users-running-with-sudo-to-access-their-r.patch</changelog>
  <changelog author="mgorse@suse.com" date="1678968000">- Backport patches from the 1.4 branch to verify ssh remote host
  keys (boo#1207364 CVE-2023-22742):
  0001-ssh-verify-the-remote-s-host-key-against-known_hosts.patch
  0002-tests-append-the-github.com-ssh-keys-so-we-have-acce.patch
  0003-tests-move-online-clone-ssh_auth_methods-into-the-ss.patch
  0004-ssh-look-for-a-key-in-known_hosts-to-set-the-key-typ.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217600">- Address boo#1219660 CVE-2024-24577:
  0021-fix-slash-in-index-for-git_index_add.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217601">- Fixing 0021-fix-slash-in-index-for-git_index_add.patch to use
  '*slash' vs. '*--slash'</changelog>
</package>
<package pkgid="6700699eaf1bd7ecce2e4bdc802160c4fce3839204a2835c0ce908109d849c5e" name="libgit2-28" arch="aarch64">
  <version epoch="0" ver="0.28.4" rel="150400.3.11.1"/>
  <changelog author="astieger@suse.com" date="1484136000">- libgit2 0.25.1
- New features and functionality:
  * repository discovery features
  * Support for reading and writing git index v4 files
  * Improve the performance of the revwalk
  * reference db concurrency improvements
  * Nanosecond resolution is now activated by default
  * restrict the set of ciphers used with OpenSSL by default.
  * user-registered merge drivers
  * built-in support for the union merge driver
  * callers can now specify proxy settings
  * New API for creating signed commits
  * New API for creating blobs from streams
  * New flags for opening repositories
  * New functions for various git operations
- Removed API:
  * git_blob_create_fromchunks() has been removed in  favour of
    git_blob_create_fromstream()
- Changed API:
  * git_packbuilder_object_count and git_packbuilder_written now
    return a size_t instead of a uint32_t for more thorough
    compatibility with the rest of the library.
  * git_packbuiler_progress now provides explicitly sized uint32_t
    values instead of unsigned int.
  * git_diff_file now includes an id_abbrev field that reflects the
    number of nibbles set in the id field.
  * git_odb_backend now has a freshen function pointer
  * git_remote_connect() now accepts proxy options.</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- libgit2 0.26.0:
  * Support for opening, creating and modifying worktrees.
  * Can now detect SHA1 collisions resulting from the SHAttered
    attack CVE-2005-4900
  * Fix for missing implementation of `git_merge_driver_source` getters
  * Fix for installed pkg-config file being broken when the prefix
    contains spaces
  * Can now detect when the hashsum of on-disk objects does not
    match their expected hashsum.
  * Support open-ended ranges (e.g. "master..", "...master") in
    revision range parsing code.
  * Correctly compute ignores with leading "/" in subdirectories.
  * Optionally call `fsync` on loose objects, packfiles and their
    indexes, loose references and packed reference files.
  * Builds against OpenSSL v1.1 and against LibreSSL.
  * Improvements for reading index v4 files.
  * API additions and incompatible API changes</changelog>
  <changelog author="mimi.vx@gmail.com" date="1510574400">- remove unneeded dependency (python is used only for testsuite, which
    isn't used during build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="kbabioch@suse.com" date="1521028800">- Update to 0.26.3:
  * Fix cloning of the libgit2 project with git clone --recursive by removing an
    invalid submodule from our testing data.
  * Fix endianness of the port in p_getaddrinfo().
  * Fix handling of negative gitignore rules with wildcards.
  * Fix handling of case-insensitive negative gitignore rules.
  * Fix resolving references to a tag if the reference is stored with its fully
    resolved OID in the packed-refs file.
  * Fix checkout not treating worktree files as modified when only their mode has
    changed.
  * Fix rename detection with GIT_DIFF_FIND_RENAMES_FROM_REWRITES.
  * Fixes memory handling issues when reading crafted repository index files.
    The issues allow for possible denial of service due to allocation of large
    memory and out-of-bound reads.
    (CVE-2018-8098 bnc#1085257 CVE-2018-8099 bnc#1085256)
  * Updates the bundled zlib to 1.2.11. Users who build the bundled zlib are
    vulnerable to security issues in the prior version.</changelog>
  <changelog author="mrueckert@suse.de" date="1524484800">- update to 0.27.0:
  - Changes or improvements
  - Improved p_unlink in posix_w32.c to try and make a file
    writable before sleeping in the retry loop to prevent
    unnecessary calls to sleep.
  - The CMake build infrastructure has been improved to speed up
    building time.
  - A new CMake option "-DUSE_HTTPS=" makes it possible to
    explicitly choose an HTTP backend.
  - A new CMake option "-DSHA1_BACKEND=" makes it possible to
    explicitly choose an SHA1 backend. The collision-detecting
    backend is now the default.
  - A new CMake option "-DUSE_BUNDLED_ZLIB" makes it possible to
    explicitly use the bundled zlib library.
  - A new CMake option "-DENABLE_REPRODUCIBLE_BUILDS" makes it
    possible to generate a reproducible static archive. This
    requires support from your toolchain.
  - The minimum required CMake version has been bumped to 2.8.11.
  - Writing to a configuration file now preserves the case of the
    key given by the caller for the case-insensitive portions of
    the key (existing sections are used even if they don't
    match).
  - We now support conditional includes in configuration files.
  - Fix for handling re-reading of configuration files with
    includes.
  - Fix for reading patches which contain exact renames only.
  - Fix for reading patches with whitespace in the compared
    files' paths.
  - We will now fill FETCH_HEAD from all passed refspecs instead
    of overwriting with the last one.
  - There is a new diff option, GIT_DIFF_INDENT_HEURISTIC which
    activates a heuristic which takes into account whitespace and
    indentation in order to produce better diffs when dealing
    with ambiguous diff hunks.
  - Fix for pattern-based ignore rules where files ignored by a
    rule cannot be un-ignored by another rule.
  - Sockets opened by libgit2 are now being closed on exec(3) if
    the platform supports it.
  - Fix for peeling annotated tags from packed-refs files.
  - Fix reading huge loose objects from the object database.
  - Fix files not being treated as modified when only the file
    mode has changed.
  - We now explicitly reject adding submodules to the index via
    git_index_add_frombuffer.
  - Fix handling of GIT_DIFF_FIND_RENAMES_FROM_REWRITES raising
    SIGABRT when one file has been deleted and another file has
    been rewritten.
  - Fix for WinHTTP not properly handling NTLM and Negotiate
    challenges.
  - When using SSH-based transports, we now repeatedly ask for
    the passphrase to decrypt the private key in case a wrong
    passphrase is being provided.
  - When generating conflict markers, they will now use the same
    line endings as the rest of the file.
  - API additions
  - The git_merge_file_options structure now contains a new
    setting, marker_size. This allows users to set the size of
    markers that delineate the sides of merged files in the
    output conflict file.  By default this is 7
    (GIT_MERGE_CONFLICT_MARKER_SIZE), which produces output
    markers like &lt;&lt;&lt;&lt;&lt;&lt;&lt; and &gt;&gt;&gt;&gt;&gt;&gt;&gt;.
  - git_remote_create_detached() creates a remote that is not
    associated to any repository (and does not apply
    configuration like 'insteadof' rules).  This is mostly useful
    for e.g. emulating git ls-remote behavior.
  - git_diff_patchid() lets you generate patch IDs for diffs.
  - git_status_options now has an additional field baseline to
    allow creating status lists against different trees.
  - New family of functions to allow creating notes for a
    specific notes commit instead of for a notes reference.
  - New family of functions to allow parsing message trailers.
    This API is still experimental and may change in future
    releases.
  - Breaking API changes
  - Signatures now distinguish between +0000 and -0000 UTC offsets.
  - The certificate check callback in the WinHTTP transport will
    now receive the message_cb_payload instead of the
    cred_acquire_payload.
  - We are now reading symlinked directories under .git/refs.
  - We now refuse creating branches named "HEAD".
  - We now refuse reading and writing all-zero object IDs into
    the object database.
  - We now read the effective user's configuration file instead
    of the real user's configuration in case libgit2 runs as part
    of a setuid binary.
  - The git_odb_open_rstream function and its readstream callback
    in the git_odb_backend interface have changed their
    signatures to allow providing the object's size and type to
    the caller.</changelog>
  <changelog author="astieger@suse.com" date="1531224000">- libgit2 0.27.3:
  * CVE-2018-10887 (bsc#1100613), CVE-2018-10888 (bsc#1100612):
    Specially crafted delta object in packfiles could trigger an
    integer overflow, bypassing input validation and causing the
    object database to contain copies of system memory. This may
    allow denial of service or, potentially, an information leak
- includes changes from 0.27.2:
  * various API and correctnes fixes
  * Fixes related to handling of .gitmodules
- includes changes from 0.27.1:
  * CVE-2018-11235: insufficient validation of submodule names from
    .gitmodules allowed writes to arbitrary paths (bsc#1095219)
  * disallow .gitmodules files as symlinks.</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- libgit2 0.27.4:
  * fix out-of-bounds reads when processing smart-protocol "ng"
    packets (bsc#1104641)</changelog>
  <changelog author="mpluskal@suse.com" date="1534852800">- Use pkgconfig style of dependencies, refresh dependencies
- Use more of cmake macros</changelog>
  <changelog author="astieger@suse.com" date="1538913600">- libgit2 0.27.5:
  * CVE-2018-17456: Submodule URLs and paths with a leading "-"
    are now ignored to avoid injecting options into library
    consumers that perform recursive clones (bsc#1110949)
  * Avoid a buffer overflow when running repack
  * Avoid stack overflow from unbounded recursion in configuration
    file parser
  * Avoid heap-buffer overflow when parsing "ok" packets
  * Fix heap-buffer overflows in smart protocol parsing code
  * Fix potential integer overflows on platforms with 16 bit ints
  * Fix potential NULL pointer dereference when parsing
    configuration files</changelog>
  <changelog author="astieger@suse.com" date="1541419200">- libgit2 0.27.7:
  * Various improvements for handling repositories
  * Various API correctness fixes
- includes changess from 0.27.6:
  * Various security fixes for parsing integers from buffers,
    and buffer handling bsc#1114729</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550059200">- Update to version 0.28.0:
  * Changes or improvements:
  - The library is now always built with cdecl calling
    conventions on Windows; the ability to build a stdcall
    library has been removed.
  - Reference log creation now honors
    core.logallrefupdates=always.
  - Fix some issues with the error-reporting in the OpenSSL
    backend.
  - HTTP proxy support is now builtin; libcurl is no longer used
    to support proxies and is removed as a dependency.
  - Certificate and credential callbacks can now return
    GIT_PASSTHROUGH to decline to act; libgit2 will behave as if
    there was no callback set in the first place.
  - The line-ending filtering logic - when checking out files -
    has been updated to match newer git (&gt;= git 2.9) for proper
    interoperability.
  - Symbolic links are now supported on Windows when
    core.symlinks is set to true.
  - Submodules with names which attempt to perform path traversal
    now have their configuration ignored. Such names were blindly
    appended to the $GIT_DIR/modules and a malicious name could
    lead to an attacker writing to an arbitrary location. This
    matches git's handling of CVE-2018-11235.
  - Object validation is now performed during tree creation in
    the git_index_write_tree_to API.
  - Configuration variable may now be specified on the same line
    as a section header; previously this was erroneously a parser
    error.
  - When an HTTP server supports both NTLM and Negotiate
    authentication mechanisms, we would previously fail to
    authenticate with any mechanism.
  - The GIT_OPT_SET_PACK_MAX_OBJECTS option can now set the
    maximum number of objects allowed in a packfile being
    downloaded; this can help limit the maximum memory used when
    fetching from an untrusted remote.
  - Line numbers in diffs loaded from patch files were not being
    populated; they are now included in the results.
  - The repository's index is reloaded from disk at the beginning
    of git_merge operations to ensure that it is up-to-date.
  - Mailmap handling APIs have been introduced, and the new
    commit APIs git_commit_committer_with_mailmap and
    git_commit_author_with_mailmap will use the mailmap to
    resolve the committer and author information. In addition,
    blame will use the mailmap given when the
    GIT_BLAME_USE_MAILMAP option.
  - Ignore handling for files in ignored folders would be
    ignored.
  - Worktrees can now be backed by bare repositories.
  - Trailing spaces are supported in .gitignore files, these
    spaces were previously (and erroneously) treated as part of
    the pattern.
  - The library can now be built with mbedTLS support for HTTPS.
  - The diff status character 'T' will now be presented by the
    git_diff_status_char API for diff entries that change type.
  - Revision walks previously would sometimes include commits
    that should have been ignored; this is corrected.
  - Revision walks are now more efficient when the output is
    unsorted; we now avoid walking all the way to the beginning
    of history unnecessarily.
  - Error-handling around index extension loading has been fixed.
    We were previously always misreporting a truncated index.
  * API additions:
  - The index may now be iterated atomically using
    git_index_iterator.
  - Remote objects can now be created with extended options using
    the git_remote_create_with_opts API.
  - Diff objects can now be applied as changes to the working
    directory, index or both, emulating the git apply command.
    Additionally, git_apply_to_tree can apply those changes to a
    tree object as a fully in-memory operation.
  - You can now swap out memory allocators via the
    GIT_OPT_SET_ALLOCATOR option with git_libgit2_opts().
  - You can now ensure that functions do not discard unwritten
    changes to the index via the
    GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY option to
    git_libgit2_opts(). This will cause functions that implicitly
    re-read the index (eg, git_checkout) to fail if you have
    staged changes to the index but you have not written the
    index to disk. (Unless the checkout has the FORCE flag
    specified.)
  - At present, this defaults to off, but we intend to enable
    this more broadly in the future, as a warning or error. We
    encourage you to examine your code to ensure that you are not
    relying on the current behavior that implicitly removes
    staged changes.
  - Reference specifications can be parsed from an arbitrary
    string with the git_refspec_parse API.
  - You can now get the name and path of worktrees using the
    git_worktree_name and git_worktree_path APIs, respectively.
  - The ref field has been added to git_worktree_add_options to
    enable the creation of a worktree from a pre-existing branch.
  - It's now possible to analyze merge relationships between any
    two references, not just against HEAD, using
    git_merge_analysis_for_ref.
  * API removals:
  - The git_buf_free API is deprecated; it has been renamed to
    git_buf_dispose for consistency. The git_buf_free API will be
    retained for backward compatibility for the foreseeable
    future.
  - The git_otype enumeration and its members are deprecated and
    have been renamed for consistency. The GIT_OBJ_ enumeration
    values are now prefixed with GIT_OBJECT_. The old
    enumerations and macros will be retained for backward
    compatibility for the foreseeable future.
  - Several index-related APIs have been renamed for consistency.
    The GIT_IDXENTRY_ enumeration values and macros have been
    renamed to be prefixed with GIT_INDEX_ENTRY_. The
    GIT_INDEXCAP enumeration values are now prefixed with
    GIT_INDEX_CAPABILITY_. The old enumerations and macros will
    be retained for backward compatibility for the foreseeable
    future.
  - The error functions and enumeration values have been renamed
    for consistency. The giterr_ functions and values prefix have
    been renamed to be prefixed with git_error_; similarly,
    the GITERR_ constants have been renamed to be prefixed with
    GIT_ERROR_. The old enumerations and macros will be retained
    for backward compatibility for the foreseeable future.
  * Breaking API changes:
  - The default checkout strategy changed from DRY_RUN to SAFE.
  - Adding a symlink as .gitmodules into the index from the
    workdir or checking out such files is not allowed as this can
    make a Git implementation write outside of the repository and
    bypass the fsck checks for CVE-2018-11235.
- Bump sover to 28 following upstreams changes.</changelog>
  <changelog author="mrueckert@suse.de" date="1550145600">-  Update to version 0.28.1:
  - The deprecated functions (git_buf_free and the giterr_ family
    of functions) are now exported properly. In the v0.28 release,
    they were not given the correct external attributes and they
    did not have the correct linkage visibility in the v0.28
    library.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 0.28.2:
  * Fix include directory ordering when using bundled dependencies.
  * Fix infinite loop when searching for a non-existing repository with
    Windows-style paths including drive prefixes.
  * Fix symlinks to directories on Windows.
  * Fix paths with a trailing "/" not always being treated as
    directories when computing ignores.
  * Fix false negatives when computing ignores where ignore rules
    that are a prefix to a negative ignore rule exist.
  * Fix patches with CRLF line endings not being parsed correctly.
  * Fix segfault when parsing patches with file addition (deletion)
    where the added (deleted) file name contains a space.
  * Fix assertion failure when trying to write to a non-existent
    locked configuration file.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065600">- libgit2 0.28.3:
  * A carefully constructed commit object with a very large number
    of parents may have lead to out-of-bounds writes or potential
    denial of service (boo#1158981)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065601">- libgit2 0.28.4:
  * CVE-2019-1348: the fast-import stream command "feature
    export-marks=path" allows writing to arbitrary file paths. As
    libgit2 does not offer any interface for fast-import, it is not
    susceptible to this vulnerability. (boo#1158785)
  * CVE-2019-1349: by using NTFS 8.3 short names, backslashes or
    alternate filesystreams, it is possible to cause submodules to
    be written into pre-existing directories during a recursive
    clone using git. As libgit2 rejects cloning into non-empty
    directories by default, it is not susceptible to this
    vulnerability. (boo#1158787)
  * CVE-2019-1350: recursive clones may lead to arbitrary remote
    code executing due to improper quoting of command line
    arguments. As libgit2 uses libssh2, which does not require us
    to perform command line parsing, it is not susceptible to this
    vulnerability. (boo#1158788)
  * CVE-2019-1351: Windows provides the ability to substitute
    drive letters with arbitrary letters, including multi-byte
    Unicode letters. To fix any potential issues arising from
    interpreting such paths as relative paths, we have extended
    detection of DOS drive prefixes to accomodate for such cases.
    (boo#1158790)
  * CVE-2019-1352: by using NTFS-style alternative file streams for
    the ".git" directory, it is possible to overwrite parts of the
    repository. While this has been fixed in the past for Windows,
    the same vulnerability may also exist on other systems that
    write to NTFS filesystems. We now reject any paths starting
    with ".git:" on all systems. (boo#1158790)
  * CVE-2019-1353: by using NTFS-style 8.3 short names, it was
    possible to write to the ".git" directory and thus overwrite
    parts of the repository, leading to possible remote code
    execution. While this problem was already fixed in the past for
    Windows, other systems accessing NTFS filesystems are
    vulnerable to this issue too. We now enable NTFS protecions by
    default on all systems to fix this attack vector. (boo#1158791)
  * CVE-2019-1354: on Windows, backslashes are not a valid part of
    a filename but are instead interpreted as directory separators.
    As other platforms allowed to use such paths, it was possible
    to write such invalid entries into a Git repository and was
    thus an attack vector to write into the ".git" dierctory. We
    now reject any entries starting with ".git" on all systems.
    (boo#1158792)
  * CVE-2019-1387: it is possible to let a submodule's git
    directory point into a sibling's submodule directory, which may
    result in overwriting parts of the Git repository and thus lead
    to arbitrary command execution. As libgit2 doesn't provide any
    way to do submodule clones natively, it is not susceptible to
    this vulnerability. Users of libgit2 that have implemented
    recursive submodule clones manually are encouraged to review
    their implementation for this vulnerability. (boo#1158793)</changelog>
  <changelog author="alarrosa@suse.com" date="1661342400">- Add patches backported from the upstream v1.3 branch to fix
  CVE-2022-29187, CVE-2022-24765 (bsc#1201431, bsc#1198234):
  * 0001-buffer-git_buf_sanitize-should-return-a-value.patch
  * 0001-path-refactor-ownership-checks-into-current-user-and.patch
  * 0002-repo-ensure-that-repo-dir-is-owned-by-current-user.patch
  * 0003-fs_path-mock-ownership-checks.patch
  * 0004-repo-test-configuration-ownership-validation.patch
  * 0005-repo-refactor-global-config-loader-function.patch
  * 0006-repo-honor-safe.directory-during-ownership-checks.patch
  * 0007-repo-make-ownership-checks-optional.patch
  * 0010-revparse-Remove-error-prone-redundant-test.patch
  * 0014-repo-add-tests-for-bare-repo-permissions.patch
  * 0015-fs-remove-mock-naming-from-change-ownership-constant.patch
  * 0016-fs-refactor-file-ownership-checks.patch
  * 0017-fs-allow-ownership-match-if-user-is-in-admin-group.patch
  * 0018-repo-allow-admin-owned-configs-by-admin-users.patch
  * 0019-repo-validate-gitdir-and-gitlink-ownership.patch
  * 0020-repo-allow-users-running-with-sudo-to-access-their-r.patch</changelog>
  <changelog author="mgorse@suse.com" date="1678968000">- Backport patches from the 1.4 branch to verify ssh remote host
  keys (boo#1207364 CVE-2023-22742):
  0001-ssh-verify-the-remote-s-host-key-against-known_hosts.patch
  0002-tests-append-the-github.com-ssh-keys-so-we-have-acce.patch
  0003-tests-move-online-clone-ssh_auth_methods-into-the-ss.patch
  0004-ssh-look-for-a-key-in-known_hosts-to-set-the-key-typ.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217600">- Address boo#1219660 CVE-2024-24577:
  0021-fix-slash-in-index-for-git_index_add.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217601">- Fixing 0021-fix-slash-in-index-for-git_index_add.patch to use
  '*slash' vs. '*--slash'</changelog>
</package>
<package pkgid="0135f86f23b01f10e4993bfa3a38e0f79445bdde888422080f0bbde62aee166e" name="libgit2-28" arch="ppc64le">
  <version epoch="0" ver="0.28.4" rel="150400.3.11.1"/>
  <changelog author="astieger@suse.com" date="1484136000">- libgit2 0.25.1
- New features and functionality:
  * repository discovery features
  * Support for reading and writing git index v4 files
  * Improve the performance of the revwalk
  * reference db concurrency improvements
  * Nanosecond resolution is now activated by default
  * restrict the set of ciphers used with OpenSSL by default.
  * user-registered merge drivers
  * built-in support for the union merge driver
  * callers can now specify proxy settings
  * New API for creating signed commits
  * New API for creating blobs from streams
  * New flags for opening repositories
  * New functions for various git operations
- Removed API:
  * git_blob_create_fromchunks() has been removed in  favour of
    git_blob_create_fromstream()
- Changed API:
  * git_packbuilder_object_count and git_packbuilder_written now
    return a size_t instead of a uint32_t for more thorough
    compatibility with the rest of the library.
  * git_packbuiler_progress now provides explicitly sized uint32_t
    values instead of unsigned int.
  * git_diff_file now includes an id_abbrev field that reflects the
    number of nibbles set in the id field.
  * git_odb_backend now has a freshen function pointer
  * git_remote_connect() now accepts proxy options.</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- libgit2 0.26.0:
  * Support for opening, creating and modifying worktrees.
  * Can now detect SHA1 collisions resulting from the SHAttered
    attack CVE-2005-4900
  * Fix for missing implementation of `git_merge_driver_source` getters
  * Fix for installed pkg-config file being broken when the prefix
    contains spaces
  * Can now detect when the hashsum of on-disk objects does not
    match their expected hashsum.
  * Support open-ended ranges (e.g. "master..", "...master") in
    revision range parsing code.
  * Correctly compute ignores with leading "/" in subdirectories.
  * Optionally call `fsync` on loose objects, packfiles and their
    indexes, loose references and packed reference files.
  * Builds against OpenSSL v1.1 and against LibreSSL.
  * Improvements for reading index v4 files.
  * API additions and incompatible API changes</changelog>
  <changelog author="mimi.vx@gmail.com" date="1510574400">- remove unneeded dependency (python is used only for testsuite, which
    isn't used during build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="kbabioch@suse.com" date="1521028800">- Update to 0.26.3:
  * Fix cloning of the libgit2 project with git clone --recursive by removing an
    invalid submodule from our testing data.
  * Fix endianness of the port in p_getaddrinfo().
  * Fix handling of negative gitignore rules with wildcards.
  * Fix handling of case-insensitive negative gitignore rules.
  * Fix resolving references to a tag if the reference is stored with its fully
    resolved OID in the packed-refs file.
  * Fix checkout not treating worktree files as modified when only their mode has
    changed.
  * Fix rename detection with GIT_DIFF_FIND_RENAMES_FROM_REWRITES.
  * Fixes memory handling issues when reading crafted repository index files.
    The issues allow for possible denial of service due to allocation of large
    memory and out-of-bound reads.
    (CVE-2018-8098 bnc#1085257 CVE-2018-8099 bnc#1085256)
  * Updates the bundled zlib to 1.2.11. Users who build the bundled zlib are
    vulnerable to security issues in the prior version.</changelog>
  <changelog author="mrueckert@suse.de" date="1524484800">- update to 0.27.0:
  - Changes or improvements
  - Improved p_unlink in posix_w32.c to try and make a file
    writable before sleeping in the retry loop to prevent
    unnecessary calls to sleep.
  - The CMake build infrastructure has been improved to speed up
    building time.
  - A new CMake option "-DUSE_HTTPS=" makes it possible to
    explicitly choose an HTTP backend.
  - A new CMake option "-DSHA1_BACKEND=" makes it possible to
    explicitly choose an SHA1 backend. The collision-detecting
    backend is now the default.
  - A new CMake option "-DUSE_BUNDLED_ZLIB" makes it possible to
    explicitly use the bundled zlib library.
  - A new CMake option "-DENABLE_REPRODUCIBLE_BUILDS" makes it
    possible to generate a reproducible static archive. This
    requires support from your toolchain.
  - The minimum required CMake version has been bumped to 2.8.11.
  - Writing to a configuration file now preserves the case of the
    key given by the caller for the case-insensitive portions of
    the key (existing sections are used even if they don't
    match).
  - We now support conditional includes in configuration files.
  - Fix for handling re-reading of configuration files with
    includes.
  - Fix for reading patches which contain exact renames only.
  - Fix for reading patches with whitespace in the compared
    files' paths.
  - We will now fill FETCH_HEAD from all passed refspecs instead
    of overwriting with the last one.
  - There is a new diff option, GIT_DIFF_INDENT_HEURISTIC which
    activates a heuristic which takes into account whitespace and
    indentation in order to produce better diffs when dealing
    with ambiguous diff hunks.
  - Fix for pattern-based ignore rules where files ignored by a
    rule cannot be un-ignored by another rule.
  - Sockets opened by libgit2 are now being closed on exec(3) if
    the platform supports it.
  - Fix for peeling annotated tags from packed-refs files.
  - Fix reading huge loose objects from the object database.
  - Fix files not being treated as modified when only the file
    mode has changed.
  - We now explicitly reject adding submodules to the index via
    git_index_add_frombuffer.
  - Fix handling of GIT_DIFF_FIND_RENAMES_FROM_REWRITES raising
    SIGABRT when one file has been deleted and another file has
    been rewritten.
  - Fix for WinHTTP not properly handling NTLM and Negotiate
    challenges.
  - When using SSH-based transports, we now repeatedly ask for
    the passphrase to decrypt the private key in case a wrong
    passphrase is being provided.
  - When generating conflict markers, they will now use the same
    line endings as the rest of the file.
  - API additions
  - The git_merge_file_options structure now contains a new
    setting, marker_size. This allows users to set the size of
    markers that delineate the sides of merged files in the
    output conflict file.  By default this is 7
    (GIT_MERGE_CONFLICT_MARKER_SIZE), which produces output
    markers like &lt;&lt;&lt;&lt;&lt;&lt;&lt; and &gt;&gt;&gt;&gt;&gt;&gt;&gt;.
  - git_remote_create_detached() creates a remote that is not
    associated to any repository (and does not apply
    configuration like 'insteadof' rules).  This is mostly useful
    for e.g. emulating git ls-remote behavior.
  - git_diff_patchid() lets you generate patch IDs for diffs.
  - git_status_options now has an additional field baseline to
    allow creating status lists against different trees.
  - New family of functions to allow creating notes for a
    specific notes commit instead of for a notes reference.
  - New family of functions to allow parsing message trailers.
    This API is still experimental and may change in future
    releases.
  - Breaking API changes
  - Signatures now distinguish between +0000 and -0000 UTC offsets.
  - The certificate check callback in the WinHTTP transport will
    now receive the message_cb_payload instead of the
    cred_acquire_payload.
  - We are now reading symlinked directories under .git/refs.
  - We now refuse creating branches named "HEAD".
  - We now refuse reading and writing all-zero object IDs into
    the object database.
  - We now read the effective user's configuration file instead
    of the real user's configuration in case libgit2 runs as part
    of a setuid binary.
  - The git_odb_open_rstream function and its readstream callback
    in the git_odb_backend interface have changed their
    signatures to allow providing the object's size and type to
    the caller.</changelog>
  <changelog author="astieger@suse.com" date="1531224000">- libgit2 0.27.3:
  * CVE-2018-10887 (bsc#1100613), CVE-2018-10888 (bsc#1100612):
    Specially crafted delta object in packfiles could trigger an
    integer overflow, bypassing input validation and causing the
    object database to contain copies of system memory. This may
    allow denial of service or, potentially, an information leak
- includes changes from 0.27.2:
  * various API and correctnes fixes
  * Fixes related to handling of .gitmodules
- includes changes from 0.27.1:
  * CVE-2018-11235: insufficient validation of submodule names from
    .gitmodules allowed writes to arbitrary paths (bsc#1095219)
  * disallow .gitmodules files as symlinks.</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- libgit2 0.27.4:
  * fix out-of-bounds reads when processing smart-protocol "ng"
    packets (bsc#1104641)</changelog>
  <changelog author="mpluskal@suse.com" date="1534852800">- Use pkgconfig style of dependencies, refresh dependencies
- Use more of cmake macros</changelog>
  <changelog author="astieger@suse.com" date="1538913600">- libgit2 0.27.5:
  * CVE-2018-17456: Submodule URLs and paths with a leading "-"
    are now ignored to avoid injecting options into library
    consumers that perform recursive clones (bsc#1110949)
  * Avoid a buffer overflow when running repack
  * Avoid stack overflow from unbounded recursion in configuration
    file parser
  * Avoid heap-buffer overflow when parsing "ok" packets
  * Fix heap-buffer overflows in smart protocol parsing code
  * Fix potential integer overflows on platforms with 16 bit ints
  * Fix potential NULL pointer dereference when parsing
    configuration files</changelog>
  <changelog author="astieger@suse.com" date="1541419200">- libgit2 0.27.7:
  * Various improvements for handling repositories
  * Various API correctness fixes
- includes changess from 0.27.6:
  * Various security fixes for parsing integers from buffers,
    and buffer handling bsc#1114729</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550059200">- Update to version 0.28.0:
  * Changes or improvements:
  - The library is now always built with cdecl calling
    conventions on Windows; the ability to build a stdcall
    library has been removed.
  - Reference log creation now honors
    core.logallrefupdates=always.
  - Fix some issues with the error-reporting in the OpenSSL
    backend.
  - HTTP proxy support is now builtin; libcurl is no longer used
    to support proxies and is removed as a dependency.
  - Certificate and credential callbacks can now return
    GIT_PASSTHROUGH to decline to act; libgit2 will behave as if
    there was no callback set in the first place.
  - The line-ending filtering logic - when checking out files -
    has been updated to match newer git (&gt;= git 2.9) for proper
    interoperability.
  - Symbolic links are now supported on Windows when
    core.symlinks is set to true.
  - Submodules with names which attempt to perform path traversal
    now have their configuration ignored. Such names were blindly
    appended to the $GIT_DIR/modules and a malicious name could
    lead to an attacker writing to an arbitrary location. This
    matches git's handling of CVE-2018-11235.
  - Object validation is now performed during tree creation in
    the git_index_write_tree_to API.
  - Configuration variable may now be specified on the same line
    as a section header; previously this was erroneously a parser
    error.
  - When an HTTP server supports both NTLM and Negotiate
    authentication mechanisms, we would previously fail to
    authenticate with any mechanism.
  - The GIT_OPT_SET_PACK_MAX_OBJECTS option can now set the
    maximum number of objects allowed in a packfile being
    downloaded; this can help limit the maximum memory used when
    fetching from an untrusted remote.
  - Line numbers in diffs loaded from patch files were not being
    populated; they are now included in the results.
  - The repository's index is reloaded from disk at the beginning
    of git_merge operations to ensure that it is up-to-date.
  - Mailmap handling APIs have been introduced, and the new
    commit APIs git_commit_committer_with_mailmap and
    git_commit_author_with_mailmap will use the mailmap to
    resolve the committer and author information. In addition,
    blame will use the mailmap given when the
    GIT_BLAME_USE_MAILMAP option.
  - Ignore handling for files in ignored folders would be
    ignored.
  - Worktrees can now be backed by bare repositories.
  - Trailing spaces are supported in .gitignore files, these
    spaces were previously (and erroneously) treated as part of
    the pattern.
  - The library can now be built with mbedTLS support for HTTPS.
  - The diff status character 'T' will now be presented by the
    git_diff_status_char API for diff entries that change type.
  - Revision walks previously would sometimes include commits
    that should have been ignored; this is corrected.
  - Revision walks are now more efficient when the output is
    unsorted; we now avoid walking all the way to the beginning
    of history unnecessarily.
