# changelog

author: BlueJeans <bfl@bluejeans.com> - 2.1.0
changelog:
  - Outlook Calendar Integration - Integrate the Outlook / Office 365 calendar to the BlueJeans Application to Join BlueJeans meetings directly from the App
  - Debian Package - BlueJeans Desktop Application for Linux is now available for Ubuntu. Visit: bluejeans.com/downloads
  - Miscellaneous bug fixes


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.6.0 (Release 19.6)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Centrify cURL is upgraded based on cURL v7.65.0 instead of v7.61.1. (Ref: CS-47453, CS-47973)
      - This includes several security fixes, e.g. CVE-2018-16890, CVE-2019-3822, and CVE-2019-3823, CVE-2019-5435, and CVE-2019-5436. For details, please refer to https://curl.haxx.se/docs/security.html.
    - Upgraded URI to v1.74 from v1.60. (Ref: CS-47560)
      - For changelog details, please refer to https://metacpan.org/release/URI.
    - Enhanced adcdiag command related to cloud connector test:
      - Added the information on how much time a connector probe spent by logging the GMT timestamps when the probe starts and ends for each connector, the timestamp format is like "Apr 18, 2019 08:28:12(GMT)". (Ref: CS-47735)
      - Added the support for the parameter 'adclient.cloud.connector' to limit the probing to a specific connector. (Ref: CS-47759)
      - Added time-out to each probe attempt. (Ref: CS-47788)
    - Enhanced adcheck command to check for a running nscd and alert users if not. (Ref: CS-47518)
    - Added the support for parallel execution of adjoin --precreate command to pre-create computers in a zone during provisioning. (Ref: CS-47237)
    - Added an option --interactive to adkeytab --adopt command as an alternative to --newpasswd to prevent entering a password in clear text on the command line. (Ref: CS-47483)
      - Example of using option --newpasswd: 
      - $ adkeytab --adopt -K user1.keytab --local --newpasswd password1 user1 
      - Example of using option --interactive: 
      - $ adkeytab --adopt -K user1.keytab --local --interactive user1 
      - user1@EXAMPLE.COM's password:  
    - Added two options to adleave command to remove role assignments from computer zone and computer zone itself when leaving a zone. (Ref: CS-35367, CS-40518)
      - -o, --removecomputerzone, to remove computer zone from Active Directory
      - -O, --removemachinescope, to remove Direct Authorize scope from Active Directory
    - Added an option -k, --removekeytab to adleave command to remove krb5.keytab file on successful leave. Without this option, adleave will only clean up keytab entries but not remove keytab file. (Ref: CS-29241)
    - Added an option --case to adsyncignore command to do case-sensitive comparison to AD user/group names. By default, it will do case-insensitive comparison. (Ref: CS-47907)
    - Added an option --dzcache to adsyncignore command for performance improvement. When this option is specified, the adsyncignore command will use the DZ cache from DirectControl agent instead of walking through the zone tree to check user visibility in the joined zone. This can usually improve the performance, especially when there is a lot of role assignments and visible users. Also added two new properties for adsyncignore and similar commands: tool.minuid and tool.mingid. They are used to determine whether a uid or gid should be considered as local and hence should not be processed. For example, if the value is 1000 (which is the default), then the IDs below 1000 will not be processed. (Ref: CS-47853)
    - Added the following parameters in centrifydc.conf:
      - adclient.cloud.connector.subnet.preference.enabled: This parameter specifies whether or not to enable the ability to select subnet preferences when the agent connects to a cloud connector. By default, this option is not enabled (false), which means that the agent selects the cloud connector based on the closest Active Directory site. If you enable this option, the agent selects the cloud connector located in the same subnet as the client within the current Active Directory site, then in different subnets within the current Active Directory site, and then in an Active Directory site that's different than the current one. (Ref: CS-47873)
      - adclient.local.forest.altupn.lookup: This parameter specifies whether or not to enable local forest altupn lookup. The default is true. (Ref: CS-47419)
    - Modified the following parameters in centrifydc.conf:
      - adclient.cloud.connector: This parameter specifies the ONLY cloud connector to be used between Centrify-managed *NIX systems and the cloud instance that provides authentication service. The default is not set which means the agent will do automatic discovery of connectors. (Ref: CS-47759)
  - Bug fixes
    - Fixed a bug where DirectControl agent 'adclient' (or DirectAudit agent 'dad') process running in docker container is stopped when DirectControl (or DirectAudit) is upgraded on docker host. (Ref: CS-47406)
    - Fixed a bug where MFA fails to perform properly when adclient.cloud.connector parameter is set. (Ref: CS-47876)
    - Fixed a bug where users with 'always permit login' role cannot login when DirectControl agent is down in a docker environment. Note: As part of the fix, the location of the file apu.lst has been changed from /etc/centrifydc/apu.lst to /etc/centrifydc/share/apu.lst. (Ref: CS-46600)
    - Fixed a bug where some UNIX members of a zone group are missing after those members were moved on AD. (Ref: CS-47781)
    - Fixed a bug where the password is shown when entering user password to run a scp command if NSS module is disabled but auditing command for "ssh" is enabled. (Ref: CS-47527)
    - Fix a bug in 'adsyncignore' command where it incorrectly uses case-sensitive mode as default when doing comparison with AD user/group names. (Ref: CS-47907)
    - Fixed a bug in 'dzinfo' command where it dumps out unnecessary INFO messages. (Ref: CS-35714)


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.6.1 (Release 19.9)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Centrify DirectControl Agent's Microsoft Privilege Access Management (PAM) Privilege Escalation feature is enhanced to support single sign-on (SSO) scenario. Note: After the user has been granted elevation and added to the PAMGroup, the user is required to re-obtain a new ticket-granting ticket (TGT) for SSO login. (Ref: CS-45781)
    - Centrify DirectControl Agent can now integrate with Citrix Linux Virtual Delivery Agent to support smart card login.  (Ref: CS-47942)
  - Bug fixes
    - Fixed a bug that sometimes automount share returned permission denied using Kerberos ticket generated by Centrify kinit but worked with native kinit, or users got access denied error after migration from Classic to Hierarchical zone. Centrify DirectControl Agent will always generate key entries of all encryption types in krb5.keytab, regardless of the adclient.krb5.tkt.encryption.types setting from centrifydc.conf. Note: There is no FIPS mode support in this version. In future versions that support FIPS mode, there will still be no key entries of non-FIPS-approved encryption types if FIPS mode is enabled. (Ref: CS-47884)
    - Fixed a bug that role assignments to groups from a cross-forest one-way trusted domain failed to apply to its members. (Ref: CS-48078)
    - Fixed a bug that sometimes DirectControl agent would return incomplete result to queries for a user's unix groups. (Ref: CS-48297)
    - Fixed a bug that sometimes DirectControl agent would unnecessarily refresh all zone groups from Active Directory in the background. (Ref: CS-48322)
    - Fixed a bug in the command line utility adcert not able to correctly verify the local certificate resulting that DirectControl agent would request a new certificate from Active Directory whenever updating group policies. (Ref: CS-48360)


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.7.0 (Release 2020)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Centrify cURL is upgraded based on cURL v7.70 instead of v7.65.0. (Ref: CS-48004)
      - This includes several security fixes. For details, please refer to https://curl.haxx.se/docs/security.html.
    - Centrify OpenLDAP is upgraded based on OpenLDAP v2.4.50 instead of v2.4.47. (Ref: CS-48161)
      - For changelog details, please refer to https://www.openldap.org/software/release/changes.html.
    - Centrify OpenSSH is upgraded based on openssh v8.2 instead of v7.9p1. (Ref: CS-47903)
      - This includes several security fixes and potentially incompatible changes, e.g. removal of 'ssh-rsa'(RSA/SHA1) algorithm from those accepted for certificate signatures (i.e. the client and server CASignatureAlgorithms option). For changelog details, please refer to http://www.openssh.com/releasenotes.html.
      - This also fixed the issue of running Centrify OpenSSH on Fedora 30 or above. (Ref: CS-47895)
      - This also fixed the compatibility issue with RHEL 8 crypto-policies package. (Ref: CS-48603)
      - Note that with this upgrade, Centrify OpenSSH does not support the use of 'Use PAM no' anymore. (Ref: CS-48603)
    - Centrify OpenSSL is upgraded based on OpenSSL v1.1.1g instead of v1.1.1b. (Ref: CS-47986)
      - For changelog and vulnerability fix details, please refer to https://www.openssl.org/news/vulnerabilities.html and https://www.openssl.org/news/cl111.txt.
    - Upgraded TCL to v8.6.10 from v8.5.x. (Ref: CS-27205)
      - For changelog details, please refer to http://www.tcl.tk/software/tcltk/8.6.html.
    - On Solaris, the 64-bit executables are now placed in the appropriate directories. In x86 packages, it is "bin/amd64", while in sparc packages, it is "bin/sparcv9". Because of these changes, all Solaris packages have to be upgraded together. For example, you cannot install prior version of CentrifyDC package and install this version of CentrifyDC-openssh package. (Ref: CS-45176)
    - Added the support for IPS packaging format for Solaris 11. The new packages are centrify-infrastructure-services-2020-sol11-i386.tgz, and centrify-infrastructure-services-2020-sol11-sparc.tgz. (Ref: CS-48186, CS-48707)
    - Compatibility (Ref: CS-48610)
      - This release of Centrify DirectControl Agent for *NIX will work with the following except on Solaris:
        - The latest released Centrify for DB2 and Centrify for Samba. (Ref: CS-44594)
        - Centrify DirectAudit Agent of Release 2017 or later, except
          - On AIX, Linux PowerPC platforms, DirectAudit Agent must be of Release 2017.3 or later. (Ref: CS-44597, CS-44601, CS-44749)
        - Centrify OpenSSH of Release 19.6. (Ref: CS-45107)
      - On Solaris, you need to upgrade all packages to Release 2020. E.g. this release of Centrify DirectControl Agent for *NIX will not work with old versions of adbindproxy package, DirectAudit Agent, Centrify OpenSSH, etc., as the location of 64-bit executables is changed (e.g. 'bin/amd64' for x86, and 'bin/sparcv9' for sparc). (Ref: CS-45176)
      - As Centrify Deployment Manager is already discontinued after Release 18.11, Deployment Manager cannot deploy this release of Centrify DirectControl Agent for *NIX. (Ref: CS-47626)
    - Added in DirectControl agent a periodic update of the following information to 'postalAddress' attribute of the computer object in Active Directory, e.g. current domain controller, current connector, update timestamp, adclient process elapse time, computer up time, and connector up time. The adjoin command also adds 'join time' to the attribute. Users can use this information for quick cloud deployment. Note: the update interval is controlled by the configuration parameter 'adclient.deploy.report.update.interval'. (Ref: CS-42377, CS-48372)
    - Also added in DirectControl agent a heartbeat (INFO) message to syslog in this format, 'WATCH HostName: <Local host name> DomainName: <Joined to domain> JoinAs: <joined as> PreWin2kName: <pre-win2k name> CurrentDC: <current dc> PreferredSite: <prefered site> Zone: <zone name> LastPasswordSet: <last password set> Mode: <CentrifyDC mode> LicensedFeature: <Licensed Features>'. The interval is configurable through Group Policy, with default to 0 to disable the message. This message is useful in Analytics, and SIEM software to monitor the healthiness of the agent. (Ref: CS-46731)
    - Added a new feature to assist users to manage 'external' keytabs that contain SPN keys. After successful password change and krb.keytab update, DirectControl agent will launch an optional user process/command to do user-specified action, controlled by the configuration parameter, 'adclient.krb5.password.change.hook'. Also enhanced the adkeytab command with a new option '-o/--copy' to copy the specified keys from an input keytab file into an output keytab file based on specified SPN. This can be useful to users as base to create script to manage their keytab file in their own way. See adkeytab man page for details. (Ref: CS-48384)
    - Added the capability of smart connector selection by using the connector from the next_closest_site if no connector available in the same site, controlled by a new configuration parameter 'adclient.next.closest.site.lookup.enabled'. Please refer to 'KB-14229 Methods used by the Centrify agent when selecting a connector' for details. (Ref: CS-48458, CS-33977)
    - Added the capability in DirectControl watch dog to emit alert when adclient CPU consumption is too high. (Ref: CS-48467)
    - Added a new feature in Multi-Factor Authentication (MFA) policy for Linux, UNIX and Windows Servers to respect MFA profile pass-through duration. You may choose to apply this pass-through duration base on source and/or target. Once it is enabled, one will not be re-prompted for MFA credentials if one has successfully done MFA within a set duration. (Ref: CS-48711)
    - Enhanced dzdo command with the following:
      - Added the support of dzdo on Fedora 30 or above. (Ref: CS-47892)
    - Added the following parameters in centrifydc.conf:
      - adclient.deploy.report.update.interval: This parameter specifies the interval in hours for DirectControl agent to update some useful statistics information to the computer object in Active Directory, such as current domain controller, current connector, adclient process elapse time, computer up time, DC update timestamp, and connector update timestamp. (Ref: CS-48372)
      - adclient.gc.locator.shortcut: This parameter specifies whether or not to use a shortcut to Global Catalog. By default, this option is not enabled (false), which means that the agent connects to GC through normal channel. If you enable this option, the agent checks if the currently connected Domain Controller is also a GC and uses it if yes. (Ref: CS-47786)
      - adclient.heartbeat.interval: This parameter specifies the interval in minutes for DirectControl agent to emit heartbeat INFO message to syslog. The default is 0, which means this feature is disabled. (Ref: CS-46731)
      - adclient.krb5.password.change.hook: This parameter specifies the full path of the command that will be executed after DirectControl agent successfully changed the password and updated the krb5.keytab file. The default is empty string, which means no extra command will be executed. (Ref: CS-48384)
      - adclient.next.closest.site.lookup.enabled: This parameter specifies whether to enable the 'Try Next Closest Site' feature. The default is true, which means DirectControl agent will try to use the domain controller from the next closest site if no domain controller available in the same site. (Ref: CS-33977)
      - adclient.watch.cpu.utilization.info.threshold: This parameter specifies the threshold value that cdcwatch will write a INFO message when adclient's CPU usage is higher than this value. The default is -1, which means no threshold is set. (Ref: CS-48467)
      - adclient.watch.cpu.utilization.warning.threshold: This parameter specifies the threshold value that cdcwatch will write a WARN message when adclient's CPU usage is higher than this value. The default is -1, which means no threshold is set. (Ref: CS-48467)
      - dzdo.use_pty: This parameter specifies whether dzdo will run commands in a pseudo-tty or not. The default is false. (Ref: CS-47464)
    - Added a new option '-notdelegateanyright' in 'precreate_computer' adedit command. When this option is specified, the command will not set the security descriptor when creating a computer object. (Ref: CS-48687)
    - Added the support of smart card login on RHEL 8. (Ref: CS-48087)
  - Bug fixes
    - Fixed an issue in the package description for some architectures on Linux platforms. (Ref: CS-48559)
    - Added the required additional perl module check in rpm spec files so that if users install DirectControl via rpm and not via install.sh, it will also alert users about the missing modules too. (Ref: CS-48570)
    - Fixed an issue that the group refresh background task cannot stop when adclient is shutting down causing intermittent missing cache information during reboot. (Ref: CS-48637)
    - Fixed an issue that when DirectControl searches for available cloud connectors, it will try to extend the cloud connector computer object, and this may result in showing a warning message if no GC is connectable. The DirectControl now do not extend the computer object, thus no more warning message in that case. (Ref: CS-48023)
    - Fixed an issue in large cache environment that may cause high CPU usage on various servers due to force refresh of group members.. We now have an option to restore the old behavior. (Ref: CS-48675, CS-48526)
    - Fixed an issue on MFA login failure due to intermittent SSL connection error caused by dead connector. (Ref: CS-47264)
    - Fixed an issue of an unnecessary ERROR message complaining about no cloud connector in a domain where MFA is not even used. (Ref: CS-48694)
    - Fixed an unnecessary warning message in the log '… WARN util.fbbuf FBBufCtrl - bAlloc failed: Insufficient space'. (Ref: CS-48314)
    - Changed the default behavior in MFA such that experimental features are disabled. (Ref: CS-49018)
    - Fixed an issue on AIX in configuration update script causing zoned user login failure after OS upgrade and DirectControl installation. (Ref: CS-48482)
    - Fixed an issue on AIX in the logic in loading computer roles if custom attribute is used causing users not showing up. (Ref: CS-48183)
    - Fixed an issue on AIX that 'lsuer ADUSER' command returns the primary group twice. (Ref: CS-48850)
    - Added SELinux rules to bypass domain_can_mmap_files check on RHEL8. (Ref: CS-48545)
    - Fixed an issue on HPUX not able to create Kerberos cache file causing user ssh login to fail. (Ref: CS-48221)
    - Fixed an issue which caused failure to perform offline login due to cache flushed after adclient crashed. (Ref: CS-48373)
    - Fixed an issue on RHEL7 such that the authentication will simply exit when hitting CTRL-C at password prompt even with MFA enabled. (Ref: CS-48118)
    - Fixed an issue that adcert failed the 'verify certificate check' even there existed one good CA cert. (Ref: CS-33681)
    - Fixed an issue that dzdo cannot get the correct status from dzcheck.sample if dzcheck.sample is interrupted by signal. (Ref: CS-48982)