  - Error-handling around index extension loading has been fixed.
    We were previously always misreporting a truncated index.
  * API additions:
  - The index may now be iterated atomically using
    git_index_iterator.
  - Remote objects can now be created with extended options using
    the git_remote_create_with_opts API.
  - Diff objects can now be applied as changes to the working
    directory, index or both, emulating the git apply command.
    Additionally, git_apply_to_tree can apply those changes to a
    tree object as a fully in-memory operation.
  - You can now swap out memory allocators via the
    GIT_OPT_SET_ALLOCATOR option with git_libgit2_opts().
  - You can now ensure that functions do not discard unwritten
    changes to the index via the
    GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY option to
    git_libgit2_opts(). This will cause functions that implicitly
    re-read the index (eg, git_checkout) to fail if you have
    staged changes to the index but you have not written the
    index to disk. (Unless the checkout has the FORCE flag
    specified.)
  - At present, this defaults to off, but we intend to enable
    this more broadly in the future, as a warning or error. We
    encourage you to examine your code to ensure that you are not
    relying on the current behavior that implicitly removes
    staged changes.
  - Reference specifications can be parsed from an arbitrary
    string with the git_refspec_parse API.
  - You can now get the name and path of worktrees using the
    git_worktree_name and git_worktree_path APIs, respectively.
  - The ref field has been added to git_worktree_add_options to
    enable the creation of a worktree from a pre-existing branch.
  - It's now possible to analyze merge relationships between any
    two references, not just against HEAD, using
    git_merge_analysis_for_ref.
  * API removals:
  - The git_buf_free API is deprecated; it has been renamed to
    git_buf_dispose for consistency. The git_buf_free API will be
    retained for backward compatibility for the foreseeable
    future.
  - The git_otype enumeration and its members are deprecated and
    have been renamed for consistency. The GIT_OBJ_ enumeration
    values are now prefixed with GIT_OBJECT_. The old
    enumerations and macros will be retained for backward
    compatibility for the foreseeable future.
  - Several index-related APIs have been renamed for consistency.
    The GIT_IDXENTRY_ enumeration values and macros have been
    renamed to be prefixed with GIT_INDEX_ENTRY_. The
    GIT_INDEXCAP enumeration values are now prefixed with
    GIT_INDEX_CAPABILITY_. The old enumerations and macros will
    be retained for backward compatibility for the foreseeable
    future.
  - The error functions and enumeration values have been renamed
    for consistency. The giterr_ functions and values prefix have
    been renamed to be prefixed with git_error_; similarly,
    the GITERR_ constants have been renamed to be prefixed with
    GIT_ERROR_. The old enumerations and macros will be retained
    for backward compatibility for the foreseeable future.
  * Breaking API changes:
  - The default checkout strategy changed from DRY_RUN to SAFE.
  - Adding a symlink as .gitmodules into the index from the
    workdir or checking out such files is not allowed as this can
    make a Git implementation write outside of the repository and
    bypass the fsck checks for CVE-2018-11235.
- Bump sover to 28 following upstreams changes.</changelog>
  <changelog author="mrueckert@suse.de" date="1550145600">-  Update to version 0.28.1:
  - The deprecated functions (git_buf_free and the giterr_ family
    of functions) are now exported properly. In the v0.28 release,
    they were not given the correct external attributes and they
    did not have the correct linkage visibility in the v0.28
    library.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 0.28.2:
  * Fix include directory ordering when using bundled dependencies.
  * Fix infinite loop when searching for a non-existing repository with
    Windows-style paths including drive prefixes.
  * Fix symlinks to directories on Windows.
  * Fix paths with a trailing "/" not always being treated as
    directories when computing ignores.
  * Fix false negatives when computing ignores where ignore rules
    that are a prefix to a negative ignore rule exist.
  * Fix patches with CRLF line endings not being parsed correctly.
  * Fix segfault when parsing patches with file addition (deletion)
    where the added (deleted) file name contains a space.
  * Fix assertion failure when trying to write to a non-existent
    locked configuration file.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065600">- libgit2 0.28.3:
  * A carefully constructed commit object with a very large number
    of parents may have lead to out-of-bounds writes or potential
    denial of service (boo#1158981)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065601">- libgit2 0.28.4:
  * CVE-2019-1348: the fast-import stream command "feature
    export-marks=path" allows writing to arbitrary file paths. As
    libgit2 does not offer any interface for fast-import, it is not
    susceptible to this vulnerability. (boo#1158785)
  * CVE-2019-1349: by using NTFS 8.3 short names, backslashes or
    alternate filesystreams, it is possible to cause submodules to
    be written into pre-existing directories during a recursive
    clone using git. As libgit2 rejects cloning into non-empty
    directories by default, it is not susceptible to this
    vulnerability. (boo#1158787)
  * CVE-2019-1350: recursive clones may lead to arbitrary remote
    code executing due to improper quoting of command line
    arguments. As libgit2 uses libssh2, which does not require us
    to perform command line parsing, it is not susceptible to this
    vulnerability. (boo#1158788)
  * CVE-2019-1351: Windows provides the ability to substitute
    drive letters with arbitrary letters, including multi-byte
    Unicode letters. To fix any potential issues arising from
    interpreting such paths as relative paths, we have extended
    detection of DOS drive prefixes to accomodate for such cases.
    (boo#1158790)
  * CVE-2019-1352: by using NTFS-style alternative file streams for
    the ".git" directory, it is possible to overwrite parts of the
    repository. While this has been fixed in the past for Windows,
    the same vulnerability may also exist on other systems that
    write to NTFS filesystems. We now reject any paths starting
    with ".git:" on all systems. (boo#1158790)
  * CVE-2019-1353: by using NTFS-style 8.3 short names, it was
    possible to write to the ".git" directory and thus overwrite
    parts of the repository, leading to possible remote code
    execution. While this problem was already fixed in the past for
    Windows, other systems accessing NTFS filesystems are
    vulnerable to this issue too. We now enable NTFS protecions by
    default on all systems to fix this attack vector. (boo#1158791)
  * CVE-2019-1354: on Windows, backslashes are not a valid part of
    a filename but are instead interpreted as directory separators.
    As other platforms allowed to use such paths, it was possible
    to write such invalid entries into a Git repository and was
    thus an attack vector to write into the ".git" dierctory. We
    now reject any entries starting with ".git" on all systems.
    (boo#1158792)
  * CVE-2019-1387: it is possible to let a submodule's git
    directory point into a sibling's submodule directory, which may
    result in overwriting parts of the Git repository and thus lead
    to arbitrary command execution. As libgit2 doesn't provide any
    way to do submodule clones natively, it is not susceptible to
    this vulnerability. Users of libgit2 that have implemented
    recursive submodule clones manually are encouraged to review
    their implementation for this vulnerability. (boo#1158793)</changelog>
  <changelog author="alarrosa@suse.com" date="1661342400">- Add patches backported from the upstream v1.3 branch to fix
  CVE-2022-29187, CVE-2022-24765 (bsc#1201431, bsc#1198234):
  * 0001-buffer-git_buf_sanitize-should-return-a-value.patch
  * 0001-path-refactor-ownership-checks-into-current-user-and.patch
  * 0002-repo-ensure-that-repo-dir-is-owned-by-current-user.patch
  * 0003-fs_path-mock-ownership-checks.patch
  * 0004-repo-test-configuration-ownership-validation.patch
  * 0005-repo-refactor-global-config-loader-function.patch
  * 0006-repo-honor-safe.directory-during-ownership-checks.patch
  * 0007-repo-make-ownership-checks-optional.patch
  * 0010-revparse-Remove-error-prone-redundant-test.patch
  * 0014-repo-add-tests-for-bare-repo-permissions.patch
  * 0015-fs-remove-mock-naming-from-change-ownership-constant.patch
  * 0016-fs-refactor-file-ownership-checks.patch
  * 0017-fs-allow-ownership-match-if-user-is-in-admin-group.patch
  * 0018-repo-allow-admin-owned-configs-by-admin-users.patch
  * 0019-repo-validate-gitdir-and-gitlink-ownership.patch
  * 0020-repo-allow-users-running-with-sudo-to-access-their-r.patch</changelog>
  <changelog author="mgorse@suse.com" date="1678968000">- Backport patches from the 1.4 branch to verify ssh remote host
  keys (boo#1207364 CVE-2023-22742):
  0001-ssh-verify-the-remote-s-host-key-against-known_hosts.patch
  0002-tests-append-the-github.com-ssh-keys-so-we-have-acce.patch
  0003-tests-move-online-clone-ssh_auth_methods-into-the-ss.patch
  0004-ssh-look-for-a-key-in-known_hosts-to-set-the-key-typ.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217600">- Address boo#1219660 CVE-2024-24577:
  0021-fix-slash-in-index-for-git_index_add.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217601">- Fixing 0021-fix-slash-in-index-for-git_index_add.patch to use
  '*slash' vs. '*--slash'</changelog>
</package>
<package pkgid="54155f731e1b7ca2153933e63bf42e556d33cfe63abf3791cb3730a755cbdadf" name="libgit2-28" arch="s390x">
  <version epoch="0" ver="0.28.4" rel="150400.3.11.1"/>
  <changelog author="astieger@suse.com" date="1484136000">- libgit2 0.25.1
- New features and functionality:
  * repository discovery features
  * Support for reading and writing git index v4 files
  * Improve the performance of the revwalk
  * reference db concurrency improvements
  * Nanosecond resolution is now activated by default
  * restrict the set of ciphers used with OpenSSL by default.
  * user-registered merge drivers
  * built-in support for the union merge driver
  * callers can now specify proxy settings
  * New API for creating signed commits
  * New API for creating blobs from streams
  * New flags for opening repositories
  * New functions for various git operations
- Removed API:
  * git_blob_create_fromchunks() has been removed in  favour of
    git_blob_create_fromstream()
- Changed API:
  * git_packbuilder_object_count and git_packbuilder_written now
    return a size_t instead of a uint32_t for more thorough
    compatibility with the rest of the library.
  * git_packbuiler_progress now provides explicitly sized uint32_t
    values instead of unsigned int.
  * git_diff_file now includes an id_abbrev field that reflects the
    number of nibbles set in the id field.
  * git_odb_backend now has a freshen function pointer
  * git_remote_connect() now accepts proxy options.</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- libgit2 0.26.0:
  * Support for opening, creating and modifying worktrees.
  * Can now detect SHA1 collisions resulting from the SHAttered
    attack CVE-2005-4900
  * Fix for missing implementation of `git_merge_driver_source` getters
  * Fix for installed pkg-config file being broken when the prefix
    contains spaces
  * Can now detect when the hashsum of on-disk objects does not
    match their expected hashsum.
  * Support open-ended ranges (e.g. "master..", "...master") in
    revision range parsing code.
  * Correctly compute ignores with leading "/" in subdirectories.
  * Optionally call `fsync` on loose objects, packfiles and their
    indexes, loose references and packed reference files.
  * Builds against OpenSSL v1.1 and against LibreSSL.
  * Improvements for reading index v4 files.
  * API additions and incompatible API changes</changelog>
  <changelog author="mimi.vx@gmail.com" date="1510574400">- remove unneeded dependency (python is used only for testsuite, which
    isn't used during build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="kbabioch@suse.com" date="1521028800">- Update to 0.26.3:
  * Fix cloning of the libgit2 project with git clone --recursive by removing an
    invalid submodule from our testing data.
  * Fix endianness of the port in p_getaddrinfo().
  * Fix handling of negative gitignore rules with wildcards.
  * Fix handling of case-insensitive negative gitignore rules.
  * Fix resolving references to a tag if the reference is stored with its fully
    resolved OID in the packed-refs file.
  * Fix checkout not treating worktree files as modified when only their mode has
    changed.
  * Fix rename detection with GIT_DIFF_FIND_RENAMES_FROM_REWRITES.
  * Fixes memory handling issues when reading crafted repository index files.
    The issues allow for possible denial of service due to allocation of large
    memory and out-of-bound reads.
    (CVE-2018-8098 bnc#1085257 CVE-2018-8099 bnc#1085256)
  * Updates the bundled zlib to 1.2.11. Users who build the bundled zlib are
    vulnerable to security issues in the prior version.</changelog>
  <changelog author="mrueckert@suse.de" date="1524484800">- update to 0.27.0:
  - Changes or improvements
  - Improved p_unlink in posix_w32.c to try and make a file
    writable before sleeping in the retry loop to prevent
    unnecessary calls to sleep.
  - The CMake build infrastructure has been improved to speed up
    building time.
  - A new CMake option "-DUSE_HTTPS=" makes it possible to
    explicitly choose an HTTP backend.
  - A new CMake option "-DSHA1_BACKEND=" makes it possible to
    explicitly choose an SHA1 backend. The collision-detecting
    backend is now the default.
  - A new CMake option "-DUSE_BUNDLED_ZLIB" makes it possible to
    explicitly use the bundled zlib library.
  - A new CMake option "-DENABLE_REPRODUCIBLE_BUILDS" makes it
    possible to generate a reproducible static archive. This
    requires support from your toolchain.
  - The minimum required CMake version has been bumped to 2.8.11.
  - Writing to a configuration file now preserves the case of the
    key given by the caller for the case-insensitive portions of
    the key (existing sections are used even if they don't
    match).
  - We now support conditional includes in configuration files.
  - Fix for handling re-reading of configuration files with
    includes.
  - Fix for reading patches which contain exact renames only.
  - Fix for reading patches with whitespace in the compared
    files' paths.
  - We will now fill FETCH_HEAD from all passed refspecs instead
    of overwriting with the last one.
  - There is a new diff option, GIT_DIFF_INDENT_HEURISTIC which
    activates a heuristic which takes into account whitespace and
    indentation in order to produce better diffs when dealing
    with ambiguous diff hunks.
  - Fix for pattern-based ignore rules where files ignored by a
    rule cannot be un-ignored by another rule.
  - Sockets opened by libgit2 are now being closed on exec(3) if
    the platform supports it.
  - Fix for peeling annotated tags from packed-refs files.
  - Fix reading huge loose objects from the object database.
  - Fix files not being treated as modified when only the file
    mode has changed.
  - We now explicitly reject adding submodules to the index via
    git_index_add_frombuffer.
  - Fix handling of GIT_DIFF_FIND_RENAMES_FROM_REWRITES raising
    SIGABRT when one file has been deleted and another file has
    been rewritten.
  - Fix for WinHTTP not properly handling NTLM and Negotiate
    challenges.
  - When using SSH-based transports, we now repeatedly ask for
    the passphrase to decrypt the private key in case a wrong
    passphrase is being provided.
  - When generating conflict markers, they will now use the same
    line endings as the rest of the file.
  - API additions
  - The git_merge_file_options structure now contains a new
    setting, marker_size. This allows users to set the size of
    markers that delineate the sides of merged files in the
    output conflict file.  By default this is 7
    (GIT_MERGE_CONFLICT_MARKER_SIZE), which produces output
    markers like &lt;&lt;&lt;&lt;&lt;&lt;&lt; and &gt;&gt;&gt;&gt;&gt;&gt;&gt;.
  - git_remote_create_detached() creates a remote that is not
    associated to any repository (and does not apply
    configuration like 'insteadof' rules).  This is mostly useful
    for e.g. emulating git ls-remote behavior.
  - git_diff_patchid() lets you generate patch IDs for diffs.
  - git_status_options now has an additional field baseline to
    allow creating status lists against different trees.
  - New family of functions to allow creating notes for a
    specific notes commit instead of for a notes reference.
  - New family of functions to allow parsing message trailers.
    This API is still experimental and may change in future
    releases.
  - Breaking API changes
  - Signatures now distinguish between +0000 and -0000 UTC offsets.
  - The certificate check callback in the WinHTTP transport will
    now receive the message_cb_payload instead of the
    cred_acquire_payload.
  - We are now reading symlinked directories under .git/refs.
  - We now refuse creating branches named "HEAD".
  - We now refuse reading and writing all-zero object IDs into
    the object database.
  - We now read the effective user's configuration file instead
    of the real user's configuration in case libgit2 runs as part
    of a setuid binary.
  - The git_odb_open_rstream function and its readstream callback
    in the git_odb_backend interface have changed their
    signatures to allow providing the object's size and type to
    the caller.</changelog>
  <changelog author="astieger@suse.com" date="1531224000">- libgit2 0.27.3:
  * CVE-2018-10887 (bsc#1100613), CVE-2018-10888 (bsc#1100612):
    Specially crafted delta object in packfiles could trigger an
    integer overflow, bypassing input validation and causing the
    object database to contain copies of system memory. This may
    allow denial of service or, potentially, an information leak
- includes changes from 0.27.2:
  * various API and correctnes fixes
  * Fixes related to handling of .gitmodules
- includes changes from 0.27.1:
  * CVE-2018-11235: insufficient validation of submodule names from
    .gitmodules allowed writes to arbitrary paths (bsc#1095219)
  * disallow .gitmodules files as symlinks.</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- libgit2 0.27.4:
  * fix out-of-bounds reads when processing smart-protocol "ng"
    packets (bsc#1104641)</changelog>
  <changelog author="mpluskal@suse.com" date="1534852800">- Use pkgconfig style of dependencies, refresh dependencies
- Use more of cmake macros</changelog>
  <changelog author="astieger@suse.com" date="1538913600">- libgit2 0.27.5:
  * CVE-2018-17456: Submodule URLs and paths with a leading "-"
    are now ignored to avoid injecting options into library
    consumers that perform recursive clones (bsc#1110949)
  * Avoid a buffer overflow when running repack
  * Avoid stack overflow from unbounded recursion in configuration
    file parser
  * Avoid heap-buffer overflow when parsing "ok" packets
  * Fix heap-buffer overflows in smart protocol parsing code
  * Fix potential integer overflows on platforms with 16 bit ints
  * Fix potential NULL pointer dereference when parsing
    configuration files</changelog>
  <changelog author="astieger@suse.com" date="1541419200">- libgit2 0.27.7:
  * Various improvements for handling repositories
  * Various API correctness fixes
- includes changess from 0.27.6:
  * Various security fixes for parsing integers from buffers,
    and buffer handling bsc#1114729</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550059200">- Update to version 0.28.0:
  * Changes or improvements:
  - The library is now always built with cdecl calling
    conventions on Windows; the ability to build a stdcall
    library has been removed.
  - Reference log creation now honors
    core.logallrefupdates=always.
  - Fix some issues with the error-reporting in the OpenSSL
    backend.
  - HTTP proxy support is now builtin; libcurl is no longer used
    to support proxies and is removed as a dependency.
  - Certificate and credential callbacks can now return
    GIT_PASSTHROUGH to decline to act; libgit2 will behave as if
    there was no callback set in the first place.
  - The line-ending filtering logic - when checking out files -
    has been updated to match newer git (&gt;= git 2.9) for proper
    interoperability.
  - Symbolic links are now supported on Windows when
    core.symlinks is set to true.
  - Submodules with names which attempt to perform path traversal
    now have their configuration ignored. Such names were blindly
    appended to the $GIT_DIR/modules and a malicious name could
    lead to an attacker writing to an arbitrary location. This
    matches git's handling of CVE-2018-11235.
  - Object validation is now performed during tree creation in
    the git_index_write_tree_to API.
  - Configuration variable may now be specified on the same line
    as a section header; previously this was erroneously a parser
    error.
  - When an HTTP server supports both NTLM and Negotiate
    authentication mechanisms, we would previously fail to
    authenticate with any mechanism.
  - The GIT_OPT_SET_PACK_MAX_OBJECTS option can now set the
    maximum number of objects allowed in a packfile being
    downloaded; this can help limit the maximum memory used when
    fetching from an untrusted remote.
  - Line numbers in diffs loaded from patch files were not being
    populated; they are now included in the results.
  - The repository's index is reloaded from disk at the beginning
    of git_merge operations to ensure that it is up-to-date.
  - Mailmap handling APIs have been introduced, and the new
    commit APIs git_commit_committer_with_mailmap and
    git_commit_author_with_mailmap will use the mailmap to
    resolve the committer and author information. In addition,
    blame will use the mailmap given when the
    GIT_BLAME_USE_MAILMAP option.
  - Ignore handling for files in ignored folders would be
    ignored.
  - Worktrees can now be backed by bare repositories.
  - Trailing spaces are supported in .gitignore files, these
    spaces were previously (and erroneously) treated as part of
    the pattern.
  - The library can now be built with mbedTLS support for HTTPS.
  - The diff status character 'T' will now be presented by the
    git_diff_status_char API for diff entries that change type.
  - Revision walks previously would sometimes include commits
    that should have been ignored; this is corrected.
  - Revision walks are now more efficient when the output is
    unsorted; we now avoid walking all the way to the beginning
    of history unnecessarily.
  - Error-handling around index extension loading has been fixed.
    We were previously always misreporting a truncated index.
  * API additions:
  - The index may now be iterated atomically using
    git_index_iterator.
  - Remote objects can now be created with extended options using
    the git_remote_create_with_opts API.
  - Diff objects can now be applied as changes to the working
    directory, index or both, emulating the git apply command.
    Additionally, git_apply_to_tree can apply those changes to a
    tree object as a fully in-memory operation.
  - You can now swap out memory allocators via the
    GIT_OPT_SET_ALLOCATOR option with git_libgit2_opts().
  - You can now ensure that functions do not discard unwritten
    changes to the index via the
    GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY option to
    git_libgit2_opts(). This will cause functions that implicitly
    re-read the index (eg, git_checkout) to fail if you have
    staged changes to the index but you have not written the
    index to disk. (Unless the checkout has the FORCE flag
    specified.)
  - At present, this defaults to off, but we intend to enable
    this more broadly in the future, as a warning or error. We
    encourage you to examine your code to ensure that you are not
    relying on the current behavior that implicitly removes
    staged changes.
  - Reference specifications can be parsed from an arbitrary
    string with the git_refspec_parse API.
  - You can now get the name and path of worktrees using the
    git_worktree_name and git_worktree_path APIs, respectively.
  - The ref field has been added to git_worktree_add_options to
    enable the creation of a worktree from a pre-existing branch.
  - It's now possible to analyze merge relationships between any
    two references, not just against HEAD, using
    git_merge_analysis_for_ref.
  * API removals:
  - The git_buf_free API is deprecated; it has been renamed to
    git_buf_dispose for consistency. The git_buf_free API will be
    retained for backward compatibility for the foreseeable
    future.
  - The git_otype enumeration and its members are deprecated and
    have been renamed for consistency. The GIT_OBJ_ enumeration
    values are now prefixed with GIT_OBJECT_. The old
    enumerations and macros will be retained for backward
    compatibility for the foreseeable future.
  - Several index-related APIs have been renamed for consistency.
    The GIT_IDXENTRY_ enumeration values and macros have been
    renamed to be prefixed with GIT_INDEX_ENTRY_. The
    GIT_INDEXCAP enumeration values are now prefixed with
    GIT_INDEX_CAPABILITY_. The old enumerations and macros will
    be retained for backward compatibility for the foreseeable
    future.
  - The error functions and enumeration values have been renamed
    for consistency. The giterr_ functions and values prefix have
    been renamed to be prefixed with git_error_; similarly,
    the GITERR_ constants have been renamed to be prefixed with
    GIT_ERROR_. The old enumerations and macros will be retained
    for backward compatibility for the foreseeable future.
  * Breaking API changes:
  - The default checkout strategy changed from DRY_RUN to SAFE.
  - Adding a symlink as .gitmodules into the index from the
    workdir or checking out such files is not allowed as this can
    make a Git implementation write outside of the repository and
    bypass the fsck checks for CVE-2018-11235.
- Bump sover to 28 following upstreams changes.</changelog>
  <changelog author="mrueckert@suse.de" date="1550145600">-  Update to version 0.28.1:
  - The deprecated functions (git_buf_free and the giterr_ family
    of functions) are now exported properly. In the v0.28 release,
    they were not given the correct external attributes and they
    did not have the correct linkage visibility in the v0.28
    library.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 0.28.2:
  * Fix include directory ordering when using bundled dependencies.
  * Fix infinite loop when searching for a non-existing repository with
    Windows-style paths including drive prefixes.
  * Fix symlinks to directories on Windows.
  * Fix paths with a trailing "/" not always being treated as
    directories when computing ignores.
  * Fix false negatives when computing ignores where ignore rules
    that are a prefix to a negative ignore rule exist.
  * Fix patches with CRLF line endings not being parsed correctly.
  * Fix segfault when parsing patches with file addition (deletion)
    where the added (deleted) file name contains a space.
  * Fix assertion failure when trying to write to a non-existent
    locked configuration file.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065600">- libgit2 0.28.3:
  * A carefully constructed commit object with a very large number
    of parents may have lead to out-of-bounds writes or potential
    denial of service (boo#1158981)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065601">- libgit2 0.28.4:
  * CVE-2019-1348: the fast-import stream command "feature
    export-marks=path" allows writing to arbitrary file paths. As
    libgit2 does not offer any interface for fast-import, it is not
    susceptible to this vulnerability. (boo#1158785)
  * CVE-2019-1349: by using NTFS 8.3 short names, backslashes or
    alternate filesystreams, it is possible to cause submodules to
    be written into pre-existing directories during a recursive
    clone using git. As libgit2 rejects cloning into non-empty
    directories by default, it is not susceptible to this
    vulnerability. (boo#1158787)
  * CVE-2019-1350: recursive clones may lead to arbitrary remote
    code executing due to improper quoting of command line
    arguments. As libgit2 uses libssh2, which does not require us
    to perform command line parsing, it is not susceptible to this
    vulnerability. (boo#1158788)
  * CVE-2019-1351: Windows provides the ability to substitute
    drive letters with arbitrary letters, including multi-byte
    Unicode letters. To fix any potential issues arising from
    interpreting such paths as relative paths, we have extended
    detection of DOS drive prefixes to accomodate for such cases.
    (boo#1158790)
  * CVE-2019-1352: by using NTFS-style alternative file streams for
    the ".git" directory, it is possible to overwrite parts of the
    repository. While this has been fixed in the past for Windows,
    the same vulnerability may also exist on other systems that
    write to NTFS filesystems. We now reject any paths starting
    with ".git:" on all systems. (boo#1158790)
  * CVE-2019-1353: by using NTFS-style 8.3 short names, it was
    possible to write to the ".git" directory and thus overwrite
    parts of the repository, leading to possible remote code
    execution. While this problem was already fixed in the past for
    Windows, other systems accessing NTFS filesystems are
    vulnerable to this issue too. We now enable NTFS protecions by
    default on all systems to fix this attack vector. (boo#1158791)
  * CVE-2019-1354: on Windows, backslashes are not a valid part of
    a filename but are instead interpreted as directory separators.
    As other platforms allowed to use such paths, it was possible
    to write such invalid entries into a Git repository and was
    thus an attack vector to write into the ".git" dierctory. We
    now reject any entries starting with ".git" on all systems.
    (boo#1158792)
  * CVE-2019-1387: it is possible to let a submodule's git
    directory point into a sibling's submodule directory, which may
    result in overwriting parts of the Git repository and thus lead
    to arbitrary command execution. As libgit2 doesn't provide any
    way to do submodule clones natively, it is not susceptible to
    this vulnerability. Users of libgit2 that have implemented
    recursive submodule clones manually are encouraged to review
    their implementation for this vulnerability. (boo#1158793)</changelog>
  <changelog author="alarrosa@suse.com" date="1661342400">- Add patches backported from the upstream v1.3 branch to fix
  CVE-2022-29187, CVE-2022-24765 (bsc#1201431, bsc#1198234):
  * 0001-buffer-git_buf_sanitize-should-return-a-value.patch
  * 0001-path-refactor-ownership-checks-into-current-user-and.patch
  * 0002-repo-ensure-that-repo-dir-is-owned-by-current-user.patch
  * 0003-fs_path-mock-ownership-checks.patch
  * 0004-repo-test-configuration-ownership-validation.patch
  * 0005-repo-refactor-global-config-loader-function.patch
  * 0006-repo-honor-safe.directory-during-ownership-checks.patch
  * 0007-repo-make-ownership-checks-optional.patch
  * 0010-revparse-Remove-error-prone-redundant-test.patch
  * 0014-repo-add-tests-for-bare-repo-permissions.patch
  * 0015-fs-remove-mock-naming-from-change-ownership-constant.patch
  * 0016-fs-refactor-file-ownership-checks.patch
  * 0017-fs-allow-ownership-match-if-user-is-in-admin-group.patch
  * 0018-repo-allow-admin-owned-configs-by-admin-users.patch
  * 0019-repo-validate-gitdir-and-gitlink-ownership.patch
  * 0020-repo-allow-users-running-with-sudo-to-access-their-r.patch</changelog>
  <changelog author="mgorse@suse.com" date="1678968000">- Backport patches from the 1.4 branch to verify ssh remote host
  keys (boo#1207364 CVE-2023-22742):
  0001-ssh-verify-the-remote-s-host-key-against-known_hosts.patch
  0002-tests-append-the-github.com-ssh-keys-so-we-have-acce.patch
  0003-tests-move-online-clone-ssh_auth_methods-into-the-ss.patch
  0004-ssh-look-for-a-key-in-known_hosts-to-set-the-key-typ.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217600">- Address boo#1219660 CVE-2024-24577:
  0021-fix-slash-in-index-for-git_index_add.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217601">- Fixing 0021-fix-slash-in-index-for-git_index_add.patch to use
  '*slash' vs. '*--slash'</changelog>
</package>
<package pkgid="fdc62be0a5b22e36727b72ba9c377e9b87c51778574c3c4bb7da471a390b6668" name="libgit2-28" arch="x86_64">
  <version epoch="0" ver="0.28.4" rel="150400.3.11.1"/>
  <changelog author="astieger@suse.com" date="1484136000">- libgit2 0.25.1
- New features and functionality:
  * repository discovery features
  * Support for reading and writing git index v4 files
  * Improve the performance of the revwalk
  * reference db concurrency improvements
  * Nanosecond resolution is now activated by default
  * restrict the set of ciphers used with OpenSSL by default.
  * user-registered merge drivers
  * built-in support for the union merge driver
  * callers can now specify proxy settings
  * New API for creating signed commits
  * New API for creating blobs from streams
  * New flags for opening repositories
  * New functions for various git operations
- Removed API:
  * git_blob_create_fromchunks() has been removed in  favour of
    git_blob_create_fromstream()
- Changed API:
  * git_packbuilder_object_count and git_packbuilder_written now
    return a size_t instead of a uint32_t for more thorough
    compatibility with the rest of the library.
  * git_packbuiler_progress now provides explicitly sized uint32_t
    values instead of unsigned int.
  * git_diff_file now includes an id_abbrev field that reflects the
    number of nibbles set in the id field.
  * git_odb_backend now has a freshen function pointer
  * git_remote_connect() now accepts proxy options.</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- libgit2 0.26.0:
  * Support for opening, creating and modifying worktrees.
  * Can now detect SHA1 collisions resulting from the SHAttered
    attack CVE-2005-4900
  * Fix for missing implementation of `git_merge_driver_source` getters
  * Fix for installed pkg-config file being broken when the prefix
    contains spaces
  * Can now detect when the hashsum of on-disk objects does not
    match their expected hashsum.
  * Support open-ended ranges (e.g. "master..", "...master") in
    revision range parsing code.
  * Correctly compute ignores with leading "/" in subdirectories.
  * Optionally call `fsync` on loose objects, packfiles and their
    indexes, loose references and packed reference files.
  * Builds against OpenSSL v1.1 and against LibreSSL.
  * Improvements for reading index v4 files.
  * API additions and incompatible API changes</changelog>
  <changelog author="mimi.vx@gmail.com" date="1510574400">- remove unneeded dependency (python is used only for testsuite, which
    isn't used during build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="kbabioch@suse.com" date="1521028800">- Update to 0.26.3:
  * Fix cloning of the libgit2 project with git clone --recursive by removing an
    invalid submodule from our testing data.
  * Fix endianness of the port in p_getaddrinfo().
  * Fix handling of negative gitignore rules with wildcards.
  * Fix handling of case-insensitive negative gitignore rules.
  * Fix resolving references to a tag if the reference is stored with its fully
    resolved OID in the packed-refs file.
  * Fix checkout not treating worktree files as modified when only their mode has
    changed.
  * Fix rename detection with GIT_DIFF_FIND_RENAMES_FROM_REWRITES.
  * Fixes memory handling issues when reading crafted repository index files.
    The issues allow for possible denial of service due to allocation of large
    memory and out-of-bound reads.
    (CVE-2018-8098 bnc#1085257 CVE-2018-8099 bnc#1085256)
  * Updates the bundled zlib to 1.2.11. Users who build the bundled zlib are
    vulnerable to security issues in the prior version.</changelog>
  <changelog author="mrueckert@suse.de" date="1524484800">- update to 0.27.0:
  - Changes or improvements
  - Improved p_unlink in posix_w32.c to try and make a file
    writable before sleeping in the retry loop to prevent
    unnecessary calls to sleep.
  - The CMake build infrastructure has been improved to speed up
    building time.
  - A new CMake option "-DUSE_HTTPS=" makes it possible to
    explicitly choose an HTTP backend.
  - A new CMake option "-DSHA1_BACKEND=" makes it possible to
    explicitly choose an SHA1 backend. The collision-detecting
    backend is now the default.
  - A new CMake option "-DUSE_BUNDLED_ZLIB" makes it possible to
    explicitly use the bundled zlib library.
  - A new CMake option "-DENABLE_REPRODUCIBLE_BUILDS" makes it
    possible to generate a reproducible static archive. This
    requires support from your toolchain.
  - The minimum required CMake version has been bumped to 2.8.11.
  - Writing to a configuration file now preserves the case of the
    key given by the caller for the case-insensitive portions of
    the key (existing sections are used even if they don't
    match).
  - We now support conditional includes in configuration files.
  - Fix for handling re-reading of configuration files with
    includes.
  - Fix for reading patches which contain exact renames only.
  - Fix for reading patches with whitespace in the compared
    files' paths.
  - We will now fill FETCH_HEAD from all passed refspecs instead
    of overwriting with the last one.
  - There is a new diff option, GIT_DIFF_INDENT_HEURISTIC which
    activates a heuristic which takes into account whitespace and
    indentation in order to produce better diffs when dealing
    with ambiguous diff hunks.
  - Fix for pattern-based ignore rules where files ignored by a
    rule cannot be un-ignored by another rule.
  - Sockets opened by libgit2 are now being closed on exec(3) if
    the platform supports it.
  - Fix for peeling annotated tags from packed-refs files.
  - Fix reading huge loose objects from the object database.
  - Fix files not being treated as modified when only the file
    mode has changed.
  - We now explicitly reject adding submodules to the index via
    git_index_add_frombuffer.
  - Fix handling of GIT_DIFF_FIND_RENAMES_FROM_REWRITES raising
    SIGABRT when one file has been deleted and another file has
    been rewritten.
  - Fix for WinHTTP not properly handling NTLM and Negotiate
    challenges.
  - When using SSH-based transports, we now repeatedly ask for
    the passphrase to decrypt the private key in case a wrong
    passphrase is being provided.
  - When generating conflict markers, they will now use the same
    line endings as the rest of the file.
  - API additions
  - The git_merge_file_options structure now contains a new
    setting, marker_size. This allows users to set the size of
    markers that delineate the sides of merged files in the
    output conflict file.  By default this is 7
    (GIT_MERGE_CONFLICT_MARKER_SIZE), which produces output
    markers like &lt;&lt;&lt;&lt;&lt;&lt;&lt; and &gt;&gt;&gt;&gt;&gt;&gt;&gt;.
  - git_remote_create_detached() creates a remote that is not
    associated to any repository (and does not apply
    configuration like 'insteadof' rules).  This is mostly useful
    for e.g. emulating git ls-remote behavior.
  - git_diff_patchid() lets you generate patch IDs for diffs.
  - git_status_options now has an additional field baseline to
    allow creating status lists against different trees.
  - New family of functions to allow creating notes for a
    specific notes commit instead of for a notes reference.
  - New family of functions to allow parsing message trailers.
    This API is still experimental and may change in future
    releases.
  - Breaking API changes
  - Signatures now distinguish between +0000 and -0000 UTC offsets.
  - The certificate check callback in the WinHTTP transport will
    now receive the message_cb_payload instead of the
    cred_acquire_payload.
  - We are now reading symlinked directories under .git/refs.
  - We now refuse creating branches named "HEAD".
  - We now refuse reading and writing all-zero object IDs into
    the object database.
  - We now read the effective user's configuration file instead
    of the real user's configuration in case libgit2 runs as part
    of a setuid binary.
  - The git_odb_open_rstream function and its readstream callback
    in the git_odb_backend interface have changed their
    signatures to allow providing the object's size and type to
    the caller.</changelog>
  <changelog author="astieger@suse.com" date="1531224000">- libgit2 0.27.3:
  * CVE-2018-10887 (bsc#1100613), CVE-2018-10888 (bsc#1100612):
    Specially crafted delta object in packfiles could trigger an
    integer overflow, bypassing input validation and causing the
    object database to contain copies of system memory. This may
    allow denial of service or, potentially, an information leak
- includes changes from 0.27.2:
  * various API and correctnes fixes
  * Fixes related to handling of .gitmodules
- includes changes from 0.27.1:
  * CVE-2018-11235: insufficient validation of submodule names from
    .gitmodules allowed writes to arbitrary paths (bsc#1095219)
  * disallow .gitmodules files as symlinks.</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- libgit2 0.27.4:
  * fix out-of-bounds reads when processing smart-protocol "ng"
    packets (bsc#1104641)</changelog>
  <changelog author="mpluskal@suse.com" date="1534852800">- Use pkgconfig style of dependencies, refresh dependencies
- Use more of cmake macros</changelog>
  <changelog author="astieger@suse.com" date="1538913600">- libgit2 0.27.5:
  * CVE-2018-17456: Submodule URLs and paths with a leading "-"
    are now ignored to avoid injecting options into library
    consumers that perform recursive clones (bsc#1110949)
  * Avoid a buffer overflow when running repack
  * Avoid stack overflow from unbounded recursion in configuration
    file parser
  * Avoid heap-buffer overflow when parsing "ok" packets
  * Fix heap-buffer overflows in smart protocol parsing code
  * Fix potential integer overflows on platforms with 16 bit ints
  * Fix potential NULL pointer dereference when parsing
    configuration files</changelog>
  <changelog author="astieger@suse.com" date="1541419200">- libgit2 0.27.7:
  * Various improvements for handling repositories
  * Various API correctness fixes
- includes changess from 0.27.6:
  * Various security fixes for parsing integers from buffers,
    and buffer handling bsc#1114729</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550059200">- Update to version 0.28.0:
  * Changes or improvements:
  - The library is now always built with cdecl calling
    conventions on Windows; the ability to build a stdcall
    library has been removed.
  - Reference log creation now honors
    core.logallrefupdates=always.
  - Fix some issues with the error-reporting in the OpenSSL
    backend.
  - HTTP proxy support is now builtin; libcurl is no longer used
    to support proxies and is removed as a dependency.
  - Certificate and credential callbacks can now return
    GIT_PASSTHROUGH to decline to act; libgit2 will behave as if
    there was no callback set in the first place.
  - The line-ending filtering logic - when checking out files -
    has been updated to match newer git (&gt;= git 2.9) for proper
    interoperability.
  - Symbolic links are now supported on Windows when
    core.symlinks is set to true.
  - Submodules with names which attempt to perform path traversal
    now have their configuration ignored. Such names were blindly
    appended to the $GIT_DIR/modules and a malicious name could
    lead to an attacker writing to an arbitrary location. This
    matches git's handling of CVE-2018-11235.
  - Object validation is now performed during tree creation in
    the git_index_write_tree_to API.
  - Configuration variable may now be specified on the same line
    as a section header; previously this was erroneously a parser
    error.
  - When an HTTP server supports both NTLM and Negotiate
    authentication mechanisms, we would previously fail to
    authenticate with any mechanism.
  - The GIT_OPT_SET_PACK_MAX_OBJECTS option can now set the
    maximum number of objects allowed in a packfile being
    downloaded; this can help limit the maximum memory used when
    fetching from an untrusted remote.
  - Line numbers in diffs loaded from patch files were not being
    populated; they are now included in the results.
  - The repository's index is reloaded from disk at the beginning
    of git_merge operations to ensure that it is up-to-date.
  - Mailmap handling APIs have been introduced, and the new
    commit APIs git_commit_committer_with_mailmap and
    git_commit_author_with_mailmap will use the mailmap to
    resolve the committer and author information. In addition,
    blame will use the mailmap given when the
    GIT_BLAME_USE_MAILMAP option.
  - Ignore handling for files in ignored folders would be
    ignored.
  - Worktrees can now be backed by bare repositories.
  - Trailing spaces are supported in .gitignore files, these
    spaces were previously (and erroneously) treated as part of
    the pattern.
  - The library can now be built with mbedTLS support for HTTPS.
  - The diff status character 'T' will now be presented by the
    git_diff_status_char API for diff entries that change type.
  - Revision walks previously would sometimes include commits
    that should have been ignored; this is corrected.
  - Revision walks are now more efficient when the output is
    unsorted; we now avoid walking all the way to the beginning
    of history unnecessarily.
  - Error-handling around index extension loading has been fixed.
    We were previously always misreporting a truncated index.
  * API additions:
  - The index may now be iterated atomically using
    git_index_iterator.
  - Remote objects can now be created with extended options using
    the git_remote_create_with_opts API.
  - Diff objects can now be applied as changes to the working
    directory, index or both, emulating the git apply command.
    Additionally, git_apply_to_tree can apply those changes to a
    tree object as a fully in-memory operation.
  - You can now swap out memory allocators via the
    GIT_OPT_SET_ALLOCATOR option with git_libgit2_opts().
  - You can now ensure that functions do not discard unwritten
    changes to the index via the
    GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY option to
    git_libgit2_opts(). This will cause functions that implicitly
    re-read the index (eg, git_checkout) to fail if you have
    staged changes to the index but you have not written the
    index to disk. (Unless the checkout has the FORCE flag
    specified.)
  - At present, this defaults to off, but we intend to enable
    this more broadly in the future, as a warning or error. We
    encourage you to examine your code to ensure that you are not
    relying on the current behavior that implicitly removes
    staged changes.
  - Reference specifications can be parsed from an arbitrary
    string with the git_refspec_parse API.
  - You can now get the name and path of worktrees using the
    git_worktree_name and git_worktree_path APIs, respectively.
  - The ref field has been added to git_worktree_add_options to
    enable the creation of a worktree from a pre-existing branch.
  - It's now possible to analyze merge relationships between any
    two references, not just against HEAD, using
    git_merge_analysis_for_ref.
  * API removals:
  - The git_buf_free API is deprecated; it has been renamed to
    git_buf_dispose for consistency. The git_buf_free API will be
    retained for backward compatibility for the foreseeable
    future.
  - The git_otype enumeration and its members are deprecated and
    have been renamed for consistency. The GIT_OBJ_ enumeration
    values are now prefixed with GIT_OBJECT_. The old
    enumerations and macros will be retained for backward
    compatibility for the foreseeable future.
  - Several index-related APIs have been renamed for consistency.
    The GIT_IDXENTRY_ enumeration values and macros have been
    renamed to be prefixed with GIT_INDEX_ENTRY_. The
    GIT_INDEXCAP enumeration values are now prefixed with
    GIT_INDEX_CAPABILITY_. The old enumerations and macros will
    be retained for backward compatibility for the foreseeable
    future.
  - The error functions and enumeration values have been renamed
    for consistency. The giterr_ functions and values prefix have
    been renamed to be prefixed with git_error_; similarly,
    the GITERR_ constants have been renamed to be prefixed with
    GIT_ERROR_. The old enumerations and macros will be retained
    for backward compatibility for the foreseeable future.
  * Breaking API changes:
  - The default checkout strategy changed from DRY_RUN to SAFE.
  - Adding a symlink as .gitmodules into the index from the
    workdir or checking out such files is not allowed as this can
    make a Git implementation write outside of the repository and
    bypass the fsck checks for CVE-2018-11235.
- Bump sover to 28 following upstreams changes.</changelog>
  <changelog author="mrueckert@suse.de" date="1550145600">-  Update to version 0.28.1:
  - The deprecated functions (git_buf_free and the giterr_ family
    of functions) are now exported properly. In the v0.28 release,
    they were not given the correct external attributes and they
    did not have the correct linkage visibility in the v0.28
    library.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 0.28.2:
  * Fix include directory ordering when using bundled dependencies.
  * Fix infinite loop when searching for a non-existing repository with
    Windows-style paths including drive prefixes.
  * Fix symlinks to directories on Windows.
  * Fix paths with a trailing "/" not always being treated as
    directories when computing ignores.
  * Fix false negatives when computing ignores where ignore rules
    that are a prefix to a negative ignore rule exist.
  * Fix patches with CRLF line endings not being parsed correctly.
  * Fix segfault when parsing patches with file addition (deletion)
    where the added (deleted) file name contains a space.
  * Fix assertion failure when trying to write to a non-existent
    locked configuration file.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065600">- libgit2 0.28.3:
  * A carefully constructed commit object with a very large number
    of parents may have lead to out-of-bounds writes or potential
    denial of service (boo#1158981)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065601">- libgit2 0.28.4:
  * CVE-2019-1348: the fast-import stream command "feature
    export-marks=path" allows writing to arbitrary file paths. As
    libgit2 does not offer any interface for fast-import, it is not
    susceptible to this vulnerability. (boo#1158785)
  * CVE-2019-1349: by using NTFS 8.3 short names, backslashes or
    alternate filesystreams, it is possible to cause submodules to
    be written into pre-existing directories during a recursive
    clone using git. As libgit2 rejects cloning into non-empty
    directories by default, it is not susceptible to this
    vulnerability. (boo#1158787)
  * CVE-2019-1350: recursive clones may lead to arbitrary remote
    code executing due to improper quoting of command line
    arguments. As libgit2 uses libssh2, which does not require us
    to perform command line parsing, it is not susceptible to this
    vulnerability. (boo#1158788)
  * CVE-2019-1351: Windows provides the ability to substitute
    drive letters with arbitrary letters, including multi-byte
    Unicode letters. To fix any potential issues arising from
    interpreting such paths as relative paths, we have extended
    detection of DOS drive prefixes to accomodate for such cases.
    (boo#1158790)
  * CVE-2019-1352: by using NTFS-style alternative file streams for
    the ".git" directory, it is possible to overwrite parts of the
    repository. While this has been fixed in the past for Windows,
    the same vulnerability may also exist on other systems that
    write to NTFS filesystems. We now reject any paths starting
    with ".git:" on all systems. (boo#1158790)
  * CVE-2019-1353: by using NTFS-style 8.3 short names, it was
    possible to write to the ".git" directory and thus overwrite
    parts of the repository, leading to possible remote code
    execution. While this problem was already fixed in the past for
    Windows, other systems accessing NTFS filesystems are
    vulnerable to this issue too. We now enable NTFS protecions by
    default on all systems to fix this attack vector. (boo#1158791)
  * CVE-2019-1354: on Windows, backslashes are not a valid part of
    a filename but are instead interpreted as directory separators.
    As other platforms allowed to use such paths, it was possible
    to write such invalid entries into a Git repository and was
    thus an attack vector to write into the ".git" dierctory. We
    now reject any entries starting with ".git" on all systems.
    (boo#1158792)
  * CVE-2019-1387: it is possible to let a submodule's git
    directory point into a sibling's submodule directory, which may
    result in overwriting parts of the Git repository and thus lead
    to arbitrary command execution. As libgit2 doesn't provide any
    way to do submodule clones natively, it is not susceptible to
    this vulnerability. Users of libgit2 that have implemented
    recursive submodule clones manually are encouraged to review
    their implementation for this vulnerability. (boo#1158793)</changelog>
  <changelog author="alarrosa@suse.com" date="1661342400">- Add patches backported from the upstream v1.3 branch to fix
  CVE-2022-29187, CVE-2022-24765 (bsc#1201431, bsc#1198234):
  * 0001-buffer-git_buf_sanitize-should-return-a-value.patch
  * 0001-path-refactor-ownership-checks-into-current-user-and.patch
  * 0002-repo-ensure-that-repo-dir-is-owned-by-current-user.patch
  * 0003-fs_path-mock-ownership-checks.patch
  * 0004-repo-test-configuration-ownership-validation.patch
  * 0005-repo-refactor-global-config-loader-function.patch
  * 0006-repo-honor-safe.directory-during-ownership-checks.patch
  * 0007-repo-make-ownership-checks-optional.patch
  * 0010-revparse-Remove-error-prone-redundant-test.patch
  * 0014-repo-add-tests-for-bare-repo-permissions.patch
  * 0015-fs-remove-mock-naming-from-change-ownership-constant.patch
  * 0016-fs-refactor-file-ownership-checks.patch
  * 0017-fs-allow-ownership-match-if-user-is-in-admin-group.patch
  * 0018-repo-allow-admin-owned-configs-by-admin-users.patch
  * 0019-repo-validate-gitdir-and-gitlink-ownership.patch
  * 0020-repo-allow-users-running-with-sudo-to-access-their-r.patch</changelog>
  <changelog author="mgorse@suse.com" date="1678968000">- Backport patches from the 1.4 branch to verify ssh remote host
  keys (boo#1207364 CVE-2023-22742):
  0001-ssh-verify-the-remote-s-host-key-against-known_hosts.patch
  0002-tests-append-the-github.com-ssh-keys-so-we-have-acce.patch
  0003-tests-move-online-clone-ssh_auth_methods-into-the-ss.patch
  0004-ssh-look-for-a-key-in-known_hosts-to-set-the-key-typ.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217600">- Address boo#1219660 CVE-2024-24577:
  0021-fix-slash-in-index-for-git_index_add.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217601">- Fixing 0021-fix-slash-in-index-for-git_index_add.patch to use
  '*slash' vs. '*--slash'</changelog>
</package>
<package pkgid="42a5dd3e72bc64f8f821f7e2df20707103b4a12ba9db34a98c92d3f0ab9230ca" name="libgit2-28-64bit" arch="aarch64_ilp32">
  <version epoch="0" ver="0.28.4" rel="150400.3.11.1"/>
  <changelog author="astieger@suse.com" date="1484136000">- libgit2 0.25.1
- New features and functionality:
  * repository discovery features
  * Support for reading and writing git index v4 files
  * Improve the performance of the revwalk
  * reference db concurrency improvements
  * Nanosecond resolution is now activated by default
  * restrict the set of ciphers used with OpenSSL by default.
  * user-registered merge drivers
  * built-in support for the union merge driver
  * callers can now specify proxy settings
  * New API for creating signed commits
  * New API for creating blobs from streams
  * New flags for opening repositories
  * New functions for various git operations
- Removed API:
  * git_blob_create_fromchunks() has been removed in  favour of
    git_blob_create_fromstream()
- Changed API:
  * git_packbuilder_object_count and git_packbuilder_written now
    return a size_t instead of a uint32_t for more thorough
    compatibility with the rest of the library.
  * git_packbuiler_progress now provides explicitly sized uint32_t
    values instead of unsigned int.
  * git_diff_file now includes an id_abbrev field that reflects the
    number of nibbles set in the id field.
  * git_odb_backend now has a freshen function pointer
  * git_remote_connect() now accepts proxy options.</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- libgit2 0.26.0:
  * Support for opening, creating and modifying worktrees.
  * Can now detect SHA1 collisions resulting from the SHAttered
    attack CVE-2005-4900
  * Fix for missing implementation of `git_merge_driver_source` getters
  * Fix for installed pkg-config file being broken when the prefix
    contains spaces
  * Can now detect when the hashsum of on-disk objects does not
    match their expected hashsum.
  * Support open-ended ranges (e.g. "master..", "...master") in
    revision range parsing code.
  * Correctly compute ignores with leading "/" in subdirectories.
  * Optionally call `fsync` on loose objects, packfiles and their
    indexes, loose references and packed reference files.
  * Builds against OpenSSL v1.1 and against LibreSSL.
  * Improvements for reading index v4 files.
  * API additions and incompatible API changes</changelog>
  <changelog author="mimi.vx@gmail.com" date="1510574400">- remove unneeded dependency (python is used only for testsuite, which
    isn't used during build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="kbabioch@suse.com" date="1521028800">- Update to 0.26.3:
  * Fix cloning of the libgit2 project with git clone --recursive by removing an
    invalid submodule from our testing data.
  * Fix endianness of the port in p_getaddrinfo().
  * Fix handling of negative gitignore rules with wildcards.
  * Fix handling of case-insensitive negative gitignore rules.
  * Fix resolving references to a tag if the reference is stored with its fully
    resolved OID in the packed-refs file.
  * Fix checkout not treating worktree files as modified when only their mode has
    changed.
  * Fix rename detection with GIT_DIFF_FIND_RENAMES_FROM_REWRITES.
  * Fixes memory handling issues when reading crafted repository index files.
    The issues allow for possible denial of service due to allocation of large
    memory and out-of-bound reads.
    (CVE-2018-8098 bnc#1085257 CVE-2018-8099 bnc#1085256)
  * Updates the bundled zlib to 1.2.11. Users who build the bundled zlib are
    vulnerable to security issues in the prior version.</changelog>
  <changelog author="mrueckert@suse.de" date="1524484800">- update to 0.27.0:
  - Changes or improvements
  - Improved p_unlink in posix_w32.c to try and make a file
    writable before sleeping in the retry loop to prevent
    unnecessary calls to sleep.
  - The CMake build infrastructure has been improved to speed up
    building time.
  - A new CMake option "-DUSE_HTTPS=" makes it possible to
    explicitly choose an HTTP backend.
  - A new CMake option "-DSHA1_BACKEND=" makes it possible to
    explicitly choose an SHA1 backend. The collision-detecting
    backend is now the default.
  - A new CMake option "-DUSE_BUNDLED_ZLIB" makes it possible to
    explicitly use the bundled zlib library.
  - A new CMake option "-DENABLE_REPRODUCIBLE_BUILDS" makes it
    possible to generate a reproducible static archive. This
    requires support from your toolchain.
  - The minimum required CMake version has been bumped to 2.8.11.
  - Writing to a configuration file now preserves the case of the
    key given by the caller for the case-insensitive portions of
    the key (existing sections are used even if they don't
    match).
  - We now support conditional includes in configuration files.
  - Fix for handling re-reading of configuration files with
    includes.
  - Fix for reading patches which contain exact renames only.
  - Fix for reading patches with whitespace in the compared
    files' paths.
  - We will now fill FETCH_HEAD from all passed refspecs instead
    of overwriting with the last one.
  - There is a new diff option, GIT_DIFF_INDENT_HEURISTIC which
    activates a heuristic which takes into account whitespace and
    indentation in order to produce better diffs when dealing
    with ambiguous diff hunks.
  - Fix for pattern-based ignore rules where files ignored by a
    rule cannot be un-ignored by another rule.
  - Sockets opened by libgit2 are now being closed on exec(3) if
    the platform supports it.
  - Fix for peeling annotated tags from packed-refs files.
  - Fix reading huge loose objects from the object database.
  - Fix files not being treated as modified when only the file
    mode has changed.
  - We now explicitly reject adding submodules to the index via
    git_index_add_frombuffer.
  - Fix handling of GIT_DIFF_FIND_RENAMES_FROM_REWRITES raising
    SIGABRT when one file has been deleted and another file has
    been rewritten.
  - Fix for WinHTTP not properly handling NTLM and Negotiate
    challenges.
  - When using SSH-based transports, we now repeatedly ask for
    the passphrase to decrypt the private key in case a wrong
    passphrase is being provided.
  - When generating conflict markers, they will now use the same
    line endings as the rest of the file.
  - API additions
  - The git_merge_file_options structure now contains a new
    setting, marker_size. This allows users to set the size of
    markers that delineate the sides of merged files in the
    output conflict file.  By default this is 7
    (GIT_MERGE_CONFLICT_MARKER_SIZE), which produces output
    markers like &lt;&lt;&lt;&lt;&lt;&lt;&lt; and &gt;&gt;&gt;&gt;&gt;&gt;&gt;.
  - git_remote_create_detached() creates a remote that is not
    associated to any repository (and does not apply
    configuration like 'insteadof' rules).  This is mostly useful
    for e.g. emulating git ls-remote behavior.
  - git_diff_patchid() lets you generate patch IDs for diffs.
  - git_status_options now has an additional field baseline to
    allow creating status lists against different trees.
  - New family of functions to allow creating notes for a
    specific notes commit instead of for a notes reference.
  - New family of functions to allow parsing message trailers.
    This API is still experimental and may change in future
    releases.
  - Breaking API changes
  - Signatures now distinguish between +0000 and -0000 UTC offsets.
  - The certificate check callback in the WinHTTP transport will
    now receive the message_cb_payload instead of the
    cred_acquire_payload.
  - We are now reading symlinked directories under .git/refs.
  - We now refuse creating branches named "HEAD".
  - We now refuse reading and writing all-zero object IDs into
    the object database.
  - We now read the effective user's configuration file instead
    of the real user's configuration in case libgit2 runs as part
    of a setuid binary.
  - The git_odb_open_rstream function and its readstream callback
    in the git_odb_backend interface have changed their
    signatures to allow providing the object's size and type to
    the caller.</changelog>
  <changelog author="astieger@suse.com" date="1531224000">- libgit2 0.27.3:
  * CVE-2018-10887 (bsc#1100613), CVE-2018-10888 (bsc#1100612):
    Specially crafted delta object in packfiles could trigger an
    integer overflow, bypassing input validation and causing the
    object database to contain copies of system memory. This may
    allow denial of service or, potentially, an information leak
- includes changes from 0.27.2:
  * various API and correctnes fixes
  * Fixes related to handling of .gitmodules
- includes changes from 0.27.1:
  * CVE-2018-11235: insufficient validation of submodule names from
    .gitmodules allowed writes to arbitrary paths (bsc#1095219)
  * disallow .gitmodules files as symlinks.</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- libgit2 0.27.4:
  * fix out-of-bounds reads when processing smart-protocol "ng"
    packets (bsc#1104641)</changelog>
  <changelog author="mpluskal@suse.com" date="1534852800">- Use pkgconfig style of dependencies, refresh dependencies
- Use more of cmake macros</changelog>
  <changelog author="astieger@suse.com" date="1538913600">- libgit2 0.27.5:
  * CVE-2018-17456: Submodule URLs and paths with a leading "-"
    are now ignored to avoid injecting options into library
    consumers that perform recursive clones (bsc#1110949)
  * Avoid a buffer overflow when running repack
  * Avoid stack overflow from unbounded recursion in configuration
    file parser
  * Avoid heap-buffer overflow when parsing "ok" packets
  * Fix heap-buffer overflows in smart protocol parsing code
  * Fix potential integer overflows on platforms with 16 bit ints
  * Fix potential NULL pointer dereference when parsing
    configuration files</changelog>
  <changelog author="astieger@suse.com" date="1541419200">- libgit2 0.27.7:
  * Various improvements for handling repositories
  * Various API correctness fixes
- includes changess from 0.27.6:
  * Various security fixes for parsing integers from buffers,
    and buffer handling bsc#1114729</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550059200">- Update to version 0.28.0:
  * Changes or improvements:
  - The library is now always built with cdecl calling
    conventions on Windows; the ability to build a stdcall
    library has been removed.
  - Reference log creation now honors
    core.logallrefupdates=always.
  - Fix some issues with the error-reporting in the OpenSSL
    backend.
  - HTTP proxy support is now builtin; libcurl is no longer used
    to support proxies and is removed as a dependency.
  - Certificate and credential callbacks can now return
    GIT_PASSTHROUGH to decline to act; libgit2 will behave as if
    there was no callback set in the first place.
  - The line-ending filtering logic - when checking out files -
    has been updated to match newer git (&gt;= git 2.9) for proper
    interoperability.
  - Symbolic links are now supported on Windows when
    core.symlinks is set to true.
  - Submodules with names which attempt to perform path traversal
    now have their configuration ignored. Such names were blindly
    appended to the $GIT_DIR/modules and a malicious name could
    lead to an attacker writing to an arbitrary location. This
    matches git's handling of CVE-2018-11235.
  - Object validation is now performed during tree creation in
    the git_index_write_tree_to API.
  - Configuration variable may now be specified on the same line
    as a section header; previously this was erroneously a parser
    error.
  - When an HTTP server supports both NTLM and Negotiate
    authentication mechanisms, we would previously fail to
    authenticate with any mechanism.
  - The GIT_OPT_SET_PACK_MAX_OBJECTS option can now set the
    maximum number of objects allowed in a packfile being
    downloaded; this can help limit the maximum memory used when
    fetching from an untrusted remote.
  - Line numbers in diffs loaded from patch files were not being
    populated; they are now included in the results.
  - The repository's index is reloaded from disk at the beginning
    of git_merge operations to ensure that it is up-to-date.
  - Mailmap handling APIs have been introduced, and the new
    commit APIs git_commit_committer_with_mailmap and
    git_commit_author_with_mailmap will use the mailmap to
    resolve the committer and author information. In addition,
    blame will use the mailmap given when the
    GIT_BLAME_USE_MAILMAP option.
  - Ignore handling for files in ignored folders would be
    ignored.
  - Worktrees can now be backed by bare repositories.
  - Trailing spaces are supported in .gitignore files, these
    spaces were previously (and erroneously) treated as part of
    the pattern.
  - The library can now be built with mbedTLS support for HTTPS.
  - The diff status character 'T' will now be presented by the
    git_diff_status_char API for diff entries that change type.
  - Revision walks previously would sometimes include commits
    that should have been ignored; this is corrected.
  - Revision walks are now more efficient when the output is
    unsorted; we now avoid walking all the way to the beginning
    of history unnecessarily.
  - Error-handling around index extension loading has been fixed.
    We were previously always misreporting a truncated index.
  * API additions:
  - The index may now be iterated atomically using
    git_index_iterator.
  - Remote objects can now be created with extended options using
    the git_remote_create_with_opts API.
  - Diff objects can now be applied as changes to the working
    directory, index or both, emulating the git apply command.
    Additionally, git_apply_to_tree can apply those changes to a
    tree object as a fully in-memory operation.
  - You can now swap out memory allocators via the
    GIT_OPT_SET_ALLOCATOR option with git_libgit2_opts().
  - You can now ensure that functions do not discard unwritten
    changes to the index via the
    GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY option to
    git_libgit2_opts(). This will cause functions that implicitly
    re-read the index (eg, git_checkout) to fail if you have
    staged changes to the index but you have not written the
    index to disk. (Unless the checkout has the FORCE flag
    specified.)
  - At present, this defaults to off, but we intend to enable
    this more broadly in the future, as a warning or error. We
    encourage you to examine your code to ensure that you are not
    relying on the current behavior that implicitly removes
    staged changes.
  - Reference specifications can be parsed from an arbitrary
    string with the git_refspec_parse API.
  - You can now get the name and path of worktrees using the
    git_worktree_name and git_worktree_path APIs, respectively.
  - The ref field has been added to git_worktree_add_options to
    enable the creation of a worktree from a pre-existing branch.
  - It's now possible to analyze merge relationships between any
    two references, not just against HEAD, using
    git_merge_analysis_for_ref.
  * API removals:
  - The git_buf_free API is deprecated; it has been renamed to
    git_buf_dispose for consistency. The git_buf_free API will be
    retained for backward compatibility for the foreseeable
    future.
  - The git_otype enumeration and its members are deprecated and
    have been renamed for consistency. The GIT_OBJ_ enumeration
    values are now prefixed with GIT_OBJECT_. The old
    enumerations and macros will be retained for backward
    compatibility for the foreseeable future.
  - Several index-related APIs have been renamed for consistency.
    The GIT_IDXENTRY_ enumeration values and macros have been
    renamed to be prefixed with GIT_INDEX_ENTRY_. The
    GIT_INDEXCAP enumeration values are now prefixed with
    GIT_INDEX_CAPABILITY_. The old enumerations and macros will
    be retained for backward compatibility for the foreseeable
    future.
  - The error functions and enumeration values have been renamed
    for consistency. The giterr_ functions and values prefix have
    been renamed to be prefixed with git_error_; similarly,
    the GITERR_ constants have been renamed to be prefixed with
    GIT_ERROR_. The old enumerations and macros will be retained
    for backward compatibility for the foreseeable future.
  * Breaking API changes:
  - The default checkout strategy changed from DRY_RUN to SAFE.
  - Adding a symlink as .gitmodules into the index from the
    workdir or checking out such files is not allowed as this can
    make a Git implementation write outside of the repository and
    bypass the fsck checks for CVE-2018-11235.
- Bump sover to 28 following upstreams changes.</changelog>
  <changelog author="mrueckert@suse.de" date="1550145600">-  Update to version 0.28.1:
  - The deprecated functions (git_buf_free and the giterr_ family
    of functions) are now exported properly. In the v0.28 release,
    they were not given the correct external attributes and they
    did not have the correct linkage visibility in the v0.28
    library.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 0.28.2:
  * Fix include directory ordering when using bundled dependencies.
  * Fix infinite loop when searching for a non-existing repository with
    Windows-style paths including drive prefixes.
  * Fix symlinks to directories on Windows.
  * Fix paths with a trailing "/" not always being treated as
    directories when computing ignores.
  * Fix false negatives when computing ignores where ignore rules
    that are a prefix to a negative ignore rule exist.
  * Fix patches with CRLF line endings not being parsed correctly.
  * Fix segfault when parsing patches with file addition (deletion)
    where the added (deleted) file name contains a space.
  * Fix assertion failure when trying to write to a non-existent
    locked configuration file.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065600">- libgit2 0.28.3:
  * A carefully constructed commit object with a very large number
    of parents may have lead to out-of-bounds writes or potential
    denial of service (boo#1158981)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065601">- libgit2 0.28.4:
  * CVE-2019-1348: the fast-import stream command "feature
    export-marks=path" allows writing to arbitrary file paths. As
    libgit2 does not offer any interface for fast-import, it is not
    susceptible to this vulnerability. (boo#1158785)
  * CVE-2019-1349: by using NTFS 8.3 short names, backslashes or
    alternate filesystreams, it is possible to cause submodules to
    be written into pre-existing directories during a recursive
    clone using git. As libgit2 rejects cloning into non-empty
    directories by default, it is not susceptible to this
    vulnerability. (boo#1158787)
  * CVE-2019-1350: recursive clones may lead to arbitrary remote
    code executing due to improper quoting of command line
    arguments. As libgit2 uses libssh2, which does not require us
    to perform command line parsing, it is not susceptible to this
    vulnerability. (boo#1158788)
  * CVE-2019-1351: Windows provides the ability to substitute
    drive letters with arbitrary letters, including multi-byte
    Unicode letters. To fix any potential issues arising from
    interpreting such paths as relative paths, we have extended
    detection of DOS drive prefixes to accomodate for such cases.