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.7.1 (Release 2020.1)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Compatibility (Ref: CS-49383)
      - This release of Centrify DirectControl Agent for *NIX will work with the following except on Solaris:
        - The latest released Centrify for DB2 and Centrify for Samba. (Ref: CS-44594)
        - Centrify DirectAudit Agent of Release 2017 or later, except
          - On AIX, Linux PowerPC platforms, DirectAudit Agent must be of Release 2017.3 or later. (Ref: CS-44597, CS-44601, CS-44749)
        - Centrify OpenSSH of Release 19.6. (Ref: CS-45107)
      - On Solaris, you need to upgrade all packages to Release 2020 or above. E.g. this release of Centrify DirectControl Agent for *NIX will not work with old versions of adbindproxy package, DirectAudit Agent, Centrify OpenSSH, etc., as the location of 64-bit executables is changed (e.g. 'bin/amd64' for x86, and 'bin/sparcv9' for sparc). (Ref: CS-45176)
      - As Centrify Deployment Manager is already discontinued after Release 18.11, Deployment Manager cannot deploy this release of Centrify DirectControl Agent for *NIX. (Ref: CS-47626)
    - Open Source component upgrade
      - Centrify OpenSSH is upgraded based on openssh v8.4 from v8.2. (Ref: CS-48810)
        - This includes several security fixes and potentially incompatible changes. For changelog details, please refer to http://www.openssh.com/releasenotes.html.
    - Packaging change
      - Enhanced Unix installer to preserve the settings in openssl.cnf during openssl upgrade process. (Ref: CS-49327)
    - Added python APIs for LRPC/LRPC2/CAPI modules. (Ref: CS-48520)
    - Added the options "--ignore-directory <match>", and "-ignore-file <match>" to the command adfixid to skip directory(s) or file(s) if the pattern matched via Regular Expression. (Ref: CS-49364)
    - Added an option to preserve "bad" Kerberos cache when renewal fails. (Ref: CS-49368)
    - Added the following parameters in centrifydc.conf:
      - adclient.krb5.keytab.use.all.etypes: This parameter specifies whether to output all supported encryption types into krb5.keytab file or not. The default is false, meaning to only output types specified in 'adclient.krb5.tkt.encryption.types'. (Ref: CS-49163)
      - nss.program.ignore.check.parents: This parameter specifies whether to recursively check parent processes' names for "nss.program.ignore" parameter. Default is false. (Ref: CS-31472)
      - Please refer to the manual, Configuration and Tuning Reference Guide, for details.
  - Bug fixes
    - Fixed an issue in install.sh in Release 2020 that it reports the wrong CentrifyDC version causing subsequent CentrifyDA or other product upgrade fails. (Ref: CS-49283)
    - Fixed an issue in install.sh to check if pkgadd is available or not before installation. (Ref: CS-49157)
    - Centrify DirectControl Agent for *NIX now by default uses Secure RPC for NETLOGON channel. This is related to an elevation of privilege vulnerability in Microsoft’s NETLOGON mentioned in CVE-2020-1472. (Ref: CS-49267)
    - Fixed an issue introduced in Release 19.9 that DirectControl (adclient) always generates krb5.keytab entries of all supported encryption types. Now, it will only generate krb5.keytab entries specified in the configuration parameter "adclient.krb5.tkt.encryption.types", unless a new parameter "adclient.krb5.keytab.use.all.etypes" is set to true. The default is false to match the behavior prior to Release 19.9. Please note this is a change in default behavior comparing to Release 19.9 and Release 2020. (Ref: CS-49163)
    - Fixed an issue that local account management fails to check uid conflict. Now DirectControl will emit an INFO message and skip over the conflicting entry if uid conflict exists. (Ref: CS-49077)
    - Fixed an issue that the adkeytab command sometimes creates a new AD account with PASSWD_NOTREQD(0x32) in its UserAccountControl attribute. (Ref: CS-42257)
    - Fixed an issue that DirectControl (adclient) sometimes fails to update new KDC server record into krb5.conf after a Domain Controller failover. (Ref: CS-49027)
    - Fixed a bug in the application program interface that local user authentication requested by other Centrify applications, such as, Centrify for DB2 plugin, may fail on recent Linux releases, for example RHEL 8.2, due to Kerberos library conflict. (Ref: CS-49178)
    - Fixed an issue that a bad netgroup entry causes adnisd to loop in parsing. (Ref: CS-48922)
    - Fixed an issue that when adnisd bind port fails, it logs the wrong port number. (Ref: CS-49251)
    - Enhanced Centrify DirectControl Agent for *NIX (adclient) to retry LDAP requests when the domain controller returns "server is unavailable" LDAP error. (Ref: CS-48674)