    (boo#1158790)
  * CVE-2019-1352: by using NTFS-style alternative file streams for
    the ".git" directory, it is possible to overwrite parts of the
    repository. While this has been fixed in the past for Windows,
    the same vulnerability may also exist on other systems that
    write to NTFS filesystems. We now reject any paths starting
    with ".git:" on all systems. (boo#1158790)
  * CVE-2019-1353: by using NTFS-style 8.3 short names, it was
    possible to write to the ".git" directory and thus overwrite
    parts of the repository, leading to possible remote code
    execution. While this problem was already fixed in the past for
    Windows, other systems accessing NTFS filesystems are
    vulnerable to this issue too. We now enable NTFS protecions by
    default on all systems to fix this attack vector. (boo#1158791)
  * CVE-2019-1354: on Windows, backslashes are not a valid part of
    a filename but are instead interpreted as directory separators.
    As other platforms allowed to use such paths, it was possible
    to write such invalid entries into a Git repository and was
    thus an attack vector to write into the ".git" dierctory. We
    now reject any entries starting with ".git" on all systems.
    (boo#1158792)
  * CVE-2019-1387: it is possible to let a submodule's git
    directory point into a sibling's submodule directory, which may
    result in overwriting parts of the Git repository and thus lead
    to arbitrary command execution. As libgit2 doesn't provide any
    way to do submodule clones natively, it is not susceptible to
    this vulnerability. Users of libgit2 that have implemented
    recursive submodule clones manually are encouraged to review
    their implementation for this vulnerability. (boo#1158793)</changelog>
  <changelog author="alarrosa@suse.com" date="1661342400">- Add patches backported from the upstream v1.3 branch to fix
  CVE-2022-29187, CVE-2022-24765 (bsc#1201431, bsc#1198234):
  * 0001-buffer-git_buf_sanitize-should-return-a-value.patch
  * 0001-path-refactor-ownership-checks-into-current-user-and.patch
  * 0002-repo-ensure-that-repo-dir-is-owned-by-current-user.patch
  * 0003-fs_path-mock-ownership-checks.patch
  * 0004-repo-test-configuration-ownership-validation.patch
  * 0005-repo-refactor-global-config-loader-function.patch
  * 0006-repo-honor-safe.directory-during-ownership-checks.patch
  * 0007-repo-make-ownership-checks-optional.patch
  * 0010-revparse-Remove-error-prone-redundant-test.patch
  * 0014-repo-add-tests-for-bare-repo-permissions.patch
  * 0015-fs-remove-mock-naming-from-change-ownership-constant.patch
  * 0016-fs-refactor-file-ownership-checks.patch
  * 0017-fs-allow-ownership-match-if-user-is-in-admin-group.patch
  * 0018-repo-allow-admin-owned-configs-by-admin-users.patch
  * 0019-repo-validate-gitdir-and-gitlink-ownership.patch
  * 0020-repo-allow-users-running-with-sudo-to-access-their-r.patch</changelog>
  <changelog author="mgorse@suse.com" date="1678968000">- Backport patches from the 1.4 branch to verify ssh remote host
  keys (boo#1207364 CVE-2023-22742):
  0001-ssh-verify-the-remote-s-host-key-against-known_hosts.patch
  0002-tests-append-the-github.com-ssh-keys-so-we-have-acce.patch
  0003-tests-move-online-clone-ssh_auth_methods-into-the-ss.patch
  0004-ssh-look-for-a-key-in-known_hosts-to-set-the-key-typ.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217600">- Address boo#1219660 CVE-2024-24577:
  0021-fix-slash-in-index-for-git_index_add.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217601">- Fixing 0021-fix-slash-in-index-for-git_index_add.patch to use
  '*slash' vs. '*--slash'</changelog>
</package>
<package pkgid="3daa81e6a7e368c1f4bb480503ec76574d51bb2eeddf14668c494264a7595ceb" name="libgit2-devel" arch="aarch64">
  <version epoch="0" ver="0.28.4" rel="150400.3.11.1"/>
  <changelog author="astieger@suse.com" date="1484136000">- libgit2 0.25.1
- New features and functionality:
  * repository discovery features
  * Support for reading and writing git index v4 files
  * Improve the performance of the revwalk
  * reference db concurrency improvements
  * Nanosecond resolution is now activated by default
  * restrict the set of ciphers used with OpenSSL by default.
  * user-registered merge drivers
  * built-in support for the union merge driver
  * callers can now specify proxy settings
  * New API for creating signed commits
  * New API for creating blobs from streams
  * New flags for opening repositories
  * New functions for various git operations
- Removed API:
  * git_blob_create_fromchunks() has been removed in  favour of
    git_blob_create_fromstream()
- Changed API:
  * git_packbuilder_object_count and git_packbuilder_written now
    return a size_t instead of a uint32_t for more thorough
    compatibility with the rest of the library.
  * git_packbuiler_progress now provides explicitly sized uint32_t
    values instead of unsigned int.
  * git_diff_file now includes an id_abbrev field that reflects the
    number of nibbles set in the id field.
  * git_odb_backend now has a freshen function pointer
  * git_remote_connect() now accepts proxy options.</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- libgit2 0.26.0:
  * Support for opening, creating and modifying worktrees.
  * Can now detect SHA1 collisions resulting from the SHAttered
    attack CVE-2005-4900
  * Fix for missing implementation of `git_merge_driver_source` getters
  * Fix for installed pkg-config file being broken when the prefix
    contains spaces
  * Can now detect when the hashsum of on-disk objects does not
    match their expected hashsum.
  * Support open-ended ranges (e.g. "master..", "...master") in
    revision range parsing code.
  * Correctly compute ignores with leading "/" in subdirectories.
  * Optionally call `fsync` on loose objects, packfiles and their
    indexes, loose references and packed reference files.
  * Builds against OpenSSL v1.1 and against LibreSSL.
  * Improvements for reading index v4 files.
  * API additions and incompatible API changes</changelog>
  <changelog author="mimi.vx@gmail.com" date="1510574400">- remove unneeded dependency (python is used only for testsuite, which
    isn't used during build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="kbabioch@suse.com" date="1521028800">- Update to 0.26.3:
  * Fix cloning of the libgit2 project with git clone --recursive by removing an
    invalid submodule from our testing data.
  * Fix endianness of the port in p_getaddrinfo().
  * Fix handling of negative gitignore rules with wildcards.
  * Fix handling of case-insensitive negative gitignore rules.
  * Fix resolving references to a tag if the reference is stored with its fully
    resolved OID in the packed-refs file.
  * Fix checkout not treating worktree files as modified when only their mode has
    changed.
  * Fix rename detection with GIT_DIFF_FIND_RENAMES_FROM_REWRITES.
  * Fixes memory handling issues when reading crafted repository index files.
    The issues allow for possible denial of service due to allocation of large
    memory and out-of-bound reads.
    (CVE-2018-8098 bnc#1085257 CVE-2018-8099 bnc#1085256)
  * Updates the bundled zlib to 1.2.11. Users who build the bundled zlib are
    vulnerable to security issues in the prior version.</changelog>
  <changelog author="mrueckert@suse.de" date="1524484800">- update to 0.27.0:
  - Changes or improvements
  - Improved p_unlink in posix_w32.c to try and make a file
    writable before sleeping in the retry loop to prevent
    unnecessary calls to sleep.
  - The CMake build infrastructure has been improved to speed up
    building time.
  - A new CMake option "-DUSE_HTTPS=" makes it possible to
    explicitly choose an HTTP backend.
  - A new CMake option "-DSHA1_BACKEND=" makes it possible to
    explicitly choose an SHA1 backend. The collision-detecting
    backend is now the default.
  - A new CMake option "-DUSE_BUNDLED_ZLIB" makes it possible to
    explicitly use the bundled zlib library.
  - A new CMake option "-DENABLE_REPRODUCIBLE_BUILDS" makes it
    possible to generate a reproducible static archive. This
    requires support from your toolchain.
  - The minimum required CMake version has been bumped to 2.8.11.
  - Writing to a configuration file now preserves the case of the
    key given by the caller for the case-insensitive portions of
    the key (existing sections are used even if they don't
    match).
  - We now support conditional includes in configuration files.
  - Fix for handling re-reading of configuration files with
    includes.
  - Fix for reading patches which contain exact renames only.
  - Fix for reading patches with whitespace in the compared
    files' paths.
  - We will now fill FETCH_HEAD from all passed refspecs instead
    of overwriting with the last one.
  - There is a new diff option, GIT_DIFF_INDENT_HEURISTIC which
    activates a heuristic which takes into account whitespace and
    indentation in order to produce better diffs when dealing
    with ambiguous diff hunks.
  - Fix for pattern-based ignore rules where files ignored by a
    rule cannot be un-ignored by another rule.
  - Sockets opened by libgit2 are now being closed on exec(3) if
    the platform supports it.
  - Fix for peeling annotated tags from packed-refs files.
  - Fix reading huge loose objects from the object database.
  - Fix files not being treated as modified when only the file
    mode has changed.
  - We now explicitly reject adding submodules to the index via
    git_index_add_frombuffer.
  - Fix handling of GIT_DIFF_FIND_RENAMES_FROM_REWRITES raising
    SIGABRT when one file has been deleted and another file has
    been rewritten.
  - Fix for WinHTTP not properly handling NTLM and Negotiate
    challenges.
  - When using SSH-based transports, we now repeatedly ask for
    the passphrase to decrypt the private key in case a wrong
    passphrase is being provided.
  - When generating conflict markers, they will now use the same
    line endings as the rest of the file.
  - API additions
  - The git_merge_file_options structure now contains a new
    setting, marker_size. This allows users to set the size of
    markers that delineate the sides of merged files in the
    output conflict file.  By default this is 7
    (GIT_MERGE_CONFLICT_MARKER_SIZE), which produces output
    markers like &lt;&lt;&lt;&lt;&lt;&lt;&lt; and &gt;&gt;&gt;&gt;&gt;&gt;&gt;.
  - git_remote_create_detached() creates a remote that is not
    associated to any repository (and does not apply
    configuration like 'insteadof' rules).  This is mostly useful
    for e.g. emulating git ls-remote behavior.
  - git_diff_patchid() lets you generate patch IDs for diffs.
  - git_status_options now has an additional field baseline to
    allow creating status lists against different trees.
  - New family of functions to allow creating notes for a
    specific notes commit instead of for a notes reference.
  - New family of functions to allow parsing message trailers.
    This API is still experimental and may change in future
    releases.
  - Breaking API changes
  - Signatures now distinguish between +0000 and -0000 UTC offsets.
  - The certificate check callback in the WinHTTP transport will
    now receive the message_cb_payload instead of the
    cred_acquire_payload.
  - We are now reading symlinked directories under .git/refs.
  - We now refuse creating branches named "HEAD".
  - We now refuse reading and writing all-zero object IDs into
    the object database.
  - We now read the effective user's configuration file instead
    of the real user's configuration in case libgit2 runs as part
    of a setuid binary.
  - The git_odb_open_rstream function and its readstream callback
    in the git_odb_backend interface have changed their
    signatures to allow providing the object's size and type to
    the caller.</changelog>
  <changelog author="astieger@suse.com" date="1531224000">- libgit2 0.27.3:
  * CVE-2018-10887 (bsc#1100613), CVE-2018-10888 (bsc#1100612):
    Specially crafted delta object in packfiles could trigger an
    integer overflow, bypassing input validation and causing the
    object database to contain copies of system memory. This may
    allow denial of service or, potentially, an information leak
- includes changes from 0.27.2:
  * various API and correctnes fixes
  * Fixes related to handling of .gitmodules
- includes changes from 0.27.1:
  * CVE-2018-11235: insufficient validation of submodule names from
    .gitmodules allowed writes to arbitrary paths (bsc#1095219)
  * disallow .gitmodules files as symlinks.</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- libgit2 0.27.4:
  * fix out-of-bounds reads when processing smart-protocol "ng"
    packets (bsc#1104641)</changelog>
  <changelog author="mpluskal@suse.com" date="1534852800">- Use pkgconfig style of dependencies, refresh dependencies
- Use more of cmake macros</changelog>
  <changelog author="astieger@suse.com" date="1538913600">- libgit2 0.27.5:
  * CVE-2018-17456: Submodule URLs and paths with a leading "-"
    are now ignored to avoid injecting options into library
    consumers that perform recursive clones (bsc#1110949)
  * Avoid a buffer overflow when running repack
  * Avoid stack overflow from unbounded recursion in configuration
    file parser
  * Avoid heap-buffer overflow when parsing "ok" packets
  * Fix heap-buffer overflows in smart protocol parsing code
  * Fix potential integer overflows on platforms with 16 bit ints
  * Fix potential NULL pointer dereference when parsing
    configuration files</changelog>
  <changelog author="astieger@suse.com" date="1541419200">- libgit2 0.27.7:
  * Various improvements for handling repositories
  * Various API correctness fixes
- includes changess from 0.27.6:
  * Various security fixes for parsing integers from buffers,
    and buffer handling bsc#1114729</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550059200">- Update to version 0.28.0:
  * Changes or improvements:
  - The library is now always built with cdecl calling
    conventions on Windows; the ability to build a stdcall
    library has been removed.
  - Reference log creation now honors
    core.logallrefupdates=always.
  - Fix some issues with the error-reporting in the OpenSSL
    backend.
  - HTTP proxy support is now builtin; libcurl is no longer used
    to support proxies and is removed as a dependency.
  - Certificate and credential callbacks can now return
    GIT_PASSTHROUGH to decline to act; libgit2 will behave as if
    there was no callback set in the first place.
  - The line-ending filtering logic - when checking out files -
    has been updated to match newer git (&gt;= git 2.9) for proper
    interoperability.
  - Symbolic links are now supported on Windows when
    core.symlinks is set to true.
  - Submodules with names which attempt to perform path traversal
    now have their configuration ignored. Such names were blindly
    appended to the $GIT_DIR/modules and a malicious name could
    lead to an attacker writing to an arbitrary location. This
    matches git's handling of CVE-2018-11235.
  - Object validation is now performed during tree creation in
    the git_index_write_tree_to API.
  - Configuration variable may now be specified on the same line
    as a section header; previously this was erroneously a parser
    error.
  - When an HTTP server supports both NTLM and Negotiate
    authentication mechanisms, we would previously fail to
    authenticate with any mechanism.
  - The GIT_OPT_SET_PACK_MAX_OBJECTS option can now set the
    maximum number of objects allowed in a packfile being
    downloaded; this can help limit the maximum memory used when
    fetching from an untrusted remote.
  - Line numbers in diffs loaded from patch files were not being
    populated; they are now included in the results.
  - The repository's index is reloaded from disk at the beginning
    of git_merge operations to ensure that it is up-to-date.
  - Mailmap handling APIs have been introduced, and the new
    commit APIs git_commit_committer_with_mailmap and
    git_commit_author_with_mailmap will use the mailmap to
    resolve the committer and author information. In addition,
    blame will use the mailmap given when the
    GIT_BLAME_USE_MAILMAP option.
  - Ignore handling for files in ignored folders would be
    ignored.
  - Worktrees can now be backed by bare repositories.
  - Trailing spaces are supported in .gitignore files, these
    spaces were previously (and erroneously) treated as part of
    the pattern.
  - The library can now be built with mbedTLS support for HTTPS.
  - The diff status character 'T' will now be presented by the
    git_diff_status_char API for diff entries that change type.
  - Revision walks previously would sometimes include commits
    that should have been ignored; this is corrected.
  - Revision walks are now more efficient when the output is
    unsorted; we now avoid walking all the way to the beginning
    of history unnecessarily.
  - Error-handling around index extension loading has been fixed.
    We were previously always misreporting a truncated index.
  * API additions:
  - The index may now be iterated atomically using
    git_index_iterator.
  - Remote objects can now be created with extended options using
    the git_remote_create_with_opts API.
  - Diff objects can now be applied as changes to the working
    directory, index or both, emulating the git apply command.
    Additionally, git_apply_to_tree can apply those changes to a
    tree object as a fully in-memory operation.
  - You can now swap out memory allocators via the
    GIT_OPT_SET_ALLOCATOR option with git_libgit2_opts().
  - You can now ensure that functions do not discard unwritten
    changes to the index via the
    GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY option to
    git_libgit2_opts(). This will cause functions that implicitly
    re-read the index (eg, git_checkout) to fail if you have
    staged changes to the index but you have not written the
    index to disk. (Unless the checkout has the FORCE flag
    specified.)
  - At present, this defaults to off, but we intend to enable
    this more broadly in the future, as a warning or error. We
    encourage you to examine your code to ensure that you are not
    relying on the current behavior that implicitly removes
    staged changes.
  - Reference specifications can be parsed from an arbitrary
    string with the git_refspec_parse API.
  - You can now get the name and path of worktrees using the
    git_worktree_name and git_worktree_path APIs, respectively.
  - The ref field has been added to git_worktree_add_options to
    enable the creation of a worktree from a pre-existing branch.
  - It's now possible to analyze merge relationships between any
    two references, not just against HEAD, using
    git_merge_analysis_for_ref.
  * API removals:
  - The git_buf_free API is deprecated; it has been renamed to
    git_buf_dispose for consistency. The git_buf_free API will be
    retained for backward compatibility for the foreseeable
    future.
  - The git_otype enumeration and its members are deprecated and
    have been renamed for consistency. The GIT_OBJ_ enumeration
    values are now prefixed with GIT_OBJECT_. The old
    enumerations and macros will be retained for backward
    compatibility for the foreseeable future.
  - Several index-related APIs have been renamed for consistency.
    The GIT_IDXENTRY_ enumeration values and macros have been
    renamed to be prefixed with GIT_INDEX_ENTRY_. The
    GIT_INDEXCAP enumeration values are now prefixed with
    GIT_INDEX_CAPABILITY_. The old enumerations and macros will
    be retained for backward compatibility for the foreseeable
    future.
  - The error functions and enumeration values have been renamed
    for consistency. The giterr_ functions and values prefix have
    been renamed to be prefixed with git_error_; similarly,
    the GITERR_ constants have been renamed to be prefixed with
    GIT_ERROR_. The old enumerations and macros will be retained
    for backward compatibility for the foreseeable future.
  * Breaking API changes:
  - The default checkout strategy changed from DRY_RUN to SAFE.
  - Adding a symlink as .gitmodules into the index from the
    workdir or checking out such files is not allowed as this can
    make a Git implementation write outside of the repository and
    bypass the fsck checks for CVE-2018-11235.
- Bump sover to 28 following upstreams changes.</changelog>
  <changelog author="mrueckert@suse.de" date="1550145600">-  Update to version 0.28.1:
  - The deprecated functions (git_buf_free and the giterr_ family
    of functions) are now exported properly. In the v0.28 release,
    they were not given the correct external attributes and they
    did not have the correct linkage visibility in the v0.28
    library.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 0.28.2:
  * Fix include directory ordering when using bundled dependencies.
  * Fix infinite loop when searching for a non-existing repository with
    Windows-style paths including drive prefixes.
  * Fix symlinks to directories on Windows.
  * Fix paths with a trailing "/" not always being treated as
    directories when computing ignores.
  * Fix false negatives when computing ignores where ignore rules
    that are a prefix to a negative ignore rule exist.
  * Fix patches with CRLF line endings not being parsed correctly.
  * Fix segfault when parsing patches with file addition (deletion)
    where the added (deleted) file name contains a space.
  * Fix assertion failure when trying to write to a non-existent
    locked configuration file.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065600">- libgit2 0.28.3:
  * A carefully constructed commit object with a very large number
    of parents may have lead to out-of-bounds writes or potential
    denial of service (boo#1158981)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065601">- libgit2 0.28.4:
  * CVE-2019-1348: the fast-import stream command "feature
    export-marks=path" allows writing to arbitrary file paths. As
    libgit2 does not offer any interface for fast-import, it is not
    susceptible to this vulnerability. (boo#1158785)
  * CVE-2019-1349: by using NTFS 8.3 short names, backslashes or
    alternate filesystreams, it is possible to cause submodules to
    be written into pre-existing directories during a recursive
    clone using git. As libgit2 rejects cloning into non-empty
    directories by default, it is not susceptible to this
    vulnerability. (boo#1158787)
  * CVE-2019-1350: recursive clones may lead to arbitrary remote
    code executing due to improper quoting of command line
    arguments. As libgit2 uses libssh2, which does not require us
    to perform command line parsing, it is not susceptible to this
    vulnerability. (boo#1158788)
  * CVE-2019-1351: Windows provides the ability to substitute
    drive letters with arbitrary letters, including multi-byte
    Unicode letters. To fix any potential issues arising from
    interpreting such paths as relative paths, we have extended
    detection of DOS drive prefixes to accomodate for such cases.
    (boo#1158790)
  * CVE-2019-1352: by using NTFS-style alternative file streams for
    the ".git" directory, it is possible to overwrite parts of the
    repository. While this has been fixed in the past for Windows,
    the same vulnerability may also exist on other systems that
    write to NTFS filesystems. We now reject any paths starting
    with ".git:" on all systems. (boo#1158790)
  * CVE-2019-1353: by using NTFS-style 8.3 short names, it was
    possible to write to the ".git" directory and thus overwrite
    parts of the repository, leading to possible remote code
    execution. While this problem was already fixed in the past for
    Windows, other systems accessing NTFS filesystems are
    vulnerable to this issue too. We now enable NTFS protecions by
    default on all systems to fix this attack vector. (boo#1158791)
  * CVE-2019-1354: on Windows, backslashes are not a valid part of
    a filename but are instead interpreted as directory separators.
    As other platforms allowed to use such paths, it was possible
    to write such invalid entries into a Git repository and was
    thus an attack vector to write into the ".git" dierctory. We
    now reject any entries starting with ".git" on all systems.
    (boo#1158792)
  * CVE-2019-1387: it is possible to let a submodule's git
    directory point into a sibling's submodule directory, which may
    result in overwriting parts of the Git repository and thus lead
    to arbitrary command execution. As libgit2 doesn't provide any
    way to do submodule clones natively, it is not susceptible to
    this vulnerability. Users of libgit2 that have implemented
    recursive submodule clones manually are encouraged to review
    their implementation for this vulnerability. (boo#1158793)</changelog>
  <changelog author="alarrosa@suse.com" date="1661342400">- Add patches backported from the upstream v1.3 branch to fix
  CVE-2022-29187, CVE-2022-24765 (bsc#1201431, bsc#1198234):
  * 0001-buffer-git_buf_sanitize-should-return-a-value.patch
  * 0001-path-refactor-ownership-checks-into-current-user-and.patch
  * 0002-repo-ensure-that-repo-dir-is-owned-by-current-user.patch
  * 0003-fs_path-mock-ownership-checks.patch
  * 0004-repo-test-configuration-ownership-validation.patch
  * 0005-repo-refactor-global-config-loader-function.patch
  * 0006-repo-honor-safe.directory-during-ownership-checks.patch
  * 0007-repo-make-ownership-checks-optional.patch
  * 0010-revparse-Remove-error-prone-redundant-test.patch
  * 0014-repo-add-tests-for-bare-repo-permissions.patch
  * 0015-fs-remove-mock-naming-from-change-ownership-constant.patch
  * 0016-fs-refactor-file-ownership-checks.patch
  * 0017-fs-allow-ownership-match-if-user-is-in-admin-group.patch
  * 0018-repo-allow-admin-owned-configs-by-admin-users.patch
  * 0019-repo-validate-gitdir-and-gitlink-ownership.patch
  * 0020-repo-allow-users-running-with-sudo-to-access-their-r.patch</changelog>
  <changelog author="mgorse@suse.com" date="1678968000">- Backport patches from the 1.4 branch to verify ssh remote host
  keys (boo#1207364 CVE-2023-22742):
  0001-ssh-verify-the-remote-s-host-key-against-known_hosts.patch
  0002-tests-append-the-github.com-ssh-keys-so-we-have-acce.patch
  0003-tests-move-online-clone-ssh_auth_methods-into-the-ss.patch
  0004-ssh-look-for-a-key-in-known_hosts-to-set-the-key-typ.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217600">- Address boo#1219660 CVE-2024-24577:
  0021-fix-slash-in-index-for-git_index_add.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217601">- Fixing 0021-fix-slash-in-index-for-git_index_add.patch to use
  '*slash' vs. '*--slash'</changelog>
</package>
<package pkgid="64d6f1beeda5489d4acf81b6154419590b584479d6b5024c6c0b453640f813b3" name="libgit2-devel" arch="ppc64le">
  <version epoch="0" ver="0.28.4" rel="150400.3.11.1"/>
  <changelog author="astieger@suse.com" date="1484136000">- libgit2 0.25.1
- New features and functionality:
  * repository discovery features
  * Support for reading and writing git index v4 files
  * Improve the performance of the revwalk
  * reference db concurrency improvements
  * Nanosecond resolution is now activated by default
  * restrict the set of ciphers used with OpenSSL by default.
  * user-registered merge drivers
  * built-in support for the union merge driver
  * callers can now specify proxy settings
  * New API for creating signed commits
  * New API for creating blobs from streams
  * New flags for opening repositories
  * New functions for various git operations
- Removed API:
  * git_blob_create_fromchunks() has been removed in  favour of
    git_blob_create_fromstream()
- Changed API:
  * git_packbuilder_object_count and git_packbuilder_written now
    return a size_t instead of a uint32_t for more thorough
    compatibility with the rest of the library.
  * git_packbuiler_progress now provides explicitly sized uint32_t
    values instead of unsigned int.
  * git_diff_file now includes an id_abbrev field that reflects the
    number of nibbles set in the id field.
  * git_odb_backend now has a freshen function pointer
  * git_remote_connect() now accepts proxy options.</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- libgit2 0.26.0:
  * Support for opening, creating and modifying worktrees.
  * Can now detect SHA1 collisions resulting from the SHAttered
    attack CVE-2005-4900
  * Fix for missing implementation of `git_merge_driver_source` getters
  * Fix for installed pkg-config file being broken when the prefix
    contains spaces
  * Can now detect when the hashsum of on-disk objects does not
    match their expected hashsum.
  * Support open-ended ranges (e.g. "master..", "...master") in
    revision range parsing code.
  * Correctly compute ignores with leading "/" in subdirectories.
  * Optionally call `fsync` on loose objects, packfiles and their
    indexes, loose references and packed reference files.
  * Builds against OpenSSL v1.1 and against LibreSSL.
  * Improvements for reading index v4 files.
  * API additions and incompatible API changes</changelog>
  <changelog author="mimi.vx@gmail.com" date="1510574400">- remove unneeded dependency (python is used only for testsuite, which
    isn't used during build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="kbabioch@suse.com" date="1521028800">- Update to 0.26.3:
  * Fix cloning of the libgit2 project with git clone --recursive by removing an
    invalid submodule from our testing data.
  * Fix endianness of the port in p_getaddrinfo().
  * Fix handling of negative gitignore rules with wildcards.
  * Fix handling of case-insensitive negative gitignore rules.
  * Fix resolving references to a tag if the reference is stored with its fully
    resolved OID in the packed-refs file.
  * Fix checkout not treating worktree files as modified when only their mode has
    changed.
  * Fix rename detection with GIT_DIFF_FIND_RENAMES_FROM_REWRITES.
  * Fixes memory handling issues when reading crafted repository index files.
    The issues allow for possible denial of service due to allocation of large
    memory and out-of-bound reads.
    (CVE-2018-8098 bnc#1085257 CVE-2018-8099 bnc#1085256)
  * Updates the bundled zlib to 1.2.11. Users who build the bundled zlib are
    vulnerable to security issues in the prior version.</changelog>
  <changelog author="mrueckert@suse.de" date="1524484800">- update to 0.27.0:
  - Changes or improvements
  - Improved p_unlink in posix_w32.c to try and make a file
    writable before sleeping in the retry loop to prevent
    unnecessary calls to sleep.
  - The CMake build infrastructure has been improved to speed up
    building time.
  - A new CMake option "-DUSE_HTTPS=" makes it possible to
    explicitly choose an HTTP backend.
  - A new CMake option "-DSHA1_BACKEND=" makes it possible to
    explicitly choose an SHA1 backend. The collision-detecting
    backend is now the default.
  - A new CMake option "-DUSE_BUNDLED_ZLIB" makes it possible to
    explicitly use the bundled zlib library.
  - A new CMake option "-DENABLE_REPRODUCIBLE_BUILDS" makes it
    possible to generate a reproducible static archive. This
    requires support from your toolchain.
  - The minimum required CMake version has been bumped to 2.8.11.
  - Writing to a configuration file now preserves the case of the
    key given by the caller for the case-insensitive portions of
    the key (existing sections are used even if they don't
    match).
  - We now support conditional includes in configuration files.
  - Fix for handling re-reading of configuration files with
    includes.
  - Fix for reading patches which contain exact renames only.
  - Fix for reading patches with whitespace in the compared
    files' paths.
  - We will now fill FETCH_HEAD from all passed refspecs instead
    of overwriting with the last one.
  - There is a new diff option, GIT_DIFF_INDENT_HEURISTIC which
    activates a heuristic which takes into account whitespace and
    indentation in order to produce better diffs when dealing
    with ambiguous diff hunks.
  - Fix for pattern-based ignore rules where files ignored by a
    rule cannot be un-ignored by another rule.
  - Sockets opened by libgit2 are now being closed on exec(3) if
    the platform supports it.
  - Fix for peeling annotated tags from packed-refs files.
  - Fix reading huge loose objects from the object database.
  - Fix files not being treated as modified when only the file
    mode has changed.
  - We now explicitly reject adding submodules to the index via
    git_index_add_frombuffer.
  - Fix handling of GIT_DIFF_FIND_RENAMES_FROM_REWRITES raising
    SIGABRT when one file has been deleted and another file has
    been rewritten.
  - Fix for WinHTTP not properly handling NTLM and Negotiate
    challenges.
  - When using SSH-based transports, we now repeatedly ask for
    the passphrase to decrypt the private key in case a wrong
    passphrase is being provided.
  - When generating conflict markers, they will now use the same
    line endings as the rest of the file.
  - API additions
  - The git_merge_file_options structure now contains a new
    setting, marker_size. This allows users to set the size of
    markers that delineate the sides of merged files in the
    output conflict file.  By default this is 7
    (GIT_MERGE_CONFLICT_MARKER_SIZE), which produces output
    markers like &lt;&lt;&lt;&lt;&lt;&lt;&lt; and &gt;&gt;&gt;&gt;&gt;&gt;&gt;.
  - git_remote_create_detached() creates a remote that is not
    associated to any repository (and does not apply
    configuration like 'insteadof' rules).  This is mostly useful
    for e.g. emulating git ls-remote behavior.
  - git_diff_patchid() lets you generate patch IDs for diffs.
  - git_status_options now has an additional field baseline to
    allow creating status lists against different trees.
  - New family of functions to allow creating notes for a
    specific notes commit instead of for a notes reference.
  - New family of functions to allow parsing message trailers.
    This API is still experimental and may change in future
    releases.
  - Breaking API changes
  - Signatures now distinguish between +0000 and -0000 UTC offsets.
  - The certificate check callback in the WinHTTP transport will
    now receive the message_cb_payload instead of the
    cred_acquire_payload.
  - We are now reading symlinked directories under .git/refs.
  - We now refuse creating branches named "HEAD".
  - We now refuse reading and writing all-zero object IDs into
    the object database.
  - We now read the effective user's configuration file instead
    of the real user's configuration in case libgit2 runs as part
    of a setuid binary.
  - The git_odb_open_rstream function and its readstream callback
    in the git_odb_backend interface have changed their
    signatures to allow providing the object's size and type to
    the caller.</changelog>
  <changelog author="astieger@suse.com" date="1531224000">- libgit2 0.27.3:
  * CVE-2018-10887 (bsc#1100613), CVE-2018-10888 (bsc#1100612):
    Specially crafted delta object in packfiles could trigger an
    integer overflow, bypassing input validation and causing the
    object database to contain copies of system memory. This may
    allow denial of service or, potentially, an information leak
- includes changes from 0.27.2:
  * various API and correctnes fixes
  * Fixes related to handling of .gitmodules
- includes changes from 0.27.1:
  * CVE-2018-11235: insufficient validation of submodule names from
    .gitmodules allowed writes to arbitrary paths (bsc#1095219)
  * disallow .gitmodules files as symlinks.</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- libgit2 0.27.4:
  * fix out-of-bounds reads when processing smart-protocol "ng"
    packets (bsc#1104641)</changelog>
  <changelog author="mpluskal@suse.com" date="1534852800">- Use pkgconfig style of dependencies, refresh dependencies
- Use more of cmake macros</changelog>
  <changelog author="astieger@suse.com" date="1538913600">- libgit2 0.27.5:
  * CVE-2018-17456: Submodule URLs and paths with a leading "-"
    are now ignored to avoid injecting options into library
    consumers that perform recursive clones (bsc#1110949)
  * Avoid a buffer overflow when running repack
  * Avoid stack overflow from unbounded recursion in configuration
    file parser
  * Avoid heap-buffer overflow when parsing "ok" packets
  * Fix heap-buffer overflows in smart protocol parsing code
  * Fix potential integer overflows on platforms with 16 bit ints
  * Fix potential NULL pointer dereference when parsing
    configuration files</changelog>
  <changelog author="astieger@suse.com" date="1541419200">- libgit2 0.27.7:
  * Various improvements for handling repositories
  * Various API correctness fixes
- includes changess from 0.27.6:
  * Various security fixes for parsing integers from buffers,
    and buffer handling bsc#1114729</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550059200">- Update to version 0.28.0:
  * Changes or improvements:
  - The library is now always built with cdecl calling
    conventions on Windows; the ability to build a stdcall
    library has been removed.
  - Reference log creation now honors
    core.logallrefupdates=always.
  - Fix some issues with the error-reporting in the OpenSSL
    backend.
  - HTTP proxy support is now builtin; libcurl is no longer used
    to support proxies and is removed as a dependency.
  - Certificate and credential callbacks can now return
    GIT_PASSTHROUGH to decline to act; libgit2 will behave as if
    there was no callback set in the first place.
  - The line-ending filtering logic - when checking out files -
    has been updated to match newer git (&gt;= git 2.9) for proper
    interoperability.
  - Symbolic links are now supported on Windows when
    core.symlinks is set to true.
  - Submodules with names which attempt to perform path traversal
    now have their configuration ignored. Such names were blindly
    appended to the $GIT_DIR/modules and a malicious name could
    lead to an attacker writing to an arbitrary location. This
    matches git's handling of CVE-2018-11235.
  - Object validation is now performed during tree creation in
    the git_index_write_tree_to API.
  - Configuration variable may now be specified on the same line
    as a section header; previously this was erroneously a parser
    error.
  - When an HTTP server supports both NTLM and Negotiate
    authentication mechanisms, we would previously fail to
    authenticate with any mechanism.
  - The GIT_OPT_SET_PACK_MAX_OBJECTS option can now set the
    maximum number of objects allowed in a packfile being
    downloaded; this can help limit the maximum memory used when
    fetching from an untrusted remote.
  - Line numbers in diffs loaded from patch files were not being
    populated; they are now included in the results.
  - The repository's index is reloaded from disk at the beginning
    of git_merge operations to ensure that it is up-to-date.
  - Mailmap handling APIs have been introduced, and the new
    commit APIs git_commit_committer_with_mailmap and
    git_commit_author_with_mailmap will use the mailmap to
    resolve the committer and author information. In addition,
    blame will use the mailmap given when the
    GIT_BLAME_USE_MAILMAP option.
  - Ignore handling for files in ignored folders would be
    ignored.
  - Worktrees can now be backed by bare repositories.
  - Trailing spaces are supported in .gitignore files, these
    spaces were previously (and erroneously) treated as part of
    the pattern.
  - The library can now be built with mbedTLS support for HTTPS.
  - The diff status character 'T' will now be presented by the
    git_diff_status_char API for diff entries that change type.
  - Revision walks previously would sometimes include commits
    that should have been ignored; this is corrected.
  - Revision walks are now more efficient when the output is
    unsorted; we now avoid walking all the way to the beginning
    of history unnecessarily.
  - Error-handling around index extension loading has been fixed.
    We were previously always misreporting a truncated index.
  * API additions:
  - The index may now be iterated atomically using
    git_index_iterator.
  - Remote objects can now be created with extended options using
    the git_remote_create_with_opts API.
  - Diff objects can now be applied as changes to the working
    directory, index or both, emulating the git apply command.
    Additionally, git_apply_to_tree can apply those changes to a
    tree object as a fully in-memory operation.
  - You can now swap out memory allocators via the
    GIT_OPT_SET_ALLOCATOR option with git_libgit2_opts().
  - You can now ensure that functions do not discard unwritten
    changes to the index via the
    GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY option to
    git_libgit2_opts(). This will cause functions that implicitly
    re-read the index (eg, git_checkout) to fail if you have
    staged changes to the index but you have not written the
    index to disk. (Unless the checkout has the FORCE flag
    specified.)
  - At present, this defaults to off, but we intend to enable
    this more broadly in the future, as a warning or error. We
    encourage you to examine your code to ensure that you are not
    relying on the current behavior that implicitly removes
    staged changes.
  - Reference specifications can be parsed from an arbitrary
    string with the git_refspec_parse API.
  - You can now get the name and path of worktrees using the
    git_worktree_name and git_worktree_path APIs, respectively.
  - The ref field has been added to git_worktree_add_options to
    enable the creation of a worktree from a pre-existing branch.
  - It's now possible to analyze merge relationships between any
    two references, not just against HEAD, using
    git_merge_analysis_for_ref.
  * API removals:
  - The git_buf_free API is deprecated; it has been renamed to
    git_buf_dispose for consistency. The git_buf_free API will be
    retained for backward compatibility for the foreseeable
    future.
  - The git_otype enumeration and its members are deprecated and
    have been renamed for consistency. The GIT_OBJ_ enumeration
    values are now prefixed with GIT_OBJECT_. The old
    enumerations and macros will be retained for backward
    compatibility for the foreseeable future.
  - Several index-related APIs have been renamed for consistency.
    The GIT_IDXENTRY_ enumeration values and macros have been
    renamed to be prefixed with GIT_INDEX_ENTRY_. The
    GIT_INDEXCAP enumeration values are now prefixed with
    GIT_INDEX_CAPABILITY_. The old enumerations and macros will
    be retained for backward compatibility for the foreseeable
    future.
  - The error functions and enumeration values have been renamed
    for consistency. The giterr_ functions and values prefix have
    been renamed to be prefixed with git_error_; similarly,
    the GITERR_ constants have been renamed to be prefixed with
    GIT_ERROR_. The old enumerations and macros will be retained
    for backward compatibility for the foreseeable future.
  * Breaking API changes:
  - The default checkout strategy changed from DRY_RUN to SAFE.
  - Adding a symlink as .gitmodules into the index from the
    workdir or checking out such files is not allowed as this can
    make a Git implementation write outside of the repository and
    bypass the fsck checks for CVE-2018-11235.
- Bump sover to 28 following upstreams changes.</changelog>
  <changelog author="mrueckert@suse.de" date="1550145600">-  Update to version 0.28.1:
  - The deprecated functions (git_buf_free and the giterr_ family
    of functions) are now exported properly. In the v0.28 release,
    they were not given the correct external attributes and they
    did not have the correct linkage visibility in the v0.28
    library.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 0.28.2:
  * Fix include directory ordering when using bundled dependencies.
  * Fix infinite loop when searching for a non-existing repository with
    Windows-style paths including drive prefixes.
  * Fix symlinks to directories on Windows.
  * Fix paths with a trailing "/" not always being treated as
    directories when computing ignores.
  * Fix false negatives when computing ignores where ignore rules
    that are a prefix to a negative ignore rule exist.
  * Fix patches with CRLF line endings not being parsed correctly.
  * Fix segfault when parsing patches with file addition (deletion)
    where the added (deleted) file name contains a space.
  * Fix assertion failure when trying to write to a non-existent
    locked configuration file.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065600">- libgit2 0.28.3:
  * A carefully constructed commit object with a very large number
    of parents may have lead to out-of-bounds writes or potential
    denial of service (boo#1158981)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065601">- libgit2 0.28.4:
  * CVE-2019-1348: the fast-import stream command "feature
    export-marks=path" allows writing to arbitrary file paths. As
    libgit2 does not offer any interface for fast-import, it is not
    susceptible to this vulnerability. (boo#1158785)
  * CVE-2019-1349: by using NTFS 8.3 short names, backslashes or
    alternate filesystreams, it is possible to cause submodules to
    be written into pre-existing directories during a recursive
    clone using git. As libgit2 rejects cloning into non-empty
    directories by default, it is not susceptible to this
    vulnerability. (boo#1158787)
  * CVE-2019-1350: recursive clones may lead to arbitrary remote
    code executing due to improper quoting of command line
    arguments. As libgit2 uses libssh2, which does not require us
    to perform command line parsing, it is not susceptible to this
    vulnerability. (boo#1158788)
  * CVE-2019-1351: Windows provides the ability to substitute
    drive letters with arbitrary letters, including multi-byte
    Unicode letters. To fix any potential issues arising from
    interpreting such paths as relative paths, we have extended
    detection of DOS drive prefixes to accomodate for such cases.
    (boo#1158790)
  * CVE-2019-1352: by using NTFS-style alternative file streams for
    the ".git" directory, it is possible to overwrite parts of the
    repository. While this has been fixed in the past for Windows,
    the same vulnerability may also exist on other systems that
    write to NTFS filesystems. We now reject any paths starting
    with ".git:" on all systems. (boo#1158790)
  * CVE-2019-1353: by using NTFS-style 8.3 short names, it was
    possible to write to the ".git" directory and thus overwrite
    parts of the repository, leading to possible remote code
    execution. While this problem was already fixed in the past for
    Windows, other systems accessing NTFS filesystems are
    vulnerable to this issue too. We now enable NTFS protecions by
    default on all systems to fix this attack vector. (boo#1158791)
  * CVE-2019-1354: on Windows, backslashes are not a valid part of
    a filename but are instead interpreted as directory separators.
    As other platforms allowed to use such paths, it was possible
    to write such invalid entries into a Git repository and was
    thus an attack vector to write into the ".git" dierctory. We
    now reject any entries starting with ".git" on all systems.
    (boo#1158792)
  * CVE-2019-1387: it is possible to let a submodule's git
    directory point into a sibling's submodule directory, which may
    result in overwriting parts of the Git repository and thus lead
    to arbitrary command execution. As libgit2 doesn't provide any
    way to do submodule clones natively, it is not susceptible to
    this vulnerability. Users of libgit2 that have implemented
    recursive submodule clones manually are encouraged to review
    their implementation for this vulnerability. (boo#1158793)</changelog>
  <changelog author="alarrosa@suse.com" date="1661342400">- Add patches backported from the upstream v1.3 branch to fix
  CVE-2022-29187, CVE-2022-24765 (bsc#1201431, bsc#1198234):
  * 0001-buffer-git_buf_sanitize-should-return-a-value.patch
  * 0001-path-refactor-ownership-checks-into-current-user-and.patch
  * 0002-repo-ensure-that-repo-dir-is-owned-by-current-user.patch
  * 0003-fs_path-mock-ownership-checks.patch
  * 0004-repo-test-configuration-ownership-validation.patch
  * 0005-repo-refactor-global-config-loader-function.patch
  * 0006-repo-honor-safe.directory-during-ownership-checks.patch
  * 0007-repo-make-ownership-checks-optional.patch
  * 0010-revparse-Remove-error-prone-redundant-test.patch
  * 0014-repo-add-tests-for-bare-repo-permissions.patch
  * 0015-fs-remove-mock-naming-from-change-ownership-constant.patch
  * 0016-fs-refactor-file-ownership-checks.patch
  * 0017-fs-allow-ownership-match-if-user-is-in-admin-group.patch
  * 0018-repo-allow-admin-owned-configs-by-admin-users.patch
  * 0019-repo-validate-gitdir-and-gitlink-ownership.patch
  * 0020-repo-allow-users-running-with-sudo-to-access-their-r.patch</changelog>
  <changelog author="mgorse@suse.com" date="1678968000">- Backport patches from the 1.4 branch to verify ssh remote host
  keys (boo#1207364 CVE-2023-22742):
  0001-ssh-verify-the-remote-s-host-key-against-known_hosts.patch
  0002-tests-append-the-github.com-ssh-keys-so-we-have-acce.patch
  0003-tests-move-online-clone-ssh_auth_methods-into-the-ss.patch
  0004-ssh-look-for-a-key-in-known_hosts-to-set-the-key-typ.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217600">- Address boo#1219660 CVE-2024-24577:
  0021-fix-slash-in-index-for-git_index_add.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217601">- Fixing 0021-fix-slash-in-index-for-git_index_add.patch to use
  '*slash' vs. '*--slash'</changelog>
</package>
<package pkgid="2618ca5cedc0b580add2113cf7439679c591dc9587aa8fdcd715ad86828f8b44" name="libgit2-devel" arch="s390x">
  <version epoch="0" ver="0.28.4" rel="150400.3.11.1"/>
  <changelog author="astieger@suse.com" date="1484136000">- libgit2 0.25.1
- New features and functionality:
  * repository discovery features
  * Support for reading and writing git index v4 files
  * Improve the performance of the revwalk
  * reference db concurrency improvements
  * Nanosecond resolution is now activated by default
  * restrict the set of ciphers used with OpenSSL by default.
  * user-registered merge drivers
  * built-in support for the union merge driver
  * callers can now specify proxy settings
  * New API for creating signed commits
  * New API for creating blobs from streams
  * New flags for opening repositories
  * New functions for various git operations
- Removed API:
  * git_blob_create_fromchunks() has been removed in  favour of
    git_blob_create_fromstream()
- Changed API:
  * git_packbuilder_object_count and git_packbuilder_written now
    return a size_t instead of a uint32_t for more thorough
    compatibility with the rest of the library.
  * git_packbuiler_progress now provides explicitly sized uint32_t
    values instead of unsigned int.
  * git_diff_file now includes an id_abbrev field that reflects the
    number of nibbles set in the id field.
  * git_odb_backend now has a freshen function pointer
  * git_remote_connect() now accepts proxy options.</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- libgit2 0.26.0:
  * Support for opening, creating and modifying worktrees.
  * Can now detect SHA1 collisions resulting from the SHAttered
    attack CVE-2005-4900
  * Fix for missing implementation of `git_merge_driver_source` getters
  * Fix for installed pkg-config file being broken when the prefix
    contains spaces
  * Can now detect when the hashsum of on-disk objects does not
    match their expected hashsum.
  * Support open-ended ranges (e.g. "master..", "...master") in
    revision range parsing code.
  * Correctly compute ignores with leading "/" in subdirectories.
  * Optionally call `fsync` on loose objects, packfiles and their
    indexes, loose references and packed reference files.
  * Builds against OpenSSL v1.1 and against LibreSSL.
  * Improvements for reading index v4 files.
  * API additions and incompatible API changes</changelog>
  <changelog author="mimi.vx@gmail.com" date="1510574400">- remove unneeded dependency (python is used only for testsuite, which
    isn't used during build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="kbabioch@suse.com" date="1521028800">- Update to 0.26.3:
  * Fix cloning of the libgit2 project with git clone --recursive by removing an
    invalid submodule from our testing data.
  * Fix endianness of the port in p_getaddrinfo().
  * Fix handling of negative gitignore rules with wildcards.
  * Fix handling of case-insensitive negative gitignore rules.
  * Fix resolving references to a tag if the reference is stored with its fully
    resolved OID in the packed-refs file.
  * Fix checkout not treating worktree files as modified when only their mode has
    changed.
  * Fix rename detection with GIT_DIFF_FIND_RENAMES_FROM_REWRITES.
  * Fixes memory handling issues when reading crafted repository index files.
    The issues allow for possible denial of service due to allocation of large
    memory and out-of-bound reads.
    (CVE-2018-8098 bnc#1085257 CVE-2018-8099 bnc#1085256)
  * Updates the bundled zlib to 1.2.11. Users who build the bundled zlib are
    vulnerable to security issues in the prior version.</changelog>
  <changelog author="mrueckert@suse.de" date="1524484800">- update to 0.27.0:
  - Changes or improvements
  - Improved p_unlink in posix_w32.c to try and make a file
    writable before sleeping in the retry loop to prevent
    unnecessary calls to sleep.
  - The CMake build infrastructure has been improved to speed up
    building time.
  - A new CMake option "-DUSE_HTTPS=" makes it possible to
    explicitly choose an HTTP backend.
  - A new CMake option "-DSHA1_BACKEND=" makes it possible to
    explicitly choose an SHA1 backend. The collision-detecting
    backend is now the default.
  - A new CMake option "-DUSE_BUNDLED_ZLIB" makes it possible to
    explicitly use the bundled zlib library.
  - A new CMake option "-DENABLE_REPRODUCIBLE_BUILDS" makes it
    possible to generate a reproducible static archive. This
    requires support from your toolchain.
  - The minimum required CMake version has been bumped to 2.8.11.
  - Writing to a configuration file now preserves the case of the
    key given by the caller for the case-insensitive portions of
    the key (existing sections are used even if they don't
    match).
  - We now support conditional includes in configuration files.
  - Fix for handling re-reading of configuration files with
    includes.
  - Fix for reading patches which contain exact renames only.
  - Fix for reading patches with whitespace in the compared
    files' paths.
  - We will now fill FETCH_HEAD from all passed refspecs instead
    of overwriting with the last one.
  - There is a new diff option, GIT_DIFF_INDENT_HEURISTIC which
    activates a heuristic which takes into account whitespace and
    indentation in order to produce better diffs when dealing
    with ambiguous diff hunks.
  - Fix for pattern-based ignore rules where files ignored by a
    rule cannot be un-ignored by another rule.
  - Sockets opened by libgit2 are now being closed on exec(3) if
    the platform supports it.
  - Fix for peeling annotated tags from packed-refs files.
  - Fix reading huge loose objects from the object database.
  - Fix files not being treated as modified when only the file
    mode has changed.
  - We now explicitly reject adding submodules to the index via
    git_index_add_frombuffer.
  - Fix handling of GIT_DIFF_FIND_RENAMES_FROM_REWRITES raising
    SIGABRT when one file has been deleted and another file has
    been rewritten.
  - Fix for WinHTTP not properly handling NTLM and Negotiate
    challenges.
  - When using SSH-based transports, we now repeatedly ask for
    the passphrase to decrypt the private key in case a wrong
    passphrase is being provided.
  - When generating conflict markers, they will now use the same
    line endings as the rest of the file.
  - API additions
  - The git_merge_file_options structure now contains a new
    setting, marker_size. This allows users to set the size of
    markers that delineate the sides of merged files in the
    output conflict file.  By default this is 7
    (GIT_MERGE_CONFLICT_MARKER_SIZE), which produces output
    markers like &lt;&lt;&lt;&lt;&lt;&lt;&lt; and &gt;&gt;&gt;&gt;&gt;&gt;&gt;.
  - git_remote_create_detached() creates a remote that is not
    associated to any repository (and does not apply
    configuration like 'insteadof' rules).  This is mostly useful
    for e.g. emulating git ls-remote behavior.
  - git_diff_patchid() lets you generate patch IDs for diffs.
  - git_status_options now has an additional field baseline to
    allow creating status lists against different trees.
  - New family of functions to allow creating notes for a
    specific notes commit instead of for a notes reference.
  - New family of functions to allow parsing message trailers.
    This API is still experimental and may change in future
    releases.
  - Breaking API changes
  - Signatures now distinguish between +0000 and -0000 UTC offsets.
  - The certificate check callback in the WinHTTP transport will
    now receive the message_cb_payload instead of the
    cred_acquire_payload.
  - We are now reading symlinked directories under .git/refs.
  - We now refuse creating branches named "HEAD".
  - We now refuse reading and writing all-zero object IDs into
    the object database.
  - We now read the effective user's configuration file instead
    of the real user's configuration in case libgit2 runs as part
    of a setuid binary.
  - The git_odb_open_rstream function and its readstream callback
    in the git_odb_backend interface have changed their
    signatures to allow providing the object's size and type to
    the caller.</changelog>
  <changelog author="astieger@suse.com" date="1531224000">- libgit2 0.27.3:
  * CVE-2018-10887 (bsc#1100613), CVE-2018-10888 (bsc#1100612):
    Specially crafted delta object in packfiles could trigger an
    integer overflow, bypassing input validation and causing the
    object database to contain copies of system memory. This may
    allow denial of service or, potentially, an information leak
- includes changes from 0.27.2:
  * various API and correctnes fixes
  * Fixes related to handling of .gitmodules
- includes changes from 0.27.1:
  * CVE-2018-11235: insufficient validation of submodule names from
    .gitmodules allowed writes to arbitrary paths (bsc#1095219)
  * disallow .gitmodules files as symlinks.</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- libgit2 0.27.4:
  * fix out-of-bounds reads when processing smart-protocol "ng"
    packets (bsc#1104641)</changelog>
  <changelog author="mpluskal@suse.com" date="1534852800">- Use pkgconfig style of dependencies, refresh dependencies
- Use more of cmake macros</changelog>
  <changelog author="astieger@suse.com" date="1538913600">- libgit2 0.27.5:
  * CVE-2018-17456: Submodule URLs and paths with a leading "-"
    are now ignored to avoid injecting options into library
    consumers that perform recursive clones (bsc#1110949)
  * Avoid a buffer overflow when running repack
  * Avoid stack overflow from unbounded recursion in configuration
    file parser
  * Avoid heap-buffer overflow when parsing "ok" packets
  * Fix heap-buffer overflows in smart protocol parsing code
  * Fix potential integer overflows on platforms with 16 bit ints
  * Fix potential NULL pointer dereference when parsing
    configuration files</changelog>
  <changelog author="astieger@suse.com" date="1541419200">- libgit2 0.27.7:
  * Various improvements for handling repositories
  * Various API correctness fixes
- includes changess from 0.27.6:
  * Various security fixes for parsing integers from buffers,
    and buffer handling bsc#1114729</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550059200">- Update to version 0.28.0:
  * Changes or improvements:
  - The library is now always built with cdecl calling
    conventions on Windows; the ability to build a stdcall
    library has been removed.
  - Reference log creation now honors
    core.logallrefupdates=always.
  - Fix some issues with the error-reporting in the OpenSSL
    backend.
  - HTTP proxy support is now builtin; libcurl is no longer used
    to support proxies and is removed as a dependency.
  - Certificate and credential callbacks can now return
    GIT_PASSTHROUGH to decline to act; libgit2 will behave as if
    there was no callback set in the first place.
  - The line-ending filtering logic - when checking out files -
    has been updated to match newer git (&gt;= git 2.9) for proper
    interoperability.
  - Symbolic links are now supported on Windows when
    core.symlinks is set to true.
  - Submodules with names which attempt to perform path traversal
    now have their configuration ignored. Such names were blindly
    appended to the $GIT_DIR/modules and a malicious name could
    lead to an attacker writing to an arbitrary location. This
    matches git's handling of CVE-2018-11235.
  - Object validation is now performed during tree creation in
    the git_index_write_tree_to API.
  - Configuration variable may now be specified on the same line
    as a section header; previously this was erroneously a parser
    error.
  - When an HTTP server supports both NTLM and Negotiate
    authentication mechanisms, we would previously fail to
    authenticate with any mechanism.
  - The GIT_OPT_SET_PACK_MAX_OBJECTS option can now set the
    maximum number of objects allowed in a packfile being
    downloaded; this can help limit the maximum memory used when
    fetching from an untrusted remote.
  - Line numbers in diffs loaded from patch files were not being
    populated; they are now included in the results.
  - The repository's index is reloaded from disk at the beginning
    of git_merge operations to ensure that it is up-to-date.
  - Mailmap handling APIs have been introduced, and the new
    commit APIs git_commit_committer_with_mailmap and
    git_commit_author_with_mailmap will use the mailmap to
    resolve the committer and author information. In addition,
    blame will use the mailmap given when the
    GIT_BLAME_USE_MAILMAP option.
  - Ignore handling for files in ignored folders would be
    ignored.
  - Worktrees can now be backed by bare repositories.
  - Trailing spaces are supported in .gitignore files, these
    spaces were previously (and erroneously) treated as part of
    the pattern.
  - The library can now be built with mbedTLS support for HTTPS.
  - The diff status character 'T' will now be presented by the
    git_diff_status_char API for diff entries that change type.
  - Revision walks previously would sometimes include commits
    that should have been ignored; this is corrected.
  - Revision walks are now more efficient when the output is
    unsorted; we now avoid walking all the way to the beginning
    of history unnecessarily.
  - Error-handling around index extension loading has been fixed.
    We were previously always misreporting a truncated index.
  * API additions:
  - The index may now be iterated atomically using
    git_index_iterator.
  - Remote objects can now be created with extended options using
    the git_remote_create_with_opts API.
  - Diff objects can now be applied as changes to the working
    directory, index or both, emulating the git apply command.
    Additionally, git_apply_to_tree can apply those changes to a
    tree object as a fully in-memory operation.
  - You can now swap out memory allocators via the
    GIT_OPT_SET_ALLOCATOR option with git_libgit2_opts().
  - You can now ensure that functions do not discard unwritten
    changes to the index via the
    GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY option to
    git_libgit2_opts(). This will cause functions that implicitly
    re-read the index (eg, git_checkout) to fail if you have
    staged changes to the index but you have not written the
    index to disk. (Unless the checkout has the FORCE flag
    specified.)
  - At present, this defaults to off, but we intend to enable
    this more broadly in the future, as a warning or error. We
    encourage you to examine your code to ensure that you are not
    relying on the current behavior that implicitly removes
    staged changes.
  - Reference specifications can be parsed from an arbitrary
    string with the git_refspec_parse API.
  - You can now get the name and path of worktrees using the
    git_worktree_name and git_worktree_path APIs, respectively.
  - The ref field has been added to git_worktree_add_options to
    enable the creation of a worktree from a pre-existing branch.
  - It's now possible to analyze merge relationships between any
    two references, not just against HEAD, using
    git_merge_analysis_for_ref.
  * API removals:
  - The git_buf_free API is deprecated; it has been renamed to
    git_buf_dispose for consistency. The git_buf_free API will be
    retained for backward compatibility for the foreseeable
    future.
  - The git_otype enumeration and its members are deprecated and
    have been renamed for consistency. The GIT_OBJ_ enumeration
    values are now prefixed with GIT_OBJECT_. The old
    enumerations and macros will be retained for backward
    compatibility for the foreseeable future.
  - Several index-related APIs have been renamed for consistency.
    The GIT_IDXENTRY_ enumeration values and macros have been
    renamed to be prefixed with GIT_INDEX_ENTRY_. The
    GIT_INDEXCAP enumeration values are now prefixed with
    GIT_INDEX_CAPABILITY_. The old enumerations and macros will
    be retained for backward compatibility for the foreseeable
    future.
  - The error functions and enumeration values have been renamed
    for consistency. The giterr_ functions and values prefix have
    been renamed to be prefixed with git_error_; similarly,
    the GITERR_ constants have been renamed to be prefixed with
    GIT_ERROR_. The old enumerations and macros will be retained
    for backward compatibility for the foreseeable future.
  * Breaking API changes:
  - The default checkout strategy changed from DRY_RUN to SAFE.
  - Adding a symlink as .gitmodules into the index from the
    workdir or checking out such files is not allowed as this can
    make a Git implementation write outside of the repository and
    bypass the fsck checks for CVE-2018-11235.
- Bump sover to 28 following upstreams changes.</changelog>
  <changelog author="mrueckert@suse.de" date="1550145600">-  Update to version 0.28.1:
  - The deprecated functions (git_buf_free and the giterr_ family
    of functions) are now exported properly. In the v0.28 release,
    they were not given the correct external attributes and they
    did not have the correct linkage visibility in the v0.28
    library.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 0.28.2:
  * Fix include directory ordering when using bundled dependencies.
  * Fix infinite loop when searching for a non-existing repository with
    Windows-style paths including drive prefixes.
  * Fix symlinks to directories on Windows.
  * Fix paths with a trailing "/" not always being treated as
    directories when computing ignores.
  * Fix false negatives when computing ignores where ignore rules
    that are a prefix to a negative ignore rule exist.
  * Fix patches with CRLF line endings not being parsed correctly.
  * Fix segfault when parsing patches with file addition (deletion)
    where the added (deleted) file name contains a space.
  * Fix assertion failure when trying to write to a non-existent
    locked configuration file.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065600">- libgit2 0.28.3:
  * A carefully constructed commit object with a very large number
    of parents may have lead to out-of-bounds writes or potential
    denial of service (boo#1158981)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065601">- libgit2 0.28.4:
  * CVE-2019-1348: the fast-import stream command "feature
    export-marks=path" allows writing to arbitrary file paths. As
    libgit2 does not offer any interface for fast-import, it is not
    susceptible to this vulnerability. (boo#1158785)
  * CVE-2019-1349: by using NTFS 8.3 short names, backslashes or
    alternate filesystreams, it is possible to cause submodules to
    be written into pre-existing directories during a recursive
    clone using git. As libgit2 rejects cloning into non-empty
    directories by default, it is not susceptible to this
    vulnerability. (boo#1158787)
  * CVE-2019-1350: recursive clones may lead to arbitrary remote
    code executing due to improper quoting of command line
    arguments. As libgit2 uses libssh2, which does not require us
    to perform command line parsing, it is not susceptible to this
    vulnerability. (boo#1158788)
  * CVE-2019-1351: Windows provides the ability to substitute
    drive letters with arbitrary letters, including multi-byte
    Unicode letters. To fix any potential issues arising from
    interpreting such paths as relative paths, we have extended
    detection of DOS drive prefixes to accomodate for such cases.
    (boo#1158790)
  * CVE-2019-1352: by using NTFS-style alternative file streams for
    the ".git" directory, it is possible to overwrite parts of the
    repository. While this has been fixed in the past for Windows,
    the same vulnerability may also exist on other systems that
    write to NTFS filesystems. We now reject any paths starting
    with ".git:" on all systems. (boo#1158790)
  * CVE-2019-1353: by using NTFS-style 8.3 short names, it was
    possible to write to the ".git" directory and thus overwrite
    parts of the repository, leading to possible remote code
    execution. While this problem was already fixed in the past for
    Windows, other systems accessing NTFS filesystems are
    vulnerable to this issue too. We now enable NTFS protecions by
    default on all systems to fix this attack vector. (boo#1158791)
  * CVE-2019-1354: on Windows, backslashes are not a valid part of
    a filename but are instead interpreted as directory separators.
    As other platforms allowed to use such paths, it was possible
    to write such invalid entries into a Git repository and was
    thus an attack vector to write into the ".git" dierctory. We
    now reject any entries starting with ".git" on all systems.
    (boo#1158792)
  * CVE-2019-1387: it is possible to let a submodule's git
    directory point into a sibling's submodule directory, which may
    result in overwriting parts of the Git repository and thus lead
    to arbitrary command execution. As libgit2 doesn't provide any
    way to do submodule clones natively, it is not susceptible to
    this vulnerability. Users of libgit2 that have implemented
    recursive submodule clones manually are encouraged to review
    their implementation for this vulnerability. (boo#1158793)</changelog>
  <changelog author="alarrosa@suse.com" date="1661342400">- Add patches backported from the upstream v1.3 branch to fix
  CVE-2022-29187, CVE-2022-24765 (bsc#1201431, bsc#1198234):
  * 0001-buffer-git_buf_sanitize-should-return-a-value.patch
  * 0001-path-refactor-ownership-checks-into-current-user-and.patch
  * 0002-repo-ensure-that-repo-dir-is-owned-by-current-user.patch
  * 0003-fs_path-mock-ownership-checks.patch
  * 0004-repo-test-configuration-ownership-validation.patch
  * 0005-repo-refactor-global-config-loader-function.patch
  * 0006-repo-honor-safe.directory-during-ownership-checks.patch
  * 0007-repo-make-ownership-checks-optional.patch
  * 0010-revparse-Remove-error-prone-redundant-test.patch
  * 0014-repo-add-tests-for-bare-repo-permissions.patch
  * 0015-fs-remove-mock-naming-from-change-ownership-constant.patch
  * 0016-fs-refactor-file-ownership-checks.patch
  * 0017-fs-allow-ownership-match-if-user-is-in-admin-group.patch
  * 0018-repo-allow-admin-owned-configs-by-admin-users.patch
  * 0019-repo-validate-gitdir-and-gitlink-ownership.patch
  * 0020-repo-allow-users-running-with-sudo-to-access-their-r.patch</changelog>
  <changelog author="mgorse@suse.com" date="1678968000">- Backport patches from the 1.4 branch to verify ssh remote host
  keys (boo#1207364 CVE-2023-22742):
  0001-ssh-verify-the-remote-s-host-key-against-known_hosts.patch
  0002-tests-append-the-github.com-ssh-keys-so-we-have-acce.patch
  0003-tests-move-online-clone-ssh_auth_methods-into-the-ss.patch
  0004-ssh-look-for-a-key-in-known_hosts-to-set-the-key-typ.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217600">- Address boo#1219660 CVE-2024-24577:
  0021-fix-slash-in-index-for-git_index_add.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217601">- Fixing 0021-fix-slash-in-index-for-git_index_add.patch to use
  '*slash' vs. '*--slash'</changelog>
</package>
<package pkgid="9206e229e8010009688ae2d14f003065ce98d8fdc93fafe2d09388db9ab713d5" name="libgit2-devel" arch="x86_64">
  <version epoch="0" ver="0.28.4" rel="150400.3.11.1"/>
  <changelog author="astieger@suse.com" date="1484136000">- libgit2 0.25.1
- New features and functionality:
  * repository discovery features
  * Support for reading and writing git index v4 files
  * Improve the performance of the revwalk
  * reference db concurrency improvements
  * Nanosecond resolution is now activated by default
  * restrict the set of ciphers used with OpenSSL by default.