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.8.0 (Release 2021)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Upgraded cURL from v7.70.0 to v7.75.0. (Ref: CS-48932)
      - This includes several security fixes. For details, please refer to https://curl.haxx.se/docs/security.html.
    - Upgraded OpenLDAP from v2.4.50 to v2.4.57 and also applied a patch for CVE-2021-27212. (Ref: CS-49123)
      - For changelog details, please refer to https://www.openldap.org/software/release/changes.html.
    - Upgraded OpenSSL from v1.1.1g to v1.1.1k. (Ref: CS-49218)
      - For changelog and vulnerability fix details, please refer to https://www.openssl.org/news/vulnerabilities.html and https://www.openssl.org/news/cl111.txt.
    - Upgraded PuTTY from v0.73 to v0.74. (Ref: CS-48963)
      - This includes several security fixes. For details, please refer to https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html.
    - Upgraded sudo from v1.8.20p2 to v1.9.5p2. (Ref: CS-49538)
      - For changelog details, please refer to https://www.sudo.ws/stable.html#1.9.5p2.
    - Packaging change
      - Starting from this release, the names of the bundles have changed from Centrify-Infrastructure-Services-XXX.iso/zip/tgz back to Centrify-Server-Suite-xxx.iso/zip/tgz to better reflect the product organization. (Ref: CS-49475)
      - Redhat packages are now SHA256 compliant. (Ref: CS-44650)
    - Added the instrumentation for threadpool information as part of the heartbeat INFO messages to syslog. (Ref: CS-49472)
    - Changed CAPI performance log messages from DEBUG to INFO level for better monitoring. (Ref: 49299)
    - Added the support to find out the DirectAudit status of servers in the system. (Ref: CS-6971)
    - Added the support of SELINUX related feature on SuSE with "minimum" and "targeted" policy. (Ref: CS-45558)
    - Enhanced adedit command with the following:
      - Added the support to allow runtime variable substitution (%{u:xxx}) for user fields. (Ref: CS-49347)
    - Enhanced dzdo command with the following:
      - Added the support of SELINUX related feature on SuSE with "minimum" and "targeted" policy. (Ref: CS-43833)
    - Added the following parameters in centrifydc.conf:
      - adclient.dz.refresh.hook: This parameter specifies the full path of the command that will be executed after adclient finished the DZ cache refresh. (Ref: CS-49610)
  - Bug fixes
    - Fixed an issue that rescue rights is not working after reboot when MFA is enabled. (Ref: CS-49613)
    - Fixed the crash due to exception thrown out of SecureChannel destructor. (Ref: CS-49612)
    - Fixed an issue that sudoers.pl cannot determine sudoers file location due to locale setting. (Ref: CS-49608)
    - Fixed an issue that in Kickstart deployment, the DirectContol maybe installed without systemd support and cannot work after installation. The fix is to add dependency to make sure DirectControl will be installed after systemd. (Ref: CS-49419)
    - Fixed an issue that the Python module PyLRPC is broken on Ubuntu 18.04. Note: this change breaks backward compatibility. The fix is to correct the wrong return type from previous releases. Certain attributes cannot be returned as string and python supports locale which means we cannot arbitrarily set everything to utf8. Customers who depend on previous return type of string will need to change their logic to match the new return type. (Ref: CS-49592)