  * user-registered merge drivers
  * built-in support for the union merge driver
  * callers can now specify proxy settings
  * New API for creating signed commits
  * New API for creating blobs from streams
  * New flags for opening repositories
  * New functions for various git operations
- Removed API:
  * git_blob_create_fromchunks() has been removed in  favour of
    git_blob_create_fromstream()
- Changed API:
  * git_packbuilder_object_count and git_packbuilder_written now
    return a size_t instead of a uint32_t for more thorough
    compatibility with the rest of the library.
  * git_packbuiler_progress now provides explicitly sized uint32_t
    values instead of unsigned int.
  * git_diff_file now includes an id_abbrev field that reflects the
    number of nibbles set in the id field.
  * git_odb_backend now has a freshen function pointer
  * git_remote_connect() now accepts proxy options.</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- libgit2 0.26.0:
  * Support for opening, creating and modifying worktrees.
  * Can now detect SHA1 collisions resulting from the SHAttered
    attack CVE-2005-4900
  * Fix for missing implementation of `git_merge_driver_source` getters
  * Fix for installed pkg-config file being broken when the prefix
    contains spaces
  * Can now detect when the hashsum of on-disk objects does not
    match their expected hashsum.
  * Support open-ended ranges (e.g. "master..", "...master") in
    revision range parsing code.
  * Correctly compute ignores with leading "/" in subdirectories.
  * Optionally call `fsync` on loose objects, packfiles and their
    indexes, loose references and packed reference files.
  * Builds against OpenSSL v1.1 and against LibreSSL.
  * Improvements for reading index v4 files.
  * API additions and incompatible API changes</changelog>
  <changelog author="mimi.vx@gmail.com" date="1510574400">- remove unneeded dependency (python is used only for testsuite, which
    isn't used during build)</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="kbabioch@suse.com" date="1521028800">- Update to 0.26.3:
  * Fix cloning of the libgit2 project with git clone --recursive by removing an
    invalid submodule from our testing data.
  * Fix endianness of the port in p_getaddrinfo().
  * Fix handling of negative gitignore rules with wildcards.
  * Fix handling of case-insensitive negative gitignore rules.
  * Fix resolving references to a tag if the reference is stored with its fully
    resolved OID in the packed-refs file.
  * Fix checkout not treating worktree files as modified when only their mode has
    changed.
  * Fix rename detection with GIT_DIFF_FIND_RENAMES_FROM_REWRITES.
  * Fixes memory handling issues when reading crafted repository index files.
    The issues allow for possible denial of service due to allocation of large
    memory and out-of-bound reads.
    (CVE-2018-8098 bnc#1085257 CVE-2018-8099 bnc#1085256)
  * Updates the bundled zlib to 1.2.11. Users who build the bundled zlib are
    vulnerable to security issues in the prior version.</changelog>
  <changelog author="mrueckert@suse.de" date="1524484800">- update to 0.27.0:
  - Changes or improvements
  - Improved p_unlink in posix_w32.c to try and make a file
    writable before sleeping in the retry loop to prevent
    unnecessary calls to sleep.
  - The CMake build infrastructure has been improved to speed up
    building time.
  - A new CMake option "-DUSE_HTTPS=" makes it possible to
    explicitly choose an HTTP backend.
  - A new CMake option "-DSHA1_BACKEND=" makes it possible to
    explicitly choose an SHA1 backend. The collision-detecting
    backend is now the default.
  - A new CMake option "-DUSE_BUNDLED_ZLIB" makes it possible to
    explicitly use the bundled zlib library.
  - A new CMake option "-DENABLE_REPRODUCIBLE_BUILDS" makes it
    possible to generate a reproducible static archive. This
    requires support from your toolchain.
  - The minimum required CMake version has been bumped to 2.8.11.
  - Writing to a configuration file now preserves the case of the
    key given by the caller for the case-insensitive portions of
    the key (existing sections are used even if they don't
    match).
  - We now support conditional includes in configuration files.
  - Fix for handling re-reading of configuration files with
    includes.
  - Fix for reading patches which contain exact renames only.
  - Fix for reading patches with whitespace in the compared
    files' paths.
  - We will now fill FETCH_HEAD from all passed refspecs instead
    of overwriting with the last one.
  - There is a new diff option, GIT_DIFF_INDENT_HEURISTIC which
    activates a heuristic which takes into account whitespace and
    indentation in order to produce better diffs when dealing
    with ambiguous diff hunks.
  - Fix for pattern-based ignore rules where files ignored by a
    rule cannot be un-ignored by another rule.
  - Sockets opened by libgit2 are now being closed on exec(3) if
    the platform supports it.
  - Fix for peeling annotated tags from packed-refs files.
  - Fix reading huge loose objects from the object database.
  - Fix files not being treated as modified when only the file
    mode has changed.
  - We now explicitly reject adding submodules to the index via
    git_index_add_frombuffer.
  - Fix handling of GIT_DIFF_FIND_RENAMES_FROM_REWRITES raising
    SIGABRT when one file has been deleted and another file has
    been rewritten.
  - Fix for WinHTTP not properly handling NTLM and Negotiate
    challenges.
  - When using SSH-based transports, we now repeatedly ask for
    the passphrase to decrypt the private key in case a wrong
    passphrase is being provided.
  - When generating conflict markers, they will now use the same
    line endings as the rest of the file.
  - API additions
  - The git_merge_file_options structure now contains a new
    setting, marker_size. This allows users to set the size of
    markers that delineate the sides of merged files in the
    output conflict file.  By default this is 7
    (GIT_MERGE_CONFLICT_MARKER_SIZE), which produces output
    markers like &lt;&lt;&lt;&lt;&lt;&lt;&lt; and &gt;&gt;&gt;&gt;&gt;&gt;&gt;.
  - git_remote_create_detached() creates a remote that is not
    associated to any repository (and does not apply
    configuration like 'insteadof' rules).  This is mostly useful
    for e.g. emulating git ls-remote behavior.
  - git_diff_patchid() lets you generate patch IDs for diffs.
  - git_status_options now has an additional field baseline to
    allow creating status lists against different trees.
  - New family of functions to allow creating notes for a
    specific notes commit instead of for a notes reference.
  - New family of functions to allow parsing message trailers.
    This API is still experimental and may change in future
    releases.
  - Breaking API changes
  - Signatures now distinguish between +0000 and -0000 UTC offsets.
  - The certificate check callback in the WinHTTP transport will
    now receive the message_cb_payload instead of the
    cred_acquire_payload.
  - We are now reading symlinked directories under .git/refs.
  - We now refuse creating branches named "HEAD".
  - We now refuse reading and writing all-zero object IDs into
    the object database.
  - We now read the effective user's configuration file instead
    of the real user's configuration in case libgit2 runs as part
    of a setuid binary.
  - The git_odb_open_rstream function and its readstream callback
    in the git_odb_backend interface have changed their
    signatures to allow providing the object's size and type to
    the caller.</changelog>
  <changelog author="astieger@suse.com" date="1531224000">- libgit2 0.27.3:
  * CVE-2018-10887 (bsc#1100613), CVE-2018-10888 (bsc#1100612):
    Specially crafted delta object in packfiles could trigger an
    integer overflow, bypassing input validation and causing the
    object database to contain copies of system memory. This may
    allow denial of service or, potentially, an information leak
- includes changes from 0.27.2:
  * various API and correctnes fixes
  * Fixes related to handling of .gitmodules
- includes changes from 0.27.1:
  * CVE-2018-11235: insufficient validation of submodule names from
    .gitmodules allowed writes to arbitrary paths (bsc#1095219)
  * disallow .gitmodules files as symlinks.</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- libgit2 0.27.4:
  * fix out-of-bounds reads when processing smart-protocol "ng"
    packets (bsc#1104641)</changelog>
  <changelog author="mpluskal@suse.com" date="1534852800">- Use pkgconfig style of dependencies, refresh dependencies
- Use more of cmake macros</changelog>
  <changelog author="astieger@suse.com" date="1538913600">- libgit2 0.27.5:
  * CVE-2018-17456: Submodule URLs and paths with a leading "-"
    are now ignored to avoid injecting options into library
    consumers that perform recursive clones (bsc#1110949)
  * Avoid a buffer overflow when running repack
  * Avoid stack overflow from unbounded recursion in configuration
    file parser
  * Avoid heap-buffer overflow when parsing "ok" packets
  * Fix heap-buffer overflows in smart protocol parsing code
  * Fix potential integer overflows on platforms with 16 bit ints
  * Fix potential NULL pointer dereference when parsing
    configuration files</changelog>
  <changelog author="astieger@suse.com" date="1541419200">- libgit2 0.27.7:
  * Various improvements for handling repositories
  * Various API correctness fixes
- includes changess from 0.27.6:
  * Various security fixes for parsing integers from buffers,
    and buffer handling bsc#1114729</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550059200">- Update to version 0.28.0:
  * Changes or improvements:
  - The library is now always built with cdecl calling
    conventions on Windows; the ability to build a stdcall
    library has been removed.
  - Reference log creation now honors
    core.logallrefupdates=always.
  - Fix some issues with the error-reporting in the OpenSSL
    backend.
  - HTTP proxy support is now builtin; libcurl is no longer used
    to support proxies and is removed as a dependency.
  - Certificate and credential callbacks can now return
    GIT_PASSTHROUGH to decline to act; libgit2 will behave as if
    there was no callback set in the first place.
  - The line-ending filtering logic - when checking out files -
    has been updated to match newer git (&gt;= git 2.9) for proper
    interoperability.
  - Symbolic links are now supported on Windows when
    core.symlinks is set to true.
  - Submodules with names which attempt to perform path traversal
    now have their configuration ignored. Such names were blindly
    appended to the $GIT_DIR/modules and a malicious name could
    lead to an attacker writing to an arbitrary location. This
    matches git's handling of CVE-2018-11235.
  - Object validation is now performed during tree creation in
    the git_index_write_tree_to API.
  - Configuration variable may now be specified on the same line
    as a section header; previously this was erroneously a parser
    error.
  - When an HTTP server supports both NTLM and Negotiate
    authentication mechanisms, we would previously fail to
    authenticate with any mechanism.
  - The GIT_OPT_SET_PACK_MAX_OBJECTS option can now set the
    maximum number of objects allowed in a packfile being
    downloaded; this can help limit the maximum memory used when
    fetching from an untrusted remote.
  - Line numbers in diffs loaded from patch files were not being
    populated; they are now included in the results.
  - The repository's index is reloaded from disk at the beginning
    of git_merge operations to ensure that it is up-to-date.
  - Mailmap handling APIs have been introduced, and the new
    commit APIs git_commit_committer_with_mailmap and
    git_commit_author_with_mailmap will use the mailmap to
    resolve the committer and author information. In addition,
    blame will use the mailmap given when the
    GIT_BLAME_USE_MAILMAP option.
  - Ignore handling for files in ignored folders would be
    ignored.
  - Worktrees can now be backed by bare repositories.
  - Trailing spaces are supported in .gitignore files, these
    spaces were previously (and erroneously) treated as part of
    the pattern.
  - The library can now be built with mbedTLS support for HTTPS.
  - The diff status character 'T' will now be presented by the
    git_diff_status_char API for diff entries that change type.
  - Revision walks previously would sometimes include commits
    that should have been ignored; this is corrected.
  - Revision walks are now more efficient when the output is
    unsorted; we now avoid walking all the way to the beginning
    of history unnecessarily.
  - Error-handling around index extension loading has been fixed.
    We were previously always misreporting a truncated index.
  * API additions:
  - The index may now be iterated atomically using
    git_index_iterator.
  - Remote objects can now be created with extended options using
    the git_remote_create_with_opts API.
  - Diff objects can now be applied as changes to the working
    directory, index or both, emulating the git apply command.
    Additionally, git_apply_to_tree can apply those changes to a
    tree object as a fully in-memory operation.
  - You can now swap out memory allocators via the
    GIT_OPT_SET_ALLOCATOR option with git_libgit2_opts().
  - You can now ensure that functions do not discard unwritten
    changes to the index via the
    GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY option to
    git_libgit2_opts(). This will cause functions that implicitly
    re-read the index (eg, git_checkout) to fail if you have
    staged changes to the index but you have not written the
    index to disk. (Unless the checkout has the FORCE flag
    specified.)
  - At present, this defaults to off, but we intend to enable
    this more broadly in the future, as a warning or error. We
    encourage you to examine your code to ensure that you are not
    relying on the current behavior that implicitly removes
    staged changes.
  - Reference specifications can be parsed from an arbitrary
    string with the git_refspec_parse API.
  - You can now get the name and path of worktrees using the
    git_worktree_name and git_worktree_path APIs, respectively.
  - The ref field has been added to git_worktree_add_options to
    enable the creation of a worktree from a pre-existing branch.
  - It's now possible to analyze merge relationships between any
    two references, not just against HEAD, using
    git_merge_analysis_for_ref.
  * API removals:
  - The git_buf_free API is deprecated; it has been renamed to
    git_buf_dispose for consistency. The git_buf_free API will be
    retained for backward compatibility for the foreseeable
    future.
  - The git_otype enumeration and its members are deprecated and
    have been renamed for consistency. The GIT_OBJ_ enumeration
    values are now prefixed with GIT_OBJECT_. The old
    enumerations and macros will be retained for backward
    compatibility for the foreseeable future.
  - Several index-related APIs have been renamed for consistency.
    The GIT_IDXENTRY_ enumeration values and macros have been
    renamed to be prefixed with GIT_INDEX_ENTRY_. The
    GIT_INDEXCAP enumeration values are now prefixed with
    GIT_INDEX_CAPABILITY_. The old enumerations and macros will
    be retained for backward compatibility for the foreseeable
    future.
  - The error functions and enumeration values have been renamed
    for consistency. The giterr_ functions and values prefix have
    been renamed to be prefixed with git_error_; similarly,
    the GITERR_ constants have been renamed to be prefixed with
    GIT_ERROR_. The old enumerations and macros will be retained
    for backward compatibility for the foreseeable future.
  * Breaking API changes:
  - The default checkout strategy changed from DRY_RUN to SAFE.
  - Adding a symlink as .gitmodules into the index from the
    workdir or checking out such files is not allowed as this can
    make a Git implementation write outside of the repository and
    bypass the fsck checks for CVE-2018-11235.
- Bump sover to 28 following upstreams changes.</changelog>
  <changelog author="mrueckert@suse.de" date="1550145600">-  Update to version 0.28.1:
  - The deprecated functions (git_buf_free and the giterr_ family
    of functions) are now exported properly. In the v0.28 release,
    they were not given the correct external attributes and they
    did not have the correct linkage visibility in the v0.28
    library.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 0.28.2:
  * Fix include directory ordering when using bundled dependencies.
  * Fix infinite loop when searching for a non-existing repository with
    Windows-style paths including drive prefixes.
  * Fix symlinks to directories on Windows.
  * Fix paths with a trailing "/" not always being treated as
    directories when computing ignores.
  * Fix false negatives when computing ignores where ignore rules
    that are a prefix to a negative ignore rule exist.
  * Fix patches with CRLF line endings not being parsed correctly.
  * Fix segfault when parsing patches with file addition (deletion)
    where the added (deleted) file name contains a space.
  * Fix assertion failure when trying to write to a non-existent
    locked configuration file.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065600">- libgit2 0.28.3:
  * A carefully constructed commit object with a very large number
    of parents may have lead to out-of-bounds writes or potential
    denial of service (boo#1158981)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1576065601">- libgit2 0.28.4:
  * CVE-2019-1348: the fast-import stream command "feature
    export-marks=path" allows writing to arbitrary file paths. As
    libgit2 does not offer any interface for fast-import, it is not
    susceptible to this vulnerability. (boo#1158785)
  * CVE-2019-1349: by using NTFS 8.3 short names, backslashes or
    alternate filesystreams, it is possible to cause submodules to
    be written into pre-existing directories during a recursive
    clone using git. As libgit2 rejects cloning into non-empty
    directories by default, it is not susceptible to this
    vulnerability. (boo#1158787)
  * CVE-2019-1350: recursive clones may lead to arbitrary remote
    code executing due to improper quoting of command line
    arguments. As libgit2 uses libssh2, which does not require us
    to perform command line parsing, it is not susceptible to this
    vulnerability. (boo#1158788)
  * CVE-2019-1351: Windows provides the ability to substitute
    drive letters with arbitrary letters, including multi-byte
    Unicode letters. To fix any potential issues arising from
    interpreting such paths as relative paths, we have extended
    detection of DOS drive prefixes to accomodate for such cases.
    (boo#1158790)
  * CVE-2019-1352: by using NTFS-style alternative file streams for
    the ".git" directory, it is possible to overwrite parts of the
    repository. While this has been fixed in the past for Windows,
    the same vulnerability may also exist on other systems that
    write to NTFS filesystems. We now reject any paths starting
    with ".git:" on all systems. (boo#1158790)
  * CVE-2019-1353: by using NTFS-style 8.3 short names, it was
    possible to write to the ".git" directory and thus overwrite
    parts of the repository, leading to possible remote code
    execution. While this problem was already fixed in the past for
    Windows, other systems accessing NTFS filesystems are
    vulnerable to this issue too. We now enable NTFS protecions by
    default on all systems to fix this attack vector. (boo#1158791)
  * CVE-2019-1354: on Windows, backslashes are not a valid part of
    a filename but are instead interpreted as directory separators.
    As other platforms allowed to use such paths, it was possible
    to write such invalid entries into a Git repository and was
    thus an attack vector to write into the ".git" dierctory. We
    now reject any entries starting with ".git" on all systems.
    (boo#1158792)
  * CVE-2019-1387: it is possible to let a submodule's git
    directory point into a sibling's submodule directory, which may
    result in overwriting parts of the Git repository and thus lead
    to arbitrary command execution. As libgit2 doesn't provide any
    way to do submodule clones natively, it is not susceptible to
    this vulnerability. Users of libgit2 that have implemented
    recursive submodule clones manually are encouraged to review
    their implementation for this vulnerability. (boo#1158793)</changelog>
  <changelog author="alarrosa@suse.com" date="1661342400">- Add patches backported from the upstream v1.3 branch to fix
  CVE-2022-29187, CVE-2022-24765 (bsc#1201431, bsc#1198234):
  * 0001-buffer-git_buf_sanitize-should-return-a-value.patch
  * 0001-path-refactor-ownership-checks-into-current-user-and.patch
  * 0002-repo-ensure-that-repo-dir-is-owned-by-current-user.patch
  * 0003-fs_path-mock-ownership-checks.patch
  * 0004-repo-test-configuration-ownership-validation.patch
  * 0005-repo-refactor-global-config-loader-function.patch
  * 0006-repo-honor-safe.directory-during-ownership-checks.patch
  * 0007-repo-make-ownership-checks-optional.patch
  * 0010-revparse-Remove-error-prone-redundant-test.patch
  * 0014-repo-add-tests-for-bare-repo-permissions.patch
  * 0015-fs-remove-mock-naming-from-change-ownership-constant.patch
  * 0016-fs-refactor-file-ownership-checks.patch
  * 0017-fs-allow-ownership-match-if-user-is-in-admin-group.patch
  * 0018-repo-allow-admin-owned-configs-by-admin-users.patch
  * 0019-repo-validate-gitdir-and-gitlink-ownership.patch
  * 0020-repo-allow-users-running-with-sudo-to-access-their-r.patch</changelog>
  <changelog author="mgorse@suse.com" date="1678968000">- Backport patches from the 1.4 branch to verify ssh remote host
  keys (boo#1207364 CVE-2023-22742):
  0001-ssh-verify-the-remote-s-host-key-against-known_hosts.patch
  0002-tests-append-the-github.com-ssh-keys-so-we-have-acce.patch
  0003-tests-move-online-clone-ssh_auth_methods-into-the-ss.patch
  0004-ssh-look-for-a-key-in-known_hosts-to-set-the-key-typ.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217600">- Address boo#1219660 CVE-2024-24577:
  0021-fix-slash-in-index-for-git_index_add.patch</changelog>
  <changelog author="scott.bradnick@suse.com" date="1721217601">- Fixing 0021-fix-slash-in-index-for-git_index_add.patch to use
  '*slash' vs. '*--slash'</changelog>
</package>
<package pkgid="b4a7940ff7b590941cf238f9e360d7bbdf4f56b0e790d5f6c7d6e4f3d7eac46c" name="libhttp_parser2_7_1" arch="aarch64">
  <version epoch="0" ver="2.7.1" rel="150400.4.6.4"/>
  <changelog author="p.drouand@gmail.com" date="1439035200">- Initial package (version 2.5.0) for build.opensuse.org</changelog>
  <changelog author="p.drouand@gmail.com" date="1447675200">- Update to version 2.6.0
  * No changelog available</changelog>
  <changelog author="zaitor@opensuse.org" date="1453982400">- Add baselibs.conf as source, in order to build
  libhttp-parser-suse0 32-bit compatability lib.</changelog>
  <changelog author="mpluskal@suse.com" date="1458993600">- Update to 2.6.2
  * No changelog available</changelog>
  <changelog author="p.drouand@gmail.com" date="1477051200">- Update to version 2.7.1
  * No changelog available</changelog>
  <changelog author="mimi.vx@gmail.com" date="1509710400">- move out from gyp
- use correct SONAME
- drop http-parser-gyp-sharedlib.patch
- add makefile.patch</changelog>
</package>
<package pkgid="1a40a90f2a3a5225d46aed6fa56585524b12d02079076b70cf73f135d119b9aa" name="libhttp_parser2_7_1" arch="ppc64le">
  <version epoch="0" ver="2.7.1" rel="150400.4.6.4"/>
  <changelog author="p.drouand@gmail.com" date="1439035200">- Initial package (version 2.5.0) for build.opensuse.org</changelog>
  <changelog author="p.drouand@gmail.com" date="1447675200">- Update to version 2.6.0
  * No changelog available</changelog>
  <changelog author="zaitor@opensuse.org" date="1453982400">- Add baselibs.conf as source, in order to build
  libhttp-parser-suse0 32-bit compatability lib.</changelog>
  <changelog author="mpluskal@suse.com" date="1458993600">- Update to 2.6.2
  * No changelog available</changelog>
  <changelog author="p.drouand@gmail.com" date="1477051200">- Update to version 2.7.1
  * No changelog available</changelog>
  <changelog author="mimi.vx@gmail.com" date="1509710400">- move out from gyp
- use correct SONAME
- drop http-parser-gyp-sharedlib.patch
- add makefile.patch</changelog>
</package>
<package pkgid="bbc262a6c5cccf24fd9edd2ae71abeedbbc0833480c42f3aaee1d04919806edb" name="libhttp_parser2_7_1" arch="s390x">
  <version epoch="0" ver="2.7.1" rel="150400.4.6.4"/>
  <changelog author="p.drouand@gmail.com" date="1439035200">- Initial package (version 2.5.0) for build.opensuse.org</changelog>
  <changelog author="p.drouand@gmail.com" date="1447675200">- Update to version 2.6.0
  * No changelog available</changelog>
  <changelog author="zaitor@opensuse.org" date="1453982400">- Add baselibs.conf as source, in order to build
  libhttp-parser-suse0 32-bit compatability lib.</changelog>
  <changelog author="mpluskal@suse.com" date="1458993600">- Update to 2.6.2
  * No changelog available</changelog>
  <changelog author="p.drouand@gmail.com" date="1477051200">- Update to version 2.7.1
  * No changelog available</changelog>
  <changelog author="mimi.vx@gmail.com" date="1509710400">- move out from gyp
- use correct SONAME
- drop http-parser-gyp-sharedlib.patch
- add makefile.patch</changelog>
</package>
<package pkgid="56c79a2f109ab400b7b872bbd983ce1c24d10e88fa921bce1e5f72a587ee9177" name="libhttp_parser2_7_1" arch="x86_64">
  <version epoch="0" ver="2.7.1" rel="150400.4.6.4"/>
  <changelog author="p.drouand@gmail.com" date="1439035200">- Initial package (version 2.5.0) for build.opensuse.org</changelog>
  <changelog author="p.drouand@gmail.com" date="1447675200">- Update to version 2.6.0
  * No changelog available</changelog>
  <changelog author="zaitor@opensuse.org" date="1453982400">- Add baselibs.conf as source, in order to build
  libhttp-parser-suse0 32-bit compatability lib.</changelog>
  <changelog author="mpluskal@suse.com" date="1458993600">- Update to 2.6.2
  * No changelog available</changelog>
  <changelog author="p.drouand@gmail.com" date="1477051200">- Update to version 2.7.1
  * No changelog available</changelog>
  <changelog author="mimi.vx@gmail.com" date="1509710400">- move out from gyp
- use correct SONAME
- drop http-parser-gyp-sharedlib.patch
- add makefile.patch</changelog>
</package>
<package pkgid="55995812b0164de759194d1ae62a5ee8e98e4fe7cdd1f2755b6f6f2aec3cf192" name="libhttp_parser2_7_1-64bit" arch="aarch64_ilp32">
  <version epoch="0" ver="2.7.1" rel="150400.4.6.4"/>
  <changelog author="p.drouand@gmail.com" date="1439035200">- Initial package (version 2.5.0) for build.opensuse.org</changelog>
  <changelog author="p.drouand@gmail.com" date="1447675200">- Update to version 2.6.0
  * No changelog available</changelog>
  <changelog author="zaitor@opensuse.org" date="1453982400">- Add baselibs.conf as source, in order to build
  libhttp-parser-suse0 32-bit compatability lib.</changelog>
  <changelog author="mpluskal@suse.com" date="1458993600">- Update to 2.6.2
  * No changelog available</changelog>
  <changelog author="p.drouand@gmail.com" date="1477051200">- Update to version 2.7.1
  * No changelog available</changelog>
  <changelog author="mimi.vx@gmail.com" date="1509710400">- move out from gyp
- use correct SONAME
- drop http-parser-gyp-sharedlib.patch
- add makefile.patch</changelog>
</package>
<package pkgid="656e947501d9f33fb3477a5bcaacbc8c2127c306b9babea95f1eb02331c9fc21" name="obs-to-maven" arch="noarch">
  <version epoch="0" ver="1.1.13" rel="150400.1.1"/>
  <changelog author="cbosdonnat@suse.com" date="1601985600">- Update to version 1.0.0+git20201006.14169e3:
  * Don't use cpio stdout output
  * Remove python2 support
  * Replace python binding by rpm calls
  * Smarter match of the jar file
  * Rename the api property into url to better reflect its use
  * Mark the rpm property as deprecated in favor of package
  * Be less error-friendly
  * Get rid of the osc dependency
  * Add missing errno import
  * Revert shebang change</changelog>
  <changelog author="cbosdonnat@suse.com" date="1602504000">- Update to version 1.0.0+git20201012.cfcae6e:
  * Better compare rpm versions
  * Search for jar in all the /usr tree
  * Filter out RPMs to only keep the latest version of each
  * Handle the base path of the URL in the configuration</changelog>
  <changelog author="cbosdonnat@suse.com" date="1626955200">- Update to version 1.0.0+git20210722.587f093:
  * Only try to find artefacts in the configured group</changelog>
  <changelog author="cbosdonnat@suse.com" date="1645099200">- Update to version 1.0.0+git20220217.d8d2724:
  * Parse repo primary.xml file using SAX
  * Split into modules</changelog>
  <changelog author="cbosdonnat@suse.com" date="1645444800">- Update to version 1.0.0+git20220221.e584367:
  * Don't store the parser handler data in class members</changelog>
  <changelog author="cbosdonnat@suse.com" date="1645531200">- Update to version 1.1.0:
  * More memory optimization when parsing primary xml files</changelog>
  <changelog author="cbosdonnat@suse.com" date="1655985600">-Update to version 1.1.1:
  * Add a custom 'url' parameter for repository entries</changelog>
  <changelog author="cbosdonnat@suse.com" date="1661947200">- Update to version 1.1.2:
  * re-try to download the binary on connection error</changelog>
  <changelog author="cbosdonnat@suse.com" date="1662120000">- Update to version 1.1.3:
  * Fix retry</changelog>
  <changelog author="alexander.graul@suse.com" date="1667995200">- Update to version 1.1.4:
  * Download primary.xml to disk before parsing i
  * Improve retry mechanism</changelog>
  <changelog author="cbosdonnat@suse.com" date="1672315200">- Update to version 1.1.5:
  * Fix artifact group to path translation
  * Introduce caching for primary xml data</changelog>
  <changelog author="cbosdonnat@suse.com" date="1673352000">- Update to version 1.1.6:
  * Repo name may be read as a number from the yaml config</changelog>
  <changelog author="cbosdonnat@suse.com" date="1673870400">- Update to version 1.1.7:
  * re-try on HTTP Error</changelog>
  <changelog author="ricardo.mestre@suse.com" date="1686052800">- Set python3-PyYAML as run-time dependency</changelog>
  <changelog author="cbosdonnat@suse.com" date="1725278400">- Update to version 1.1.8:
  * Fix version compare</changelog>
  <changelog author="cbosdonnat@suse.com" date="1759406400">- Update to version 1.1.9:
  * Parse and use POM metadata from the packages</changelog>
  <changelog author="cbosdonnat@suse.com" date="1762948800">- Update to version 1.1.10:
  * Enhance error handling for connection issues</changelog>
  <changelog author="cbosdonnat@suse.com" date="1764936000">- Update to version 1.1.11:
  * Avoid matching artifacts of other groups</changelog>
  <changelog author="jgonzalez@suse.com" date="1776859200">- Update to version 1.1.12
  * Add an argument to show the current version
  * Enable debugging for urllib</changelog>
  <changelog author="cbosdonnat@suse.com" date="1781870400">- Update to version 1.1.13
  * support zst compressed metadata</changelog>
</package>
<package pkgid="f3bf6dfec843876365e0825f4850a897d39f4e5d335bd869ee44d64eee9d38b3" name="obs-to-maven" arch="src">
  <version epoch="0" ver="1.1.13" rel="150400.1.1"/>
  <changelog author="cbosdonnat@suse.com" date="1601985600">- Update to version 1.0.0+git20201006.14169e3:
  * Don't use cpio stdout output
  * Remove python2 support
  * Replace python binding by rpm calls
  * Smarter match of the jar file
  * Rename the api property into url to better reflect its use
  * Mark the rpm property as deprecated in favor of package
  * Be less error-friendly
  * Get rid of the osc dependency
  * Add missing errno import
  * Revert shebang change</changelog>
  <changelog author="cbosdonnat@suse.com" date="1602504000">- Update to version 1.0.0+git20201012.cfcae6e:
  * Better compare rpm versions
  * Search for jar in all the /usr tree
  * Filter out RPMs to only keep the latest version of each
  * Handle the base path of the URL in the configuration</changelog>
  <changelog author="cbosdonnat@suse.com" date="1626955200">- Update to version 1.0.0+git20210722.587f093:
  * Only try to find artefacts in the configured group</changelog>
  <changelog author="cbosdonnat@suse.com" date="1645099200">- Update to version 1.0.0+git20220217.d8d2724:
  * Parse repo primary.xml file using SAX
  * Split into modules</changelog>
  <changelog author="cbosdonnat@suse.com" date="1645444800">- Update to version 1.0.0+git20220221.e584367:
  * Don't store the parser handler data in class members</changelog>
  <changelog author="cbosdonnat@suse.com" date="1645531200">- Update to version 1.1.0:
  * More memory optimization when parsing primary xml files</changelog>
  <changelog author="cbosdonnat@suse.com" date="1655985600">-Update to version 1.1.1:
  * Add a custom 'url' parameter for repository entries</changelog>
  <changelog author="cbosdonnat@suse.com" date="1661947200">- Update to version 1.1.2:
  * re-try to download the binary on connection error</changelog>
  <changelog author="cbosdonnat@suse.com" date="1662120000">- Update to version 1.1.3:
  * Fix retry</changelog>
  <changelog author="alexander.graul@suse.com" date="1667995200">- Update to version 1.1.4:
  * Download primary.xml to disk before parsing i
  * Improve retry mechanism</changelog>
  <changelog author="cbosdonnat@suse.com" date="1672315200">- Update to version 1.1.5:
  * Fix artifact group to path translation
  * Introduce caching for primary xml data</changelog>
  <changelog author="cbosdonnat@suse.com" date="1673352000">- Update to version 1.1.6:
  * Repo name may be read as a number from the yaml config</changelog>
  <changelog author="cbosdonnat@suse.com" date="1673870400">- Update to version 1.1.7:
  * re-try on HTTP Error</changelog>
  <changelog author="ricardo.mestre@suse.com" date="1686052800">- Set python3-PyYAML as run-time dependency</changelog>
  <changelog author="cbosdonnat@suse.com" date="1725278400">- Update to version 1.1.8:
  * Fix version compare</changelog>
  <changelog author="cbosdonnat@suse.com" date="1759406400">- Update to version 1.1.9:
  * Parse and use POM metadata from the packages</changelog>
  <changelog author="cbosdonnat@suse.com" date="1762948800">- Update to version 1.1.10:
  * Enhance error handling for connection issues</changelog>
  <changelog author="cbosdonnat@suse.com" date="1764936000">- Update to version 1.1.11:
  * Avoid matching artifacts of other groups</changelog>
  <changelog author="jgonzalez@suse.com" date="1776859200">- Update to version 1.1.12
  * Add an argument to show the current version
  * Enable debugging for urllib</changelog>
  <changelog author="cbosdonnat@suse.com" date="1781870400">- Update to version 1.1.13
  * support zst compressed metadata</changelog>
</package>
<package pkgid="52ddb0710c982006ab387987e904c45fe6a091f37d6aa30b8c131221f0c02a0e" name="pyhcl" arch="src">
  <version epoch="0" ver="0.4.2" rel="150400.8.1"/>
  <changelog author="jgonzalez@suse.com" date="1585915200">- Initial version</changelog>
</package>
<package pkgid="89132dd23b56d44038ac024df3c45f19ff72dbb3bf154ddd3da8079f38b798c6" name="python-pygit2" arch="src">
  <version epoch="0" ver="0.28.2" rel="150400.17.4"/>
  <changelog author="toddrme2178@gmail.com" date="1376827200">- Update to 0.19.0
  + Upstream provides no changelog, but you can check
    https://github.com/libgit2/pygit2/compare/v0.17.3...v0.19.0
- Keep 0.17.3 for compatibility with openSUSE 12.2</changelog>
  <changelog author="p.drouand@gmail.com" date="1386590400">- Update to version 0.20.0
  + Upstream provides no changelog, but you can check
    https://github.com/libgit2/pygit2/compare/v0.19.0...v0.20.0
- Fix build on openSUSE &gt;= 12.3 and SLE11SP3
- Remove obsolete conditionnal macros</changelog>
  <changelog author="p.drouand@gmail.com" date="1409659200">- Update to version 0.20.2
  + Fix regression with Python 2, ``IndexEntry.path`` returns str
    (bytes in Python 2 and unicode in Python 3)
  + Get back ``IndexEntry.oid`` for backwards compatibility
  + Config, iterate over the keys (instead of the key/value pairs)
    `#395 &lt;https://github.com/libgit2/pygit2/pull/395&gt;`_
  + ``Diff.find_similar`` supports new threshold arguments
    `#396 &lt;https://github.com/libgit2/pygit2/pull/396&gt;`_
  + Optimization, do not load the object when expanding an oid prefix
  `#397 &lt;https://github.com/libgit2/pygit2/pull/397&gt;`_
- Changes from version 0.20.1
  + Install fix
    `#382 &lt;https://github.com/libgit2/pygit2/pull/382&gt;`_
  + Documentation improved, including
    `#383 &lt;https://github.com/libgit2/pygit2/pull/383&gt;`_
    `#385 &lt;https://github.com/libgit2/pygit2/pull/385&gt;`_
    `#388 &lt;https://github.com/libgit2/pygit2/pull/388&gt;`_
  + Documentation, use the read-the-docs theme
    `#387 &lt;https://github.com/libgit2/pygit2/pull/387&gt;`_
  + Coding style improvements
    `#392 &lt;https://github.com/libgit2/pygit2/pull/392&gt;`_
  + New ``Repository.state_cleanup()``
    `#386 &lt;https://github.com/libgit2/pygit2/pull/386&gt;`_
  + New ``Index.conflicts``
    `#345 &lt;https://github.com/libgit2/pygit2/issues/345&gt;`_
    `#389 &lt;https://github.com/libgit2/pygit2/pull/389&gt;`_
  + New checkout option to define the target directory
    `#390 &lt;https://github.com/libgit2/pygit2/pull/390&gt;`_
- Fix build
- Remove python_sitelib definition; pygit2 is arch dependant
- Add python-cffi and python-unittest2 requirements; new
  dependencies
- Disable tests; network is now needed for launching them</changelog>
  <changelog author="dimstar@opensuse.org" date="1422964800">- Update to version 0.22.0:
  + Update to libgit2 v0.22
    (https://github.com/libgit2/pygit2/pull/459)
  + Add support for libgit2 feature detection (new pygit2.features
    and pygit2.GIT_FEATURE_*)
    (https://github.com/libgit2/pygit2/pull/475)
  + New Repository.remotes (RemoteCollection)
    (https://github.com/libgit2/pygit2/pull/447)
  + API Changes:
  - Prototype of clone_repository changed, check documentation
  - Removed clone_into, use clone_repository with callbacks instead
  - Use Repository.remotes.rename(name, new_name) instead of
    Remote.rename(new_name)
  - Use Repository.remotes.delete(name) instead of Remote.delete()
  - Now Remote.push(...) takes a list of refspecs instead of just one
  - Change Patch.old_id, Patch.new_id, Note.annotated_id,
    RefLogEntry.oid_old and RefLogEntry.oid_new to be Oid objects
    instead of strings
    (https://github.com/libgit2/pygit2/pull/449)
  + Other:
  - Fix init_repository when passing optional parameters
    workdir_path, description, template_path, initial_head or
    origin_url.
  - Fix use-after-free when patch outlives diff.
  - Documentation improvements.
  - Make the GPL exception explicit in setup.py.
- Add python-setuptools BuildRequires: new build dependency.</changelog>
  <changelog author="p.drouand@gmail.com" date="1442491200">- Update to version 0.23.0
  * Update to libgit2 v0.23
    (https://github.com/libgit2/pygit2/pull/540)
  * Now Repository.merge_base(...) returns None if no merge base is found
    (https://github.com/libgit2/pygit2/pull/550)
  * Documentation updates
    (https://github.com/libgit2/pygit2/pull/547)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1443528000">- Update to version 0.23.1
  * Improve support for cffi 1.0+
    (https://github.com/libgit2/pygit2/pull/529)
    (https://github.com/libgit2/pygit2/pull/561)
  * Fix Remote.push
    (https://github.com/libgit2/pygit2/pull/557)
  * New TreeEntry.type
    (https://github.com/libgit2/pygit2/pull/560)
  * New pygit2.GIT_DIFF_SHOW_BINARY
    (https://github.com/libgit2/pygit2/pull/566)</changelog>
  <changelog author="zaitor@opensuse.org" date="1460030400">- Update to version 0.24.0:
  + Support Python 3.5.
  + New dependency, python-six
  + New Repository.path_is_ignored(path).
  + Fix error in Repository(path) when path is a bytes string.
  + Fix memory issue in Repository.describe(...).
  + Allow testing with `tox.
- Add python-six BuildRequires following upstream changes.</changelog>
  <changelog author="tbechtold@suse.com" date="1471003200">- require the cffi version it was built against
- Use pypi.io as Source url</changelog>
  <changelog author="kkaempf@suse.com" date="1478088000">- Fix Url link (old one was dead).</changelog>
  <changelog author="astieger@suse.com" date="1484136000">- update to 0.24.2:
  * Fix when libgit2 error messages have non-ascii chars
  * Documentation improvements
- includes changes from 0.24.1
  * New Repository.listall_reference_objects()
  * Fix ``Repository.write_archive(...)`
  * Reproducible builds
  * Documentation fixes</changelog>
  <changelog author="toddrme2178@gmail.com" date="1491566400">- Update to 0.25.0.
  * Make pygit2 throw if tree of a commit is not found
  * fixed cached memory tests
  * Added mwindow_mapped_limit, cached_memory, enable_caching,
    cache_max_size, cache_object_limit options
- Implement singlespec version.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1503576000">- Update to 0.26.0
  * Update to libgit2 v0.26
  * Drop support for Python 3.2, add support for cffi 1.10
  * New ``Repository.revert_commit(...)``
  * New ``Branch.is_checked_out()``
  * Various fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1526558400">- Update to 0.27.0:
  * Update to libgit2 v0.27 #783
  * Fix for GCC 4 #786</changelog>
  <changelog author="tchvatal@suse.com" date="1526904000">- Add patch to fix issues on i586 arch:
  * pygit2-i586.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1553083200">- Update to 0.28.0
  * Update to libgit2 v0.28
  * New ``pygit2.Mailmap``
  * New ``Repository.apply(...)`` wraps ``git_apply(..)``
  * Now ``Repository.merge_analysis(...)`` accepts an optional reference parameter
  * Now ``Repository.add_worktree(...)`` accepts an optional reference parameter
  * Now it's possible to set SSL certificate locations
  * Test and documentation improvements
  * Now ``worktree.path`` returns the path to the worktree directory
  * Remove undocumented ``worktree.git_path``
- Remove unneeded patch to fix issues on i586:
  * pygit2-i586.patch
- Add patch to remove unneeded constraint on pycparser
  * pygit2-0.28-Remove-pycparser-constraint.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1553342400">- Drop the pygit2-0.28-Remove-pycparser-constraint.patch and replace
  it with shorter sed
- Switch to pytest testing:
  * Fails now but that is pycparser bug https://github.com/eliben/pycparser/issues/305
- Disable tests temporarily as per above</changelog>
  <changelog author="tchvatal@suse.com" date="1554724800">- Add patch to fix the pycparser issues as per bellow:
  * pycparser.patch</changelog>
  <changelog author="GSmith@suse.com" date="1557921600">- Update to 0.28.1
  * Removed patch pycparser.patch as it is no longer needed
  * Now works with pycparser 2.18 and above
  * Now ``Repository.write_archive(..)`` keeps the file mode
  * New ``Patch.data`` returns the raw contents of the patch as a byte string
  * New ``Patch.text`` returns the contents of the patch as a text string,</changelog>
  <changelog author="tchvatal@suse.com" date="1559563200">- Update to 0.28.2:
  * Fix crash in reflog iteration #901
  * Support symbolic references in branches.with_commit(..) #910
  * Documentation updates #909
  * Test updates #911</changelog>
  <changelog author="jgonzalez@suse.com" date="1575288000">- Fix building for s390x (bsc#1158198)</changelog>
</package>
<package pkgid="96c7e4d71f1a1f6086acbe6abc08b3133476a19ef5907868e8b3179f898ee3be" name="python3-pygit2" arch="aarch64">
  <version epoch="0" ver="0.28.2" rel="150400.17.4"/>
  <changelog author="dimstar@opensuse.org" date="1422964800">- Update to version 0.22.0:
  + Update to libgit2 v0.22
    (https://github.com/libgit2/pygit2/pull/459)
  + Add support for libgit2 feature detection (new pygit2.features
    and pygit2.GIT_FEATURE_*)
    (https://github.com/libgit2/pygit2/pull/475)
  + New Repository.remotes (RemoteCollection)
    (https://github.com/libgit2/pygit2/pull/447)
  + API Changes:
  - Prototype of clone_repository changed, check documentation
  - Removed clone_into, use clone_repository with callbacks instead
  - Use Repository.remotes.rename(name, new_name) instead of
    Remote.rename(new_name)
  - Use Repository.remotes.delete(name) instead of Remote.delete()
  - Now Remote.push(...) takes a list of refspecs instead of just one
  - Change Patch.old_id, Patch.new_id, Note.annotated_id,
    RefLogEntry.oid_old and RefLogEntry.oid_new to be Oid objects
    instead of strings
    (https://github.com/libgit2/pygit2/pull/449)
  + Other:
  - Fix init_repository when passing optional parameters
    workdir_path, description, template_path, initial_head or
    origin_url.
  - Fix use-after-free when patch outlives diff.
  - Documentation improvements.
  - Make the GPL exception explicit in setup.py.
- Add python-setuptools BuildRequires: new build dependency.</changelog>
  <changelog author="p.drouand@gmail.com" date="1442491200">- Update to version 0.23.0
  * Update to libgit2 v0.23
    (https://github.com/libgit2/pygit2/pull/540)
  * Now Repository.merge_base(...) returns None if no merge base is found
    (https://github.com/libgit2/pygit2/pull/550)
  * Documentation updates
    (https://github.com/libgit2/pygit2/pull/547)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1443528000">- Update to version 0.23.1
  * Improve support for cffi 1.0+
    (https://github.com/libgit2/pygit2/pull/529)
    (https://github.com/libgit2/pygit2/pull/561)
  * Fix Remote.push
    (https://github.com/libgit2/pygit2/pull/557)
  * New TreeEntry.type
    (https://github.com/libgit2/pygit2/pull/560)
  * New pygit2.GIT_DIFF_SHOW_BINARY
    (https://github.com/libgit2/pygit2/pull/566)</changelog>
  <changelog author="zaitor@opensuse.org" date="1460030400">- Update to version 0.24.0:
  + Support Python 3.5.
  + New dependency, python-six
  + New Repository.path_is_ignored(path).
  + Fix error in Repository(path) when path is a bytes string.
  + Fix memory issue in Repository.describe(...).
  + Allow testing with `tox.
- Add python-six BuildRequires following upstream changes.</changelog>
  <changelog author="tbechtold@suse.com" date="1471003200">- require the cffi version it was built against
- Use pypi.io as Source url</changelog>
  <changelog author="kkaempf@suse.com" date="1478088000">- Fix Url link (old one was dead).</changelog>
  <changelog author="astieger@suse.com" date="1484136000">- update to 0.24.2:
  * Fix when libgit2 error messages have non-ascii chars
  * Documentation improvements
- includes changes from 0.24.1
  * New Repository.listall_reference_objects()
  * Fix ``Repository.write_archive(...)`
  * Reproducible builds
  * Documentation fixes</changelog>
  <changelog author="toddrme2178@gmail.com" date="1491566400">- Update to 0.25.0.
  * Make pygit2 throw if tree of a commit is not found
  * fixed cached memory tests
  * Added mwindow_mapped_limit, cached_memory, enable_caching,
    cache_max_size, cache_object_limit options
- Implement singlespec version.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1503576000">- Update to 0.26.0
  * Update to libgit2 v0.26
  * Drop support for Python 3.2, add support for cffi 1.10
  * New ``Repository.revert_commit(...)``
  * New ``Branch.is_checked_out()``
  * Various fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1526558400">- Update to 0.27.0:
  * Update to libgit2 v0.27 #783
  * Fix for GCC 4 #786</changelog>
  <changelog author="tchvatal@suse.com" date="1526904000">- Add patch to fix issues on i586 arch:
  * pygit2-i586.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1553083200">- Update to 0.28.0
  * Update to libgit2 v0.28
  * New ``pygit2.Mailmap``
  * New ``Repository.apply(...)`` wraps ``git_apply(..)``
  * Now ``Repository.merge_analysis(...)`` accepts an optional reference parameter
  * Now ``Repository.add_worktree(...)`` accepts an optional reference parameter
  * Now it's possible to set SSL certificate locations
  * Test and documentation improvements
  * Now ``worktree.path`` returns the path to the worktree directory
  * Remove undocumented ``worktree.git_path``
- Remove unneeded patch to fix issues on i586:
  * pygit2-i586.patch
- Add patch to remove unneeded constraint on pycparser
  * pygit2-0.28-Remove-pycparser-constraint.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1553342400">- Drop the pygit2-0.28-Remove-pycparser-constraint.patch and replace
  it with shorter sed
- Switch to pytest testing:
  * Fails now but that is pycparser bug https://github.com/eliben/pycparser/issues/305
- Disable tests temporarily as per above</changelog>
  <changelog author="tchvatal@suse.com" date="1554724800">- Add patch to fix the pycparser issues as per bellow:
  * pycparser.patch</changelog>
  <changelog author="GSmith@suse.com" date="1557921600">- Update to 0.28.1
  * Removed patch pycparser.patch as it is no longer needed
  * Now works with pycparser 2.18 and above
  * Now ``Repository.write_archive(..)`` keeps the file mode
  * New ``Patch.data`` returns the raw contents of the patch as a byte string
  * New ``Patch.text`` returns the contents of the patch as a text string,</changelog>
  <changelog author="tchvatal@suse.com" date="1559563200">- Update to 0.28.2:
  * Fix crash in reflog iteration #901
  * Support symbolic references in branches.with_commit(..) #910
  * Documentation updates #909
  * Test updates #911</changelog>
  <changelog author="jgonzalez@suse.com" date="1575288000">- Fix building for s390x (bsc#1158198)</changelog>
</package>
<package pkgid="8e31fe09b77962a31f0699241da3e875b3d88d72ea1cadaacbeeff5414f39c83" name="python3-pygit2" arch="ppc64le">
  <version epoch="0" ver="0.28.2" rel="150400.17.4"/>
  <changelog author="dimstar@opensuse.org" date="1422964800">- Update to version 0.22.0:
  + Update to libgit2 v0.22
    (https://github.com/libgit2/pygit2/pull/459)
  + Add support for libgit2 feature detection (new pygit2.features
    and pygit2.GIT_FEATURE_*)
    (https://github.com/libgit2/pygit2/pull/475)
  + New Repository.remotes (RemoteCollection)
    (https://github.com/libgit2/pygit2/pull/447)
  + API Changes:
  - Prototype of clone_repository changed, check documentation
  - Removed clone_into, use clone_repository with callbacks instead
  - Use Repository.remotes.rename(name, new_name) instead of
    Remote.rename(new_name)
  - Use Repository.remotes.delete(name) instead of Remote.delete()
  - Now Remote.push(...) takes a list of refspecs instead of just one
  - Change Patch.old_id, Patch.new_id, Note.annotated_id,
    RefLogEntry.oid_old and RefLogEntry.oid_new to be Oid objects
    instead of strings
    (https://github.com/libgit2/pygit2/pull/449)
  + Other:
  - Fix init_repository when passing optional parameters
    workdir_path, description, template_path, initial_head or
    origin_url.
  - Fix use-after-free when patch outlives diff.
  - Documentation improvements.
  - Make the GPL exception explicit in setup.py.
- Add python-setuptools BuildRequires: new build dependency.</changelog>
  <changelog author="p.drouand@gmail.com" date="1442491200">- Update to version 0.23.0
  * Update to libgit2 v0.23
    (https://github.com/libgit2/pygit2/pull/540)
  * Now Repository.merge_base(...) returns None if no merge base is found
    (https://github.com/libgit2/pygit2/pull/550)
  * Documentation updates
    (https://github.com/libgit2/pygit2/pull/547)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1443528000">- Update to version 0.23.1
  * Improve support for cffi 1.0+
    (https://github.com/libgit2/pygit2/pull/529)
    (https://github.com/libgit2/pygit2/pull/561)
  * Fix Remote.push
    (https://github.com/libgit2/pygit2/pull/557)
  * New TreeEntry.type
    (https://github.com/libgit2/pygit2/pull/560)
  * New pygit2.GIT_DIFF_SHOW_BINARY
    (https://github.com/libgit2/pygit2/pull/566)</changelog>
  <changelog author="zaitor@opensuse.org" date="1460030400">- Update to version 0.24.0:
  + Support Python 3.5.
  + New dependency, python-six
  + New Repository.path_is_ignored(path).
  + Fix error in Repository(path) when path is a bytes string.
  + Fix memory issue in Repository.describe(...).
  + Allow testing with `tox.
- Add python-six BuildRequires following upstream changes.</changelog>
  <changelog author="tbechtold@suse.com" date="1471003200">- require the cffi version it was built against
- Use pypi.io as Source url</changelog>
  <changelog author="kkaempf@suse.com" date="1478088000">- Fix Url link (old one was dead).</changelog>
  <changelog author="astieger@suse.com" date="1484136000">- update to 0.24.2:
  * Fix when libgit2 error messages have non-ascii chars
  * Documentation improvements
- includes changes from 0.24.1
  * New Repository.listall_reference_objects()
  * Fix ``Repository.write_archive(...)`
  * Reproducible builds
  * Documentation fixes</changelog>
  <changelog author="toddrme2178@gmail.com" date="1491566400">- Update to 0.25.0.
  * Make pygit2 throw if tree of a commit is not found
  * fixed cached memory tests
  * Added mwindow_mapped_limit, cached_memory, enable_caching,
    cache_max_size, cache_object_limit options
- Implement singlespec version.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1503576000">- Update to 0.26.0
  * Update to libgit2 v0.26
  * Drop support for Python 3.2, add support for cffi 1.10
  * New ``Repository.revert_commit(...)``
  * New ``Branch.is_checked_out()``
  * Various fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1526558400">- Update to 0.27.0:
  * Update to libgit2 v0.27 #783
  * Fix for GCC 4 #786</changelog>
  <changelog author="tchvatal@suse.com" date="1526904000">- Add patch to fix issues on i586 arch:
  * pygit2-i586.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1553083200">- Update to 0.28.0
  * Update to libgit2 v0.28
  * New ``pygit2.Mailmap``
  * New ``Repository.apply(...)`` wraps ``git_apply(..)``
  * Now ``Repository.merge_analysis(...)`` accepts an optional reference parameter
  * Now ``Repository.add_worktree(...)`` accepts an optional reference parameter
  * Now it's possible to set SSL certificate locations
  * Test and documentation improvements
  * Now ``worktree.path`` returns the path to the worktree directory
  * Remove undocumented ``worktree.git_path``
- Remove unneeded patch to fix issues on i586:
  * pygit2-i586.patch
- Add patch to remove unneeded constraint on pycparser
  * pygit2-0.28-Remove-pycparser-constraint.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1553342400">- Drop the pygit2-0.28-Remove-pycparser-constraint.patch and replace
  it with shorter sed
- Switch to pytest testing:
  * Fails now but that is pycparser bug https://github.com/eliben/pycparser/issues/305
- Disable tests temporarily as per above</changelog>
  <changelog author="tchvatal@suse.com" date="1554724800">- Add patch to fix the pycparser issues as per bellow:
  * pycparser.patch</changelog>
  <changelog author="GSmith@suse.com" date="1557921600">- Update to 0.28.1
  * Removed patch pycparser.patch as it is no longer needed
  * Now works with pycparser 2.18 and above
  * Now ``Repository.write_archive(..)`` keeps the file mode
  * New ``Patch.data`` returns the raw contents of the patch as a byte string
  * New ``Patch.text`` returns the contents of the patch as a text string,</changelog>
  <changelog author="tchvatal@suse.com" date="1559563200">- Update to 0.28.2:
  * Fix crash in reflog iteration #901
  * Support symbolic references in branches.with_commit(..) #910
  * Documentation updates #909
  * Test updates #911</changelog>
  <changelog author="jgonzalez@suse.com" date="1575288000">- Fix building for s390x (bsc#1158198)</changelog>
</package>
<package pkgid="c26e585d5620312726c9cff15a172659fff523107152d8f6722b36ffb40dabb7" name="python3-pygit2" arch="s390x">
  <version epoch="0" ver="0.28.2" rel="150400.17.4"/>
  <changelog author="dimstar@opensuse.org" date="1422964800">- Update to version 0.22.0:
  + Update to libgit2 v0.22
    (https://github.com/libgit2/pygit2/pull/459)
  + Add support for libgit2 feature detection (new pygit2.features
    and pygit2.GIT_FEATURE_*)
    (https://github.com/libgit2/pygit2/pull/475)
  + New Repository.remotes (RemoteCollection)
    (https://github.com/libgit2/pygit2/pull/447)
  + API Changes:
  - Prototype of clone_repository changed, check documentation
  - Removed clone_into, use clone_repository with callbacks instead
  - Use Repository.remotes.rename(name, new_name) instead of
    Remote.rename(new_name)
  - Use Repository.remotes.delete(name) instead of Remote.delete()
  - Now Remote.push(...) takes a list of refspecs instead of just one
  - Change Patch.old_id, Patch.new_id, Note.annotated_id,
    RefLogEntry.oid_old and RefLogEntry.oid_new to be Oid objects
    instead of strings
    (https://github.com/libgit2/pygit2/pull/449)
  + Other:
  - Fix init_repository when passing optional parameters
    workdir_path, description, template_path, initial_head or
    origin_url.
  - Fix use-after-free when patch outlives diff.
  - Documentation improvements.
  - Make the GPL exception explicit in setup.py.
- Add python-setuptools BuildRequires: new build dependency.</changelog>
  <changelog author="p.drouand@gmail.com" date="1442491200">- Update to version 0.23.0
  * Update to libgit2 v0.23
    (https://github.com/libgit2/pygit2/pull/540)
  * Now Repository.merge_base(...) returns None if no merge base is found
    (https://github.com/libgit2/pygit2/pull/550)
  * Documentation updates
    (https://github.com/libgit2/pygit2/pull/547)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1443528000">- Update to version 0.23.1
  * Improve support for cffi 1.0+
    (https://github.com/libgit2/pygit2/pull/529)
    (https://github.com/libgit2/pygit2/pull/561)
  * Fix Remote.push
    (https://github.com/libgit2/pygit2/pull/557)
  * New TreeEntry.type
    (https://github.com/libgit2/pygit2/pull/560)
  * New pygit2.GIT_DIFF_SHOW_BINARY
    (https://github.com/libgit2/pygit2/pull/566)</changelog>
  <changelog author="zaitor@opensuse.org" date="1460030400">- Update to version 0.24.0:
  + Support Python 3.5.
  + New dependency, python-six
  + New Repository.path_is_ignored(path).
  + Fix error in Repository(path) when path is a bytes string.
  + Fix memory issue in Repository.describe(...).
  + Allow testing with `tox.
- Add python-six BuildRequires following upstream changes.</changelog>
  <changelog author="tbechtold@suse.com" date="1471003200">- require the cffi version it was built against
- Use pypi.io as Source url</changelog>
  <changelog author="kkaempf@suse.com" date="1478088000">- Fix Url link (old one was dead).</changelog>
  <changelog author="astieger@suse.com" date="1484136000">- update to 0.24.2:
  * Fix when libgit2 error messages have non-ascii chars
  * Documentation improvements
- includes changes from 0.24.1
  * New Repository.listall_reference_objects()
  * Fix ``Repository.write_archive(...)`
  * Reproducible builds
  * Documentation fixes</changelog>
  <changelog author="toddrme2178@gmail.com" date="1491566400">- Update to 0.25.0.
  * Make pygit2 throw if tree of a commit is not found
  * fixed cached memory tests
  * Added mwindow_mapped_limit, cached_memory, enable_caching,
    cache_max_size, cache_object_limit options
- Implement singlespec version.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1503576000">- Update to 0.26.0
  * Update to libgit2 v0.26
  * Drop support for Python 3.2, add support for cffi 1.10
  * New ``Repository.revert_commit(...)``
  * New ``Branch.is_checked_out()``
  * Various fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1526558400">- Update to 0.27.0:
  * Update to libgit2 v0.27 #783
  * Fix for GCC 4 #786</changelog>
  <changelog author="tchvatal@suse.com" date="1526904000">- Add patch to fix issues on i586 arch:
  * pygit2-i586.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1553083200">- Update to 0.28.0
  * Update to libgit2 v0.28
  * New ``pygit2.Mailmap``
  * New ``Repository.apply(...)`` wraps ``git_apply(..)``
  * Now ``Repository.merge_analysis(...)`` accepts an optional reference parameter
  * Now ``Repository.add_worktree(...)`` accepts an optional reference parameter
  * Now it's possible to set SSL certificate locations
  * Test and documentation improvements
  * Now ``worktree.path`` returns the path to the worktree directory
  * Remove undocumented ``worktree.git_path``
- Remove unneeded patch to fix issues on i586:
  * pygit2-i586.patch
- Add patch to remove unneeded constraint on pycparser
  * pygit2-0.28-Remove-pycparser-constraint.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1553342400">- Drop the pygit2-0.28-Remove-pycparser-constraint.patch and replace
  it with shorter sed
- Switch to pytest testing:
  * Fails now but that is pycparser bug https://github.com/eliben/pycparser/issues/305
- Disable tests temporarily as per above</changelog>
  <changelog author="tchvatal@suse.com" date="1554724800">- Add patch to fix the pycparser issues as per bellow:
  * pycparser.patch</changelog>
  <changelog author="GSmith@suse.com" date="1557921600">- Update to 0.28.1
  * Removed patch pycparser.patch as it is no longer needed
  * Now works with pycparser 2.18 and above
  * Now ``Repository.write_archive(..)`` keeps the file mode
  * New ``Patch.data`` returns the raw contents of the patch as a byte string
  * New ``Patch.text`` returns the contents of the patch as a text string,</changelog>
  <changelog author="tchvatal@suse.com" date="1559563200">- Update to 0.28.2:
  * Fix crash in reflog iteration #901
  * Support symbolic references in branches.with_commit(..) #910
  * Documentation updates #909
  * Test updates #911</changelog>
  <changelog author="jgonzalez@suse.com" date="1575288000">- Fix building for s390x (bsc#1158198)</changelog>
</package>
<package pkgid="833bdd8bff1a998e376aa143b8c3bcadf1e054c794c1a3c7651f2cf8cac287d8" name="python3-pygit2" arch="x86_64">
  <version epoch="0" ver="0.28.2" rel="150400.17.4"/>
  <changelog author="dimstar@opensuse.org" date="1422964800">- Update to version 0.22.0:
  + Update to libgit2 v0.22
    (https://github.com/libgit2/pygit2/pull/459)
  + Add support for libgit2 feature detection (new pygit2.features
    and pygit2.GIT_FEATURE_*)
    (https://github.com/libgit2/pygit2/pull/475)
  + New Repository.remotes (RemoteCollection)
    (https://github.com/libgit2/pygit2/pull/447)
  + API Changes:
  - Prototype of clone_repository changed, check documentation
  - Removed clone_into, use clone_repository with callbacks instead
  - Use Repository.remotes.rename(name, new_name) instead of
    Remote.rename(new_name)
  - Use Repository.remotes.delete(name) instead of Remote.delete()
  - Now Remote.push(...) takes a list of refspecs instead of just one
  - Change Patch.old_id, Patch.new_id, Note.annotated_id,
    RefLogEntry.oid_old and RefLogEntry.oid_new to be Oid objects
    instead of strings
    (https://github.com/libgit2/pygit2/pull/449)
  + Other:
  - Fix init_repository when passing optional parameters
    workdir_path, description, template_path, initial_head or
    origin_url.
  - Fix use-after-free when patch outlives diff.
  - Documentation improvements.
  - Make the GPL exception explicit in setup.py.
- Add python-setuptools BuildRequires: new build dependency.</changelog>
  <changelog author="p.drouand@gmail.com" date="1442491200">- Update to version 0.23.0
  * Update to libgit2 v0.23
    (https://github.com/libgit2/pygit2/pull/540)
  * Now Repository.merge_base(...) returns None if no merge base is found
    (https://github.com/libgit2/pygit2/pull/550)
  * Documentation updates
    (https://github.com/libgit2/pygit2/pull/547)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1443528000">- Update to version 0.23.1
  * Improve support for cffi 1.0+
    (https://github.com/libgit2/pygit2/pull/529)
    (https://github.com/libgit2/pygit2/pull/561)
  * Fix Remote.push
    (https://github.com/libgit2/pygit2/pull/557)
  * New TreeEntry.type
    (https://github.com/libgit2/pygit2/pull/560)
  * New pygit2.GIT_DIFF_SHOW_BINARY
    (https://github.com/libgit2/pygit2/pull/566)</changelog>
  <changelog author="zaitor@opensuse.org" date="1460030400">- Update to version 0.24.0:
  + Support Python 3.5.
  + New dependency, python-six
  + New Repository.path_is_ignored(path).
  + Fix error in Repository(path) when path is a bytes string.
  + Fix memory issue in Repository.describe(...).
  + Allow testing with `tox.
- Add python-six BuildRequires following upstream changes.</changelog>
  <changelog author="tbechtold@suse.com" date="1471003200">- require the cffi version it was built against
- Use pypi.io as Source url</changelog>
  <changelog author="kkaempf@suse.com" date="1478088000">- Fix Url link (old one was dead).</changelog>
  <changelog author="astieger@suse.com" date="1484136000">- update to 0.24.2:
  * Fix when libgit2 error messages have non-ascii chars
  * Documentation improvements
- includes changes from 0.24.1
  * New Repository.listall_reference_objects()
  * Fix ``Repository.write_archive(...)`
  * Reproducible builds
  * Documentation fixes</changelog>
  <changelog author="toddrme2178@gmail.com" date="1491566400">- Update to 0.25.0.