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.8.1 (Release 2021.1)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Compatibility (Ref: 353603)
      - Due to the upgrade of OpenSSL in Release 2021.1, this release of Centrify DirectControl Agent for *NIX works only with the following versions:
  	  - Centrify DirectAudit Release 2021.1 or later
  	  - Centrify OpenSSH Release 2021.1 or later
  	  - The latest released Centrify for DB2 and Centrify for Samba
      - Note: Since Centrify Deployment Manager is discontinued after Release 18.11, Deployment Manager cannot deploy this release of Centrify DirectControl Agent for *NIX. (Ref: CS-47626)
    - Added the instrumentation for LDAP bindings. New statistic results will be shown in "adinfo --sysinfo adagent" output and heartbeat log messages. (Ref: 297460)
    - Added the support of large-sized messages in LRPC2 by introducing message size ceiling to 4MB. (Ref: 299207) 
    - Added the support of Thycotic ID Bridging integration controlled by the new configuration parameter auto.schema.thycotic.rids. (Ref: 298380)
    - Added the support of managed service accounts (gMSA accounts) as AD users. This new feature allows users to (Ref: 298374)
      - define UNIX user profiles and assign roles for gMSA
      - configure adclient to automatically pull gMSA's current password into local keytab
      - use adkeytab to pull gMSA's current password into local keytab
    - DirectControl Command Line Utilities
      - Enhanced adedit command with the following:
        - Added the support of managed service accounts (gMSA accounts) as AD users. (Ref: 298378)
      - Enhanced adinfo command with the following:
        - A new option -E, --autoedit is added for adinfo command. When this new option is specified, adinfo will show the status of the system configuration files that managed by auto-edit. Note that this option will not show any files on Mac because Mac is not yet supported. (Ref: 294893)
    - Configuration Parameters
      - Added the following parameters in centrifydc.conf:
        - adclient.binding.ldapsearch.statistic.interval: this parameter specifies the interval which adclient reset the statistic information. Default is 30 minutes. (Ref: 297460)
        - adclient.gmsa: this parameter specifies the list of gMSA accounts that adclient should take care of. Default is empty. (Ref: 298374)
        - adclient.ipv4.port.range.high: this parameter, together with adclient.ipv4.port.range.low, specify the IPv4 port range that adclient should use for both TCP and UDP outbound connections. Default is 0 which means any ports can be used. If any one of the two parameters is set, validation will make sure both fall into the reasonable boundary between 1024 and 65535. (Ref: 294967)
        - adclient.ipv4.port.range.low: this parameter, together with adclient.ipv4.port.range.high, specify the IPv4 port range that adclient should use for both TCP and UDP outbound connections. Default is 0 which means any ports can be used. If any one of the two parameters is set, validation will make sure both fall into the reasonable boundary between 1024 and 65535. (Ref: 294967)
        - adclient.ntlm.discover.by.trustedDomain: this parameter specifies whether to discover NTLM domain name from "msDS-TrustForestTrustInfo" attribute in objects of class trustedDomain. Default is false. (Ref: 295464)
        - auto.schema.thycotic.rids: this parameter specifies whether UID/GID will be generated based on Thycotic algorithm. Default is false. (Ref: 298380)
        - gp.mappers.runcommand.as.user: this parameter specifies whether to run user Group Policy commands as the current user. Default is false, which means to run as root. (Ref: 295030)
        - gp.mappers.runcommand.as.root.env.list: this parameter specifies the environment variable list which will be exported to the environment for root to run Group Policy commands with. Default is empty. Note: this parameter is ignored if gp.mappers.runcommand.as.user is set to true. (Ref: 295043)
        - nss.process_group.ignore: this parameter specifies whether Centrify group or user lookup and iteration will not be called for the programs in a process group listed in parameter. Default is empty. (Ref: 296909)
        - nss.user.group.prefer.cache: this parameter specifies whether to always favor cache and defer refreshing of AD objects in background for NSS user and group queries. Default is false, meaning the NSS queries will return current results via synchronous AD object refresh in case of expired cache. On systems with heavy NSS load, enabling this option can significantly increase throughput. On systems with heavy NSS query load for users (getpwuid/getpwnam) and groups(getgrgid/getgrnam), enabling this option to true will help improve adclient's throughput as it defers sync object refresh to async refresh. (Ref: 306177)
      - Modified the following parameters in centrifydc.conf:
        - capi.cache.enabled: as this CAPI cache feature has been widely used for many years, the default value is now changed from false to true to take advantage of this feature by default. (Ref: 299235)
  - Bug fixes
    - Fixed an issue that some fields in postalAddress are lost when a machine joins to a classic zone. (Ref: 298307)
    - Fixed an issue that the installed packages in postalAddress of computer object are incomplete due to the distinguishedName too long. (Ref: 303388)
    - Fixed an issue that the user might fail to login if the group it belongs to has too many members (E.g., The length of the whole members is larger than 1000 characters). (Ref: 299242)
    - Fixed an issue that causes adclient performance to degrade in environments where AD objects have identical usnChanged attribute value across different domain controllers. (Ref: 383716)
    - Fixed an issue that causes cross domain Kerberos traffic to be blocked. (Ref: 304296)


author: Eason Yu <eason.yu@delinea.com> 5.9.0 (Release 2022)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Centrify is rebranding itself to Delinea.
    - Packaging change
      - Starting from this release, the names of the bundles have changed from Centrify-Server-Suite-xxx.iso/zip/tgz to Delinea-Server-Suite-xxx.iso/zip/tgz.
    - Added a feature that NSS and adquery now supports NTLM name lookup for users from one-way trusted forests. (Ref: 297477)
    - Added a feature that the UNIX Agent (adclient) will try to pick up Domain Controllers based on weighted random selection and re-establish LDAP bindings every 12 hours if adclient.binding.refresh.force is true.
    - Configuration Parameters
      - Added the following parameters in centrifydc.conf:
          - dzdo.timestamp_type: this parameter specifies the type of time stamp record used. (Ref: 398956)
          - smartcard.pkcs11.module: this parameter is renamed from 'rhel.smartcard.pkcs11.module'. (Ref: 408602)
          - smartcard.login.force: this parameter is renamed from 'rhel.smartcard.login.force'. (Ref: 408602)
  - Bug fixes
      - Fixed an issue that adclient does not ignore groups from the blocked domains when checking computer role groups. (Ref: 296116)
      - Fixed an issue when the UNIX Agent (adclient) or CLIs are getting "No credentials found with supported encryption types" Kerberos error after some customers have changed "adclient.krb5.permitted.encryption.types" and "adclient.krb5.tkt.encryption.types" settings. (Ref: 296530)
      - Fixed an issue that zone groups are not seeing some newly provisioned zone user members. (Ref: 298442)
      - Fixed an issue that Centrify Openssh match block set in group policies are lost in sshd_config. (Ref: 352010)
      - Fixed an issue that smart card does not work on Ubuntu 21.10. (Ref: 391868)
      - Fixed an issue that some services may not be registered after installing the packages on Solaris 10. (Ref: 395259)
      - Fixed an issue that in some situation kset.altupn and krb5.conf are not updated as expected. (Ref: 395281)
      - Fixed an issue that user cannot do MFA login with RADIUS MFA authentication. (Ref: 402716)
      - Fixed an issue that Citrix VDA smartcard authentication failed on Debian or Ubuntu when some customers are using 3rd-party pkcs11 libraries. (Ref: 403100)
      - Fixed an issue that dzdo cannot sso login to remote host to run command. (Ref: 403676)
      - Fixed an issue that ssh SSO login fails when working with gssproxy. (Ref: 406282)
      - Fixed an issue that the pass-through feature doesn't work when user do MFA ssh login. (Ref: 409684)
      - Fixed an issue that adnisd gets an incomplete group NIS maps at times. (Ref: 413748)
      - Fixed some issues in the CAPI cache, which is used by the DirectControl add-on packages (such as the adbindproxy and DB2 plugins), smart card support and macOS. Note that the CAPI cache is by default disabled prior to DirectControl version 5.8.1. (Ref: 414629)
      - Fixed an issue that DirectControl Openssh systemd service file is not installed on SuSE15 SP3. (Ref: 414951)
      - Fixed an issue that sometimes NSS user lookup fails to find a zone user when the configuration "nss.user.group.prefer.cache: true" is in place and the corresponding AD user account is from another forest. (Ref: 419739)