  * Make pygit2 throw if tree of a commit is not found
  * fixed cached memory tests
  * Added mwindow_mapped_limit, cached_memory, enable_caching,
    cache_max_size, cache_object_limit options
- Implement singlespec version.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1503576000">- Update to 0.26.0
  * Update to libgit2 v0.26
  * Drop support for Python 3.2, add support for cffi 1.10
  * New ``Repository.revert_commit(...)``
  * New ``Branch.is_checked_out()``
  * Various fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1526558400">- Update to 0.27.0:
  * Update to libgit2 v0.27 #783
  * Fix for GCC 4 #786</changelog>
  <changelog author="tchvatal@suse.com" date="1526904000">- Add patch to fix issues on i586 arch:
  * pygit2-i586.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1553083200">- Update to 0.28.0
  * Update to libgit2 v0.28
  * New ``pygit2.Mailmap``
  * New ``Repository.apply(...)`` wraps ``git_apply(..)``
  * Now ``Repository.merge_analysis(...)`` accepts an optional reference parameter
  * Now ``Repository.add_worktree(...)`` accepts an optional reference parameter
  * Now it's possible to set SSL certificate locations
  * Test and documentation improvements
  * Now ``worktree.path`` returns the path to the worktree directory
  * Remove undocumented ``worktree.git_path``
- Remove unneeded patch to fix issues on i586:
  * pygit2-i586.patch
- Add patch to remove unneeded constraint on pycparser
  * pygit2-0.28-Remove-pycparser-constraint.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1553342400">- Drop the pygit2-0.28-Remove-pycparser-constraint.patch and replace
  it with shorter sed
- Switch to pytest testing:
  * Fails now but that is pycparser bug https://github.com/eliben/pycparser/issues/305
- Disable tests temporarily as per above</changelog>
  <changelog author="tchvatal@suse.com" date="1554724800">- Add patch to fix the pycparser issues as per bellow:
  * pycparser.patch</changelog>
  <changelog author="GSmith@suse.com" date="1557921600">- Update to 0.28.1
  * Removed patch pycparser.patch as it is no longer needed
  * Now works with pycparser 2.18 and above
  * Now ``Repository.write_archive(..)`` keeps the file mode
  * New ``Patch.data`` returns the raw contents of the patch as a byte string
  * New ``Patch.text`` returns the contents of the patch as a text string,</changelog>
  <changelog author="tchvatal@suse.com" date="1559563200">- Update to 0.28.2:
  * Fix crash in reflog iteration #901
  * Support symbolic references in branches.with_commit(..) #910
  * Documentation updates #909
  * Test updates #911</changelog>
  <changelog author="jgonzalez@suse.com" date="1575288000">- Fix building for s390x (bsc#1158198)</changelog>
</package>
<package pkgid="899628dd62498b7ebf5d6bfe56c5c8680a363c5e46ad95e746c684def5064178" name="python3-pyhcl" arch="aarch64">
  <version epoch="0" ver="0.4.2" rel="150400.8.1"/>
  <changelog author="jgonzalez@suse.com" date="1585915200">- Initial version</changelog>
</package>
<package pkgid="3292acd35312764cc5f3a8f415a3d999bfac1fcf3bf0518e67096a60a8c5e735" name="python3-pyhcl" arch="ppc64le">
  <version epoch="0" ver="0.4.2" rel="150400.8.1"/>
  <changelog author="jgonzalez@suse.com" date="1585915200">- Initial version</changelog>
</package>
<package pkgid="3342f6ac8cf548fd97c90da784ec5dbd1e25b119f375d81d99dcffd84333c1bc" name="python3-pyhcl" arch="s390x">
  <version epoch="0" ver="0.4.2" rel="150400.8.1"/>
  <changelog author="jgonzalez@suse.com" date="1585915200">- Initial version</changelog>
</package>
<package pkgid="ec321db540d289e632d5eb21dd135480d994c1154253e90102b05a13bcc6a04f" name="python3-pyhcl" arch="x86_64">
  <version epoch="0" ver="0.4.2" rel="150400.8.1"/>
  <changelog author="jgonzalez@suse.com" date="1585915200">- Initial version</changelog>
</package>
<package pkgid="86fdc45e914763dc8c9d62b939bc3e1bb81e3af259dfdb2d76b277eb24ccb0ce" name="tito" arch="aarch64">
  <version epoch="0" ver="0.6.11" rel="150400.19.1"/>
  <changelog author="jgonzalez@suse.com" date="1584100800">- Enable support for CentOS, RHEL, Fedora, Debian and Ubuntu</changelog>
  <changelog author="mc@suse.com" date="1614686400">- handle package dependencies during tagging</changelog>
  <changelog author="mc@suse.com" date="1615204800">- support dbschema dependencies</changelog>
  <changelog author="jgonzalez@suse.com" date="1631534400">- Use the SUSE changelog format
- Offer the user the right git remote</changelog>
  <changelog author="mc@suse.com" date="1643112000">- support new style dbschema dependencies in tito.props</changelog>
  <changelog author="marina.latini@suse.com" date="1665489600">- Update the copyright year
- Remove superfluous %clean section supported by RPM clean logic
- Fix bad if condition and use quote instead of bare words</changelog>
  <changelog author="marina.latini@suse.com" date="1665489601">- Update the packager email address.
- Suppress rpmlint warning hardcoded-packager-tag.
  We want to keep the packager tag.
  Added: hardcoded-packager-tag-rpmlintrc</changelog>
  <changelog author="artem.shiliaev@suse.com" date="1670587200">- Added SUSEContainerTagger to tag dockerfiles and Helm charts</changelog>
  <changelog author="cbbayburt@suse.com" date="1685707200">- Implement changelog split/merge mechanism</changelog>
  <changelog author="can.bulut.bayburt@suse.com" date="1696939200">- Add missing newlines when merging changelogs</changelog>
  <changelog author="cbosdonnat@suse.com" date="1699358400">- Use the project folder name to look for changes file of helm charts</changelog>
  <changelog author="cbosdonnat@suse.com" date="1699444800">- Revert the -helm suffix removal for charts to avoid conflicts in registry</changelog>
  <changelog author="cbosdonnat@suse.com" date="1704974400">- Do not replace the version in the whole Dockerfile or Charts.yaml</changelog>
  <changelog author="thomas.florio@suse.com" date="1713268800">- Add all modified pom.xml by maven when committing
- Added:
  * 0015-add-all-modified-pom.xml-by-maven.patch</changelog>
  <changelog author="jgonzalez@suse.com" date="1733918400">- maven is now a new requirement, to be able to tag microservices</changelog>
  <changelog author="cbosdonnat@suse.com" date="1734523200">- Handle kiwi images.</changelog>
  <changelog author="rosuna@suse.com" date="1738670400">- Use default release 0 for parameter --use-release
- Added:
  * 0016-Use-default-release-0-for-parameter-use-release.patch</changelog>
  <changelog author="mc@suse.com" date="1778673600">- Handle multibuild images with susecontainertagger
- Add 0016-handle-multibuild-container-directories.patch
- Renumber patches</changelog>
  <changelog author="mc@suse.com" date="1779278400">- Ignore dummy Dockerfile in multibuild images
  * Added: 0017-Ignore-dummy-Dockerfile-in-multibuild-images.patch</changelog>
  <changelog author="mc@suse.com" date="1779451200">- Fix exscape sequences with newer python versions
  * Added: 0018-fix-invalid-escape-sequence-warnings.patch
  * Modified: 0017-Ignore-dummy-Dockerfile-in-multibuild-images.patch</changelog>
</package>
<package pkgid="10d5ef7c2aed7e7d2c17f7187305778e7baf3024f5f826c6f98e2c4ee2abc1f0" name="tito" arch="ppc64le">
  <version epoch="0" ver="0.6.11" rel="150400.19.1"/>
  <changelog author="jgonzalez@suse.com" date="1584100800">- Enable support for CentOS, RHEL, Fedora, Debian and Ubuntu</changelog>
  <changelog author="mc@suse.com" date="1614686400">- handle package dependencies during tagging</changelog>
  <changelog author="mc@suse.com" date="1615204800">- support dbschema dependencies</changelog>
  <changelog author="jgonzalez@suse.com" date="1631534400">- Use the SUSE changelog format
- Offer the user the right git remote</changelog>
  <changelog author="mc@suse.com" date="1643112000">- support new style dbschema dependencies in tito.props</changelog>
  <changelog author="marina.latini@suse.com" date="1665489600">- Update the copyright year
- Remove superfluous %clean section supported by RPM clean logic
- Fix bad if condition and use quote instead of bare words</changelog>
  <changelog author="marina.latini@suse.com" date="1665489601">- Update the packager email address.
- Suppress rpmlint warning hardcoded-packager-tag.
  We want to keep the packager tag.
  Added: hardcoded-packager-tag-rpmlintrc</changelog>
  <changelog author="artem.shiliaev@suse.com" date="1670587200">- Added SUSEContainerTagger to tag dockerfiles and Helm charts</changelog>
  <changelog author="cbbayburt@suse.com" date="1685707200">- Implement changelog split/merge mechanism</changelog>
  <changelog author="can.bulut.bayburt@suse.com" date="1696939200">- Add missing newlines when merging changelogs</changelog>
  <changelog author="cbosdonnat@suse.com" date="1699358400">- Use the project folder name to look for changes file of helm charts</changelog>
  <changelog author="cbosdonnat@suse.com" date="1699444800">- Revert the -helm suffix removal for charts to avoid conflicts in registry</changelog>
  <changelog author="cbosdonnat@suse.com" date="1704974400">- Do not replace the version in the whole Dockerfile or Charts.yaml</changelog>
  <changelog author="thomas.florio@suse.com" date="1713268800">- Add all modified pom.xml by maven when committing
- Added:
  * 0015-add-all-modified-pom.xml-by-maven.patch</changelog>
  <changelog author="jgonzalez@suse.com" date="1733918400">- maven is now a new requirement, to be able to tag microservices</changelog>
  <changelog author="cbosdonnat@suse.com" date="1734523200">- Handle kiwi images.</changelog>
  <changelog author="rosuna@suse.com" date="1738670400">- Use default release 0 for parameter --use-release
- Added:
  * 0016-Use-default-release-0-for-parameter-use-release.patch</changelog>
  <changelog author="mc@suse.com" date="1778673600">- Handle multibuild images with susecontainertagger
- Add 0016-handle-multibuild-container-directories.patch
- Renumber patches</changelog>
  <changelog author="mc@suse.com" date="1779278400">- Ignore dummy Dockerfile in multibuild images
  * Added: 0017-Ignore-dummy-Dockerfile-in-multibuild-images.patch</changelog>
  <changelog author="mc@suse.com" date="1779451200">- Fix exscape sequences with newer python versions
  * Added: 0018-fix-invalid-escape-sequence-warnings.patch
  * Modified: 0017-Ignore-dummy-Dockerfile-in-multibuild-images.patch</changelog>
</package>
<package pkgid="c4ec221bf8b74fb0e60bed53a3a3025386af6dcc4fcaa0df409348e331cde5f6" name="tito" arch="s390x">
  <version epoch="0" ver="0.6.11" rel="150400.19.1"/>
  <changelog author="jgonzalez@suse.com" date="1584100800">- Enable support for CentOS, RHEL, Fedora, Debian and Ubuntu</changelog>
  <changelog author="mc@suse.com" date="1614686400">- handle package dependencies during tagging</changelog>
  <changelog author="mc@suse.com" date="1615204800">- support dbschema dependencies</changelog>
  <changelog author="jgonzalez@suse.com" date="1631534400">- Use the SUSE changelog format
- Offer the user the right git remote</changelog>
  <changelog author="mc@suse.com" date="1643112000">- support new style dbschema dependencies in tito.props</changelog>
  <changelog author="marina.latini@suse.com" date="1665489600">- Update the copyright year
- Remove superfluous %clean section supported by RPM clean logic
- Fix bad if condition and use quote instead of bare words</changelog>
  <changelog author="marina.latini@suse.com" date="1665489601">- Update the packager email address.
- Suppress rpmlint warning hardcoded-packager-tag.
  We want to keep the packager tag.
  Added: hardcoded-packager-tag-rpmlintrc</changelog>
  <changelog author="artem.shiliaev@suse.com" date="1670587200">- Added SUSEContainerTagger to tag dockerfiles and Helm charts</changelog>
  <changelog author="cbbayburt@suse.com" date="1685707200">- Implement changelog split/merge mechanism</changelog>
  <changelog author="can.bulut.bayburt@suse.com" date="1696939200">- Add missing newlines when merging changelogs</changelog>
  <changelog author="cbosdonnat@suse.com" date="1699358400">- Use the project folder name to look for changes file of helm charts</changelog>
  <changelog author="cbosdonnat@suse.com" date="1699444800">- Revert the -helm suffix removal for charts to avoid conflicts in registry</changelog>
  <changelog author="cbosdonnat@suse.com" date="1704974400">- Do not replace the version in the whole Dockerfile or Charts.yaml</changelog>
  <changelog author="thomas.florio@suse.com" date="1713268800">- Add all modified pom.xml by maven when committing
- Added:
  * 0015-add-all-modified-pom.xml-by-maven.patch</changelog>
  <changelog author="jgonzalez@suse.com" date="1733918400">- maven is now a new requirement, to be able to tag microservices</changelog>
  <changelog author="cbosdonnat@suse.com" date="1734523200">- Handle kiwi images.</changelog>
  <changelog author="rosuna@suse.com" date="1738670400">- Use default release 0 for parameter --use-release
- Added:
  * 0016-Use-default-release-0-for-parameter-use-release.patch</changelog>
  <changelog author="mc@suse.com" date="1778673600">- Handle multibuild images with susecontainertagger
- Add 0016-handle-multibuild-container-directories.patch
- Renumber patches</changelog>
  <changelog author="mc@suse.com" date="1779278400">- Ignore dummy Dockerfile in multibuild images
  * Added: 0017-Ignore-dummy-Dockerfile-in-multibuild-images.patch</changelog>
  <changelog author="mc@suse.com" date="1779451200">- Fix exscape sequences with newer python versions
  * Added: 0018-fix-invalid-escape-sequence-warnings.patch
  * Modified: 0017-Ignore-dummy-Dockerfile-in-multibuild-images.patch</changelog>
</package>
<package pkgid="81a878290a4ac82561356e9190c5bce04ef73439676f375c267a2e54fbb25170" name="tito" arch="src">
  <version epoch="0" ver="0.6.11" rel="150400.19.1"/>
  <changelog author="jgonzalez@suse.com" date="1584100800">- Enable support for CentOS, RHEL, Fedora, Debian and Ubuntu</changelog>
  <changelog author="mc@suse.com" date="1614686400">- handle package dependencies during tagging</changelog>
  <changelog author="mc@suse.com" date="1615204800">- support dbschema dependencies</changelog>
  <changelog author="jgonzalez@suse.com" date="1631534400">- Use the SUSE changelog format
- Offer the user the right git remote</changelog>
  <changelog author="mc@suse.com" date="1643112000">- support new style dbschema dependencies in tito.props</changelog>
  <changelog author="marina.latini@suse.com" date="1665489600">- Update the copyright year
- Remove superfluous %clean section supported by RPM clean logic
- Fix bad if condition and use quote instead of bare words</changelog>
  <changelog author="marina.latini@suse.com" date="1665489601">- Update the packager email address.
- Suppress rpmlint warning hardcoded-packager-tag.
  We want to keep the packager tag.
  Added: hardcoded-packager-tag-rpmlintrc</changelog>
  <changelog author="artem.shiliaev@suse.com" date="1670587200">- Added SUSEContainerTagger to tag dockerfiles and Helm charts</changelog>
  <changelog author="cbbayburt@suse.com" date="1685707200">- Implement changelog split/merge mechanism</changelog>
  <changelog author="can.bulut.bayburt@suse.com" date="1696939200">- Add missing newlines when merging changelogs</changelog>
  <changelog author="cbosdonnat@suse.com" date="1699358400">- Use the project folder name to look for changes file of helm charts</changelog>
  <changelog author="cbosdonnat@suse.com" date="1699444800">- Revert the -helm suffix removal for charts to avoid conflicts in registry</changelog>
  <changelog author="cbosdonnat@suse.com" date="1704974400">- Do not replace the version in the whole Dockerfile or Charts.yaml</changelog>
  <changelog author="thomas.florio@suse.com" date="1713268800">- Add all modified pom.xml by maven when committing
- Added:
  * 0015-add-all-modified-pom.xml-by-maven.patch</changelog>
  <changelog author="jgonzalez@suse.com" date="1733918400">- maven is now a new requirement, to be able to tag microservices</changelog>
  <changelog author="cbosdonnat@suse.com" date="1734523200">- Handle kiwi images.</changelog>
  <changelog author="rosuna@suse.com" date="1738670400">- Use default release 0 for parameter --use-release
- Added:
  * 0016-Use-default-release-0-for-parameter-use-release.patch</changelog>
  <changelog author="mc@suse.com" date="1778673600">- Handle multibuild images with susecontainertagger
- Add 0016-handle-multibuild-container-directories.patch
- Renumber patches</changelog>
  <changelog author="mc@suse.com" date="1779278400">- Ignore dummy Dockerfile in multibuild images
  * Added: 0017-Ignore-dummy-Dockerfile-in-multibuild-images.patch</changelog>
  <changelog author="mc@suse.com" date="1779451200">- Fix exscape sequences with newer python versions
  * Added: 0018-fix-invalid-escape-sequence-warnings.patch
  * Modified: 0017-Ignore-dummy-Dockerfile-in-multibuild-images.patch</changelog>
</package>
<package pkgid="e2abe88c226f3afe03c72b3eb934ad8d40bf30d4cd4a393c17117be4ca1171c6" name="tito" arch="x86_64">
  <version epoch="0" ver="0.6.11" rel="150400.19.1"/>
  <changelog author="jgonzalez@suse.com" date="1584100800">- Enable support for CentOS, RHEL, Fedora, Debian and Ubuntu</changelog>
  <changelog author="mc@suse.com" date="1614686400">- handle package dependencies during tagging</changelog>
  <changelog author="mc@suse.com" date="1615204800">- support dbschema dependencies</changelog>
  <changelog author="jgonzalez@suse.com" date="1631534400">- Use the SUSE changelog format
- Offer the user the right git remote</changelog>
  <changelog author="mc@suse.com" date="1643112000">- support new style dbschema dependencies in tito.props</changelog>
  <changelog author="marina.latini@suse.com" date="1665489600">- Update the copyright year
- Remove superfluous %clean section supported by RPM clean logic
- Fix bad if condition and use quote instead of bare words</changelog>
  <changelog author="marina.latini@suse.com" date="1665489601">- Update the packager email address.
- Suppress rpmlint warning hardcoded-packager-tag.
  We want to keep the packager tag.
  Added: hardcoded-packager-tag-rpmlintrc</changelog>
  <changelog author="artem.shiliaev@suse.com" date="1670587200">- Added SUSEContainerTagger to tag dockerfiles and Helm charts</changelog>
  <changelog author="cbbayburt@suse.com" date="1685707200">- Implement changelog split/merge mechanism</changelog>
  <changelog author="can.bulut.bayburt@suse.com" date="1696939200">- Add missing newlines when merging changelogs</changelog>
  <changelog author="cbosdonnat@suse.com" date="1699358400">- Use the project folder name to look for changes file of helm charts</changelog>
  <changelog author="cbosdonnat@suse.com" date="1699444800">- Revert the -helm suffix removal for charts to avoid conflicts in registry</changelog>
  <changelog author="cbosdonnat@suse.com" date="1704974400">- Do not replace the version in the whole Dockerfile or Charts.yaml</changelog>
  <changelog author="thomas.florio@suse.com" date="1713268800">- Add all modified pom.xml by maven when committing
- Added:
  * 0015-add-all-modified-pom.xml-by-maven.patch</changelog>
  <changelog author="jgonzalez@suse.com" date="1733918400">- maven is now a new requirement, to be able to tag microservices</changelog>
  <changelog author="cbosdonnat@suse.com" date="1734523200">- Handle kiwi images.</changelog>
  <changelog author="rosuna@suse.com" date="1738670400">- Use default release 0 for parameter --use-release
- Added:
  * 0016-Use-default-release-0-for-parameter-use-release.patch</changelog>
  <changelog author="mc@suse.com" date="1778673600">- Handle multibuild images with susecontainertagger
- Add 0016-handle-multibuild-container-directories.patch
- Renumber patches</changelog>
  <changelog author="mc@suse.com" date="1779278400">- Ignore dummy Dockerfile in multibuild images
  * Added: 0017-Ignore-dummy-Dockerfile-in-multibuild-images.patch</changelog>
  <changelog author="mc@suse.com" date="1779451200">- Fix exscape sequences with newer python versions
  * Added: 0018-fix-invalid-escape-sequence-warnings.patch
  * Modified: 0017-Ignore-dummy-Dockerfile-in-multibuild-images.patch</changelog>
</package>
<package pkgid="04fb48ea9ddc7c945e8428668cbadd440f8660a9a512a7902eed9aec89239e4d" name="uyuni-releng-tools" arch="noarch">
  <version epoch="0" ver="0.0.11" rel="150400.1.1"/>
  <changelog author="cbosdonnat@suse.com" date="1701086400">- Initial packaging of uyuni-releng-tools 0.0.1</changelog>
  <changelog author="marina.latini@suse.com" date="1710849600">- version 0.0.2-0
  * Use product version in Dockerfile and Charts.yaml
  * Remove the container-related hacks in push and build scripts
  * Handle pushes of packages with multiple archives
  * Fix the path when pushing containers and helm charts to OBS
  * Remove unneeded replaces from push-packages-to-obs</changelog>
  <changelog author="marina.latini@suse.com" date="1712577600">- version 0.0.3-0
  * Ensure that the Release version is set to 0 and not to 1</changelog>
  <changelog author="marina.latini@suse.com" date="1712664000">- version 0.0.4-0
  * Do not hardcode a fixed release value but align it with the
    value used while tagging</changelog>
  <changelog author="marina.latini@suse.com" date="1717416000">- version 0.0.5-0
  * Specify the oscrc file using --config instead of -c
  * Add '-c|--commit' option to mkchlog for convenience</changelog>
  <changelog author="marina.latini@suse.com" date="1741176000">- version 0.0.6-0
  * push-packages-to-obs: add no-dereference option while diffing</changelog>
  <changelog author="michael.calmer@suse.com" date="1768219200">- version 0.0.7-0
  * Support building with tar archive instead of cpio
  * mkchlog: remove repeated and trailing spaces from the message
  * mkchlog: fix the feature name when the branch name contains a /
  * Add push-packages-to-git script
  * require git-lfs for working with the new git workflow
  * Add obs_subproject_creator.py and update README
  * add push-to-obs scripts</changelog>
  <changelog author="marina.latini@suse.com" date="1779192000">- version 0.0.8-0
  * Only check -N and -E if pushing to git</changelog>
  <changelog author="psuarezhernandez@suse.com" date="1781784000">- version 0.0.9-0
  * Add script to check version-release between Stable and Master</changelog>
  <changelog author="psuarezhernandez@suse.com" date="1781784001">- version 0.0.10-0
  * Fix installation issues in non-SUSE distributions</changelog>
  <changelog author="psuarezhernandez@suse.com" date="1783684800">- version 0.0.11-0
  * compare-uyuni-repos: fix issue if pkgA has pkgB on its name</changelog>
</package>
<package pkgid="824bbe2f382de0d69707e42c449a1e064d6638900f77c7eb2f377edb053370a2" name="uyuni-releng-tools" arch="src">
  <version epoch="0" ver="0.0.11" rel="150400.1.1"/>
  <changelog author="cbosdonnat@suse.com" date="1701086400">- Initial packaging of uyuni-releng-tools 0.0.1</changelog>
  <changelog author="marina.latini@suse.com" date="1710849600">- version 0.0.2-0
  * Use product version in Dockerfile and Charts.yaml
  * Remove the container-related hacks in push and build scripts
  * Handle pushes of packages with multiple archives
  * Fix the path when pushing containers and helm charts to OBS
  * Remove unneeded replaces from push-packages-to-obs</changelog>
  <changelog author="marina.latini@suse.com" date="1712577600">- version 0.0.3-0
  * Ensure that the Release version is set to 0 and not to 1</changelog>
  <changelog author="marina.latini@suse.com" date="1712664000">- version 0.0.4-0
  * Do not hardcode a fixed release value but align it with the
    value used while tagging</changelog>
  <changelog author="marina.latini@suse.com" date="1717416000">- version 0.0.5-0
  * Specify the oscrc file using --config instead of -c
  * Add '-c|--commit' option to mkchlog for convenience</changelog>
  <changelog author="marina.latini@suse.com" date="1741176000">- version 0.0.6-0
  * push-packages-to-obs: add no-dereference option while diffing</changelog>
  <changelog author="michael.calmer@suse.com" date="1768219200">- version 0.0.7-0
  * Support building with tar archive instead of cpio
  * mkchlog: remove repeated and trailing spaces from the message
  * mkchlog: fix the feature name when the branch name contains a /
  * Add push-packages-to-git script
  * require git-lfs for working with the new git workflow
  * Add obs_subproject_creator.py and update README
  * add push-to-obs scripts</changelog>
  <changelog author="marina.latini@suse.com" date="1779192000">- version 0.0.8-0
  * Only check -N and -E if pushing to git</changelog>
  <changelog author="psuarezhernandez@suse.com" date="1781784000">- version 0.0.9-0
  * Add script to check version-release between Stable and Master</changelog>
  <changelog author="psuarezhernandez@suse.com" date="1781784001">- version 0.0.10-0
  * Fix installation issues in non-SUSE distributions</changelog>
  <changelog author="psuarezhernandez@suse.com" date="1783684800">- version 0.0.11-0
  * compare-uyuni-repos: fix issue if pkgA has pkgB on its name</changelog>
</package>
<package pkgid="41c7aa93c928860ed23f5f570dc78648bf9d3d2e9799c99902640582039751ec" name="yarn" arch="noarch">
  <version epoch="0" ver="1.22.10" rel="2.1"/>
  <changelog author="mrueckert@suse.de" date="1552996800">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1556625600">- update to 1.16.0
  - Retries downloading a package on `yarn install` when we get a ETIMEDOUT error.
    [#7163](https://github.com/yarnpkg/yarn/pull/7163) - [**Vincent Bailly**](https://github.com/VincentBailly)
  - Implements `yarn audit --level [severity]` flag to filter the audit command's output.
    [#6716](https://github.com/yarnpkg/yarn/pull/6716) - [**Rogério Vicente**](https://twitter.com/rogeriopvl)
  - Implements `yarn audit --groups group_name [group_name ...]`.
    [#6724](https://github.com/yarnpkg/yarn/pull/6724) - [**Tom Milligan**](https://github.com/tommilligan)
  - Exposes the script environment variables to `yarn create` spawned processes.
    [#7127](https://github.com/yarnpkg/yarn/pull/7127) - [**Eli Perelman**](https://github.com/eliperelman)
  - Prevents EPIPE errors from being printed.
    [#7194](https://github.com/yarnpkg/yarn/pull/7194) - [**Abhishek Reddy**](https://github.com/arbscht)
  - Adds support for the npm enterprise URLs when computing the offline mirror filenames.
    [#7200](https://github.com/yarnpkg/yarn/pull/7200) - [**John Millikin**](https://john-millikin.com)
  - Tweaks the lockfile parser logic to parse a few extra cases
    [#7210](https://github.com/yarnpkg/yarn/pull/7210) - [**Maël Nison**](https://twitter.com/arcanis)</changelog>
  <changelog author="mrueckert@suse.de" date="1568894400">- update to 1.17.3
  https://github.com/yarnpkg/yarn/releases/tag/v1.17.0
  https://github.com/yarnpkg/yarn/releases/tag/v1.17.1
  https://github.com/yarnpkg/yarn/releases/tag/v1.17.2
  https://github.com/yarnpkg/yarn/releases/tag/v1.17.3</changelog>
  <changelog author="mrueckert@suse.de" date="1569758400">- update to 1.19.0
  https://github.com/yarnpkg/yarn/releases/tag/v1.18.0
  https://github.com/yarnpkg/yarn/releases/tag/v1.19.0</changelog>
  <changelog author="mrueckert@suse.de" date="1570536000">- update to 1.19.1
  https://github.com/yarnpkg/yarn/releases/tag/v1.19.1</changelog>
  <changelog author="mrueckert@suse.de" date="1574424000">- update to 1.19.2
  https://github.com/yarnpkg/yarn/releases/tag/v1.19.2</changelog>
  <changelog author="mrueckert@suse.de" date="1575288000">- update to 1.21.0
  https://github.com/yarnpkg/yarn/releases/tag/v1.20.0
  https://github.com/yarnpkg/yarn/releases/tag/v1.21.0</changelog>
  <changelog author="mrueckert@suse.de" date="1576065600">- update to 1.21.1
  https://github.com/yarnpkg/yarn/releases/tag/v1.21.1</changelog>
  <changelog author="mrueckert@suse.de" date="1580990400">- update to 1.22.0
  https://github.com/yarnpkg/yarn/releases/tag/v1.22.0</changelog>
  <changelog author="mrueckert@suse.de" date="1583496000">- update to 1.22.1
  https://github.com/yarnpkg/yarn/releases/tag/v1.22.1</changelog>
  <changelog author="mrueckert@suse.de" date="1583582400">- update to 1.22.2
  https://github.com/yarnpkg/yarn/releases/tag/v1.22.2</changelog>
  <changelog author="mrueckert@suse.de" date="1583755200">- update to 1.22.4
  https://github.com/yarnpkg/yarn/releases/tag/v1.22.3
  https://github.com/yarnpkg/yarn/releases/tag/v1.22.4</changelog>
  <changelog author="mschnitzer@suse.com" date="1586865600">- Remove nodejs from build requires
  Just the runtime dependency is needed.</changelog>
  <changelog author="mrueckert@suse.de" date="1598529600">- update to 1.22.5
  https://github.com/yarnpkg/yarn/releases/tag/v1.22.5</changelog>
  <changelog author="dmueller@suse.com" date="1605096000">- update to 1.22.10:
  https://github.com/yarnpkg/yarn/releases/tag/v1.22. 10</changelog>
</package>
<package pkgid="fa2d4af54a01d37f6e35b9abb481f9309dd303d5aa11979a25de4942a4e46232" name="yarn" arch="src">
  <version epoch="0" ver="1.22.10" rel="2.1"/>
  <changelog author="mrueckert@suse.de" date="1552996800">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1556625600">- update to 1.16.0
  - Retries downloading a package on `yarn install` when we get a ETIMEDOUT error.
    [#7163](https://github.com/yarnpkg/yarn/pull/7163) - [**Vincent Bailly**](https://github.com/VincentBailly)
  - Implements `yarn audit --level [severity]` flag to filter the audit command's output.
    [#6716](https://github.com/yarnpkg/yarn/pull/6716) - [**Rogério Vicente**](https://twitter.com/rogeriopvl)
  - Implements `yarn audit --groups group_name [group_name ...]`.
    [#6724](https://github.com/yarnpkg/yarn/pull/6724) - [**Tom Milligan**](https://github.com/tommilligan)
  - Exposes the script environment variables to `yarn create` spawned processes.
    [#7127](https://github.com/yarnpkg/yarn/pull/7127) - [**Eli Perelman**](https://github.com/eliperelman)
  - Prevents EPIPE errors from being printed.
    [#7194](https://github.com/yarnpkg/yarn/pull/7194) - [**Abhishek Reddy**](https://github.com/arbscht)
  - Adds support for the npm enterprise URLs when computing the offline mirror filenames.
    [#7200](https://github.com/yarnpkg/yarn/pull/7200) - [**John Millikin**](https://john-millikin.com)
  - Tweaks the lockfile parser logic to parse a few extra cases
    [#7210](https://github.com/yarnpkg/yarn/pull/7210) - [**Maël Nison**](https://twitter.com/arcanis)</changelog>
  <changelog author="mrueckert@suse.de" date="1568894400">- update to 1.17.3
  https://github.com/yarnpkg/yarn/releases/tag/v1.17.0
  https://github.com/yarnpkg/yarn/releases/tag/v1.17.1
  https://github.com/yarnpkg/yarn/releases/tag/v1.17.2
  https://github.com/yarnpkg/yarn/releases/tag/v1.17.3</changelog>
  <changelog author="mrueckert@suse.de" date="1569758400">- update to 1.19.0
  https://github.com/yarnpkg/yarn/releases/tag/v1.18.0
  https://github.com/yarnpkg/yarn/releases/tag/v1.19.0</changelog>
  <changelog author="mrueckert@suse.de" date="1570536000">- update to 1.19.1
  https://github.com/yarnpkg/yarn/releases/tag/v1.19.1</changelog>
  <changelog author="mrueckert@suse.de" date="1574424000">- update to 1.19.2
  https://github.com/yarnpkg/yarn/releases/tag/v1.19.2</changelog>
  <changelog author="mrueckert@suse.de" date="1575288000">- update to 1.21.0
  https://github.com/yarnpkg/yarn/releases/tag/v1.20.0
  https://github.com/yarnpkg/yarn/releases/tag/v1.21.0</changelog>
  <changelog author="mrueckert@suse.de" date="1576065600">- update to 1.21.1
  https://github.com/yarnpkg/yarn/releases/tag/v1.21.1</changelog>
  <changelog author="mrueckert@suse.de" date="1580990400">- update to 1.22.0
  https://github.com/yarnpkg/yarn/releases/tag/v1.22.0</changelog>
  <changelog author="mrueckert@suse.de" date="1583496000">- update to 1.22.1
  https://github.com/yarnpkg/yarn/releases/tag/v1.22.1</changelog>
  <changelog author="mrueckert@suse.de" date="1583582400">- update to 1.22.2
  https://github.com/yarnpkg/yarn/releases/tag/v1.22.2</changelog>
  <changelog author="mrueckert@suse.de" date="1583755200">- update to 1.22.4
  https://github.com/yarnpkg/yarn/releases/tag/v1.22.3
  https://github.com/yarnpkg/yarn/releases/tag/v1.22.4</changelog>
  <changelog author="mschnitzer@suse.com" date="1586865600">- Remove nodejs from build requires
  Just the runtime dependency is needed.</changelog>
  <changelog author="mrueckert@suse.de" date="1598529600">- update to 1.22.5
  https://github.com/yarnpkg/yarn/releases/tag/v1.22.5</changelog>
  <changelog author="dmueller@suse.com" date="1605096000">- update to 1.22.10:
  https://github.com/yarnpkg/yarn/releases/tag/v1.22. 10</changelog>
</package>
</otherdata>