author: Eason Yu <eason.yu@delinea.com> 5.9.1 (Release 2022.1)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Upgraded zlib from 1.2.3 to 1.2.12. (Ref: 430916)
    - Added Smart Card Support for Rocky Linux and AlmaLinux. (Ref: 433531, 433532)
    - Added a feature to gather statistic information for NSS requests. (Ref: 433831)
    - Added a feature to write INFO and WARN logs when the time spent on a complete NSS request exceeds the threshold value configured in Server Suite configuration file. (Ref: 433831)
    - Added support for systemd environment file under /etc/default dirctory. (Ref: 394029)
    - Configuration Parameters
      - Added the following parameters in centrifydc.conf:
          - pam.homedir.update.ownership: this parameter specifies whether fix home directory ownership when the user logs in. (Ref: 430517)
  		- adclient.nss.statistic.interval: this parameter specifies the statistic interval for adclient to gather NSS query statistics information. (Ref: 433831)
  		- nss.watch.slow.lookup.info.threshold: this parameter specifies the threshold(in milliseconds) in NSS module side, when the time spent on a complete NSS request exceeds the threshold, NSS module will write INFO log. (Ref: 433831)
  		- nss.watch.slow.lookup.warn.threshold: this parameter specifies the threshold(in milliseconds) in NSS module side, when the time spent on a complete NSS request exceeds the threshold, NSS module will write WARN log. (Ref: 433831)
  		- nss.watch.slow.lookup.info.threshold.user: Per-category settings, "user" category indicates below NSS calls: getpwnam* getpwuid* getgrouplist (Ref: 433831)
  		- nss.watch.slow.lookup.warn.threshold.user: Per-category settings, "user" category indicates below NSS calls: getpwnam* getpwuid* getgrouplist (Ref: 433831)
  		- nss.watch.slow.lookup.info.threshold.group: Per-category settings, "group" category indicates below NSS calls: getgrnam* getgrgid* (Ref: 433831)
  		- nss.watch.slow.lookup.warn.threshold.group: Per-category settings, "group" category indicates below NSS calls: getgrnam* getgrgid* (Ref: 433831)
  		- adclient.watch.slow.lookup.info.threshold: this parameter specifies the threshold(in milliseconds) in adclient side, when the time spent on a complete NSS request exceeds the threshold,adclient will write INFO log. (Ref: 433831)
  		- adclient.watch.slow.lookup.warn.threshold: this parameter specifies the threshold(in milliseconds) in adclient side, when the time spent on a complete NSS request exceeds the threshold,adclient will write WARN log. (Ref: 433831)
  		- adclient.watch.slow.lookup.info.threshold.user: Per-category settings, "user" category indicates below NSS calls: getpwnam* getpwuid* getgrouplist (Ref: 433831)
  		- adclient.watch.slow.lookup.warn.threshold.user: Per-category settings, "user" category indicates below NSS calls: getpwnam* getpwuid* getgrouplist (Ref: 433831)
  		- adclient.watch.slow.lookup.info.threshold.group: Per-category settings, "group" category indicates below NSS calls: getgrnam* getgrgid* (Ref: 433831)
  		- adclient.watch.slow.lookup.warn.threshold.group: Per-category settings, "group" category indicates below NSS calls: getgrnam* getgrgid* (Ref: 433831)
  - Bug fixes
      - Fixed an issue that the user needs to add '+' at the end of /etc/passwd manually to resolve AD user while  NSS compat mode is enabled. (Ref: 441847)
  	- Fixed an issue that adedit command 'create_assignment' cannot create Role Assignments for the same user but with different start/end times. (Ref: 422588)
  	- Fixed an issue that User lookup by NTLM name would fail when "adclient.included.domains" setting is in place. (Ref: 422590)
  	- Fixed an issue that centrifydc.log will be empty after log rotate on RHEL 8 (Ref: 429155)
  	- Fixed an issue that when use KCM kerberos credential cache, user may fail to do single-sign-on. (Ref: 430385)
  	- Fixed an issue that some groups may lose members when "adclient.local.group.merge" is true. (Ref: 431082)
  	- Fixed an issue that adjoin didn't write Kerberos keytab entries of the computer userPrincipalName. (Ref: 442592)
  	- Fixed an issue that dzdo may crash on Debian if audit is disabled in kernel parameter. (Ref: 442864)
  	- Fix a race condition issue that would sometimes crash processes performing NSS user lookups. (Ref: 443314）
  	- The obsolete GP script TestFipsMode.pl has been removed from the CentrifyDC package. (Ref: 427705)


author: Eason Yu <eason.yu@delinea.com> 6.0.0 (Release 2023)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Added Smart Card Support for Oracle Linux 8. (Ref: 480339)
    - Added support for authselect on RHEL or similar platforms. (Ref: 297948)
    - Added protection to avoid inifinite recursion. (Ref: 295801)
    - Added support mapping AIX attributes to Active Directory attributes for LAM query on AIX. (Ref: 468388)
    - Added an option (client) for addebug to control client log specially. (Ref: 430722)
    - Added Group policy to control AIX attributes mapping configuration. (Ref: 470269)
    - Exposed the parameter "adclient.group.ignore.blocked.domain.members" which is to ignore group members from explicitly blocked domains. (Ref: 468135)
    - Modified the parameter "adclient.cloud.connector" to allow it specify multiple connectors. (Ref: 469283)
    - Enhanced kinit -k to work even if the hostname is an FQDN. (Ref: 480104)
    - Smart Card Authentication in DirectControl is enhanced to support certificate-to-user mapping via the per-user altSecurityIdentities attribute. (Ref: 471297)
    - Configuration Parameters
      - Added the following parameters in centrifydc.conf:
          - lam.attributes.user.map: this parameter specifies the map file to map AIX user attributes to AD user attributes. (Ref: 468388)
          - lam.attributes.group.map: this parameter specifies the map file to map AIX group attributes to AD group attributes. (Ref: 468388)
          - smartcard.cert.upn.mapping: this parameter specifies whether to uses the Subject Alternative Name (SAN) for UPN mapping for SmartCard support. (Ref: 475828)
          - adclient.krb5.cache.infinite.renewal.gmsa: this parameter specifies the list of Group Managed Service Account (gMSA) for which adclient will renew/issue Kerberos credential cache infinitely. (Ref: 476375)
          - adclient.adsyncignore.interval: this parameter specifies how often (in minutes) adclient will be syncing user.ignore and group.ignore with zone data and updating uid.ignore and gid.ignore accordingly. A value of 0 means disabled. (Ref: 458329)
  - Bug fixes
    - Fixed an issue that adclient cannot shut down during the step building cache. (Ref: 471076)
    - Fixed CVE-2023-22809 for dzdo/dzedit. (Ref: 482707)
    - Fixed an issue that the scp and sftp of Delinea Openssh may crash on Solaris 10. (Ref: 447712)
    - Fixed an issue that zone user is not listed by "adquery user" when the home directory of zone user's profile contains "%{pgroup}". (Ref: 482952)
    - Fixed an issue that MFA might fail on SuSE Linux. (Ref: 452146)
    - Fixed an issue that CAPI cache which causing cumulative memory leak in DirectAudit NSS module if the CAPI cache is enabled. As the NSS module is used system-wide, this problem actually affects almost all applications. (Ref: 471535)
    - Fixed an issue that when user query the RootDSE for 2016 or 2019 domain via ldapproxy, the subschemaSubentry attribute will have a strange ">;" prefix in the result DN value. (Ref: 473736)
    - Fixed an issue that if DirectControl is installed in Solaris global zone for all zones on Solaris 10, then installing new Solaris zone will show an error about the CentrifyDC-openssl package and that package will not be installed in the new zone. (Ref: 467604)
    - Fixed an issue that some commands, for example, git and scp, cannot work within dzsh. (Ref: 467667)
    - Fixed an issue that RHEL RPM GPG signature for CentrifyDC package is changed to SHA256. (Ref: 483190)
    - Fixed an issue that user overriding via group membership in passwd.ovr sometimes does not apply when the overriding group is not zone enabled. (Ref: 471306)
    - Fixed an issue that DirectControl services could be in disconnected mode for a short period of time right after system boot on systemd systems. (Ref: 486028)
    - Improved the code logic about automatic adjusting in-memory "adclient.zone.group.count" value. (Ref: 465141)
    - Enhanced adclient to properly handle the situation that the Next-Closest-Site information is not available from some domain controllers. (Ref: 468557)
    - Enhanced adkeytab to enforce '-y' option must be specified while creating an account in the case that FIPS mode is enabled. (Ref: 469452)


author: Eason Yu <eason.yu@delinea.com> 6.0.1 (Release 2023.1)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Compatibility (Ref: 524065)
      - Due to the upgrade of OpenSSL in Release 2023.1, this release of DirectControl Agent for *NIX works only with the following versions:
  	  - Delinea OpenSSH Release 2023.1 or later
    - Added Smart Card Support for Debian 12.0. (Ref: 514927)
    - A new sub-option "--localkeytab" of "--adopt" is added to the adkeytab command. When the options "--adopt --localkeytab" are specified, adkeytab will just create the keytab file locally. The new sub-option can be used by a normal user to create a keytab file for passwordless authentication. The user is also able to select the principal keys to be put into the keytab file with this new sub-option. (Ref: 475138)
    - Added a new tool named "adsshauthkeys" to retrieve user's public keys from user object in AD. (Ref: 488800)
    - The user can now use either SamAccountName or User Principal Name of gMSAs in 'adclient.krb5.cache.infinite.renewal.gmsa' to control what format of Kerberos principal to use in the credential caches. (Ref: 501818)
    - The full output of "adcheck" will be printed in the log "centrifydc-install.log" as well when installing our agent. (Ref: 504317)
    - Added a new authselect optional feature "with-nullok" for server suite profile. By default server suite profile will not use "nullok" in PAM configuration files. (Ref: 517300)
    - SSH login via gssapi-with-mic will be denied when Kerberos PAC validation fails. (Ref: 520206)
    - Reduced unnecessary DN format name lookups to optimize performance. (Ref: 531870)
    - Added a new option "-X" or "--computerpassword" for adjoin command to specify the password of the precreated computer account. (Ref: 481139)
    - Added a new option "-password" for precreate_computer command to specify the password of the precreated computer account. (Ref: 484292)  
    - Configuration Parameters
      - Added the following parameters in centrifydc.conf:
          - krb5.conf.include.file: this parameter specifies "include" directive adclient will add into krb5.conf. (Ref: 505933)
          - krb5.conf.include.directory: this parameter specifies "includedir" directive adclient will add into krb5.conf. (Ref: 505933)
          - adclient.autoedit.authselect: this parameter specifies whether to use authselect method to enable nss and pam configuration on the system which has authselect. (Ref: 501204)
      - Modified the following parameters in centrifydc.conf:        
          - adclient.krb5.service.principals: the default value of this parameter is changed from "ftp cifs" to "ftp cifs ldap". (Ref: 495637)
          - nss.runtime.defaultvalue.var.shell: the default value is changed from "/usr/bin/sh" to "/sbin/sh" on HP-UX. (Ref: 531614)
          - adclient.krb5.password.change.verify.retries: the default value of this parameter is changed from 0 to 15. (Ref: 506448)
          - adclient.krb5.password.change.verify.interval: the default value of this parameter is changed from 0 to 60. (Ref: 506448)
  - Bug fixes
    - Fixed a user visibility issue that some group members remain invisible after being added to an AD group that assigned visible roles. (Ref: 489972)
    - Fixed an issue that dzinfo may show duplicate entries. (Ref: 501815)
    - Fixed an issue that adjoin would prompt warning message when self-joining a computer pre-created using Access Manager. (Ref: 504183)
    - Fixed a deadlock issue in adclient. (Ref: 517984)
    - Fixed the file permission issue with /var/centrifydc/.dz.cache.needs.refreshing if adclient's umask is unexpectedly modified by some non-standard way. (Ref: 531408)


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.6.0 (Release 19.6)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Centrify cURL is upgraded based on cURL v7.65.0 instead of v7.61.1. (Ref: CS-47453, CS-47973)
      - This includes several security fixes, e.g. CVE-2018-16890, CVE-2019-3822, and CVE-2019-3823, CVE-2019-5435, and CVE-2019-5436. For details, please refer to https://curl.haxx.se/docs/security.html.
  - Bug fixes
    - N/A


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.6.1 (Release 19.9)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - N/A
  - Bug fixes
    - N/A


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.7.0 (Release 2020)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Centrify cURL is upgraded based on cURL v7.70 instead of v7.65.0. (Ref: CS-48004)
      - This includes several security fixes. For details, please refer to https://curl.haxx.se/docs/security.html.
  - Bug fixes
    - N/A


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.8.0 (Release 2021)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Upgraded cURL from v7.70.0 to v7.75.0. (Ref: CS-48932)
      - This includes several security fixes. For details, please refer to https://curl.haxx.se/docs/security.html.
  - Bug fixes
    - N/A


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.8.1 (Release 2021.1)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Upgraded cURL from v7.75.0 to v7.78.0. (Ref: 298090)
      - This includes several security fixes. For details, please refer to https://curl.haxx.se/docs/security.html.
  - Bug fixes
    - N/A


author: Eason Yu <eason.yu@delinea.com> 5.9.0 (Release 2022)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Upgraded cURL from v7.78.0 to v7.81.0. (Ref: 365524)
      - This includes several security fixes. For details, please refer to https://curl.haxx.se/docs/security.html.
  - Bug fixes
    - N/A


author: Eason Yu <eason.yu@delinea.com> 5.9.1 (Release 2022.1)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Upgraded cURL from v7.81.0 to v7.84.0. (Ref: 442043)
      - This includes several security fixes. For details, please refer to https://curl.haxx.se/docs/security.html.
  - Bug fixes
    - N/A


author: Eason Yu <eason.yu@delinea.com> 6.0.0 (Release 2023)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Upgraded cURL from v7.84.0 to v7.87.0. (Ref: 481154)
      - This includes several security fixes. For details, please refer to https://curl.haxx.se/docs/security.html.
  - Bug fixes
    - N/A


author: Eason Yu <eason.yu@delinea.com> 6.0.1 (Release 2023.1)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Upgraded cURL from 7.87.0 to v8.1.2. (Ref: 489963)
      - This includes several security fixes. For details, please refer to https://curl.haxx.se/docs/security.html.
  - Bug fixes
    - N/A


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.7.1 (Release 2020.1)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - N/A
  - Bug fixes
    - Fixed an issue that a bad netgroup entry causes adnisd to loop in parsing. (Ref: CS-48922)
    - Fixed an issue that when adnisd bind port fails, it logs the wrong port number. (Ref: CS-49251)


author: Eason Yu <eason.yu@delinea.com> 5.9.0 (Release 2022)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Added a new feature to make NIS daemon load all the snapshot files into memory, which can be more efficient to respond ypGetAll. (Ref: 295971)
  - Bug fixes
    - N/A


author: Eason Yu <eason.yu@delinea.com> 5.9.1 (Release 2022.1)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - N/A
  - Bug fixes
    - N/A


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.6.0 (Release 19.6)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Centrify OpenLDAP is upgraded based on OpenLDAP v2.4.47 instead of v2.4.46. (Ref: CS-47385, CS-47614)
      - For changelog details, please refer to https://www.openldap.org/software/release/changes.html.
  - Bug fixes
    - Fixed a bug where restarting centrify.service sometimes wrongly overwrites the customer settings in /etc/centrifydc/openldap/slapd.conf. (Ref: CS-47652)* Fri Dec 7 2018 Vadim Gorelik <vadim.gorelik@centrify.com> 5.5.2 (Release 18.11)
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - N/A
  - Bug fixes
    - Fixed a bug in the installer where it fails to upgrade openssl, openldap, curl packages using individual installer commands with "-u" option. (Ref: CS-46863, CS-46856)


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.7.0 (Release 2020)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Centrify OpenLDAP is upgraded based on OpenLDAP v2.4.50 instead of v2.4.47. (Ref: CS-48161)
      - For changelog details, please refer to https://www.openldap.org/software/release/changes.html.
  - Bug fixes
    - N/A


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.8.0 (Release 2021)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Upgraded OpenLDAP from v2.4.50 to v2.4.57 and also applied a patch for CVE-2021-27212. (Ref: CS-49123)
      - For changelog details, please refer to https://www.openldap.org/software/release/changes.html.
  - Bug fixes
    - N/A


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.8.1 (Release 2021.1)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Upgraded OpenLDAP from v2.4.57 to v2.4.59. (Ref: 297898)
      - For changelog details, please refer to https://www.openldap.org/software/release/changes.html.
  - Bug fixes
    - N/A


author: Eason Yu <eason.yu@delinea.com> 6.0.0 (Release 2023)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Upgraded OpenLDAP from v2.4.59 to v2.5.13. (Ref: 448127)
      - For changelog details, please refer to https://www.openldap.org/software/release/changes.html.  
  - Bug fixes
    - N/A


author: Eason Yu <eason.yu@delinea.com> 6.0.1 (Release 2023.1)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Upgraded OpenLDAP from 2.5.13 to 2.5.14. (Ref: 502323)
      - For changelog details, please refer to https://www.openldap.org/software/release/changes.html.  
  - Bug fixes
    - N/A


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.6.0 (Release 19.6)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Centrify OpenSSL is upgraded based on OpenSSL v1.1.1b instead of v1.0.2p. (Ref: CS-45107, CS-47441, CS-47447, CS-47768, CS-47796)
      - This includes several security fixes for CVE-2018-0732, CVE-2018-0734, CVE-2018-0735, CVE-2018-0737, CVE-2019-1543. For changelog and vulnerability fix details, please refer to https://www.openssl.org/news/vulnerabilities.html and https://www.openssl.org/news/cl111.txt.  
      - Note:
        - This is a major upgrade from v1.0.2 to v1.1.1 which means the internal openssl library and APIs are not backward compatible. Centrify OpenSSH is also upgraded based on openssh v7.9p1 because of this reason.
        - Several algorithms, EVP_sha, EVP_dss, EVP_dss1, EVP_ecdsa, are deprecated in OpenSSL v1.1.1 and hence no longer supported by our products, e.g. adcert, in this release.
        - There is no FIPS mode support in this version. (Ref: CS-46785)
  - Bug fixes
    - N/A


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.7.0 (Release 2020)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Centrify OpenSSL is upgraded based on OpenSSL v1.1.1g instead of v1.1.1b. (Ref: CS-47986)
      - For changelog and vulnerability fix details, please refer to https://www.openssl.org/news/vulnerabilities.html and https://www.openssl.org/news/cl111.txt.
  - Bug fixes
    - N/A


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.8.0 (Release 2021)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Upgraded OpenSSL from v1.1.1g to v1.1.1k. (Ref: CS-49218)
      - For changelog and vulnerability fix details, please refer to https://www.openssl.org/news/vulnerabilities.html and https://www.openssl.org/news/cl111.txt.
  - Bug fixes
    - N/A


author: Vadim Gorelik <vadim.gorelik@centrify.com> 5.8.1 (Release 2021.1)
changelog:
  - For most up-to-date changes, please refer to Centrify Authentication Service and Centrify Privilege Elevation Service Release Notes on Centrify Web Site Product Documentation page (https://www.centrify.com/support/documentation/)
  - Feature changes
    - Upgraded OpenSSL from v1.1.1k to v3.0.0. With OpenSSL v3.0.0, FIPS mode is now supported on AIX, Mac, CentOS x86_64, RHEL x86_64, SLES x86_64, Ubuntu x86_64. (Ref: 353603, 298483)
      - For details, please refer to https://www.openssl.org/ and https://www.openssl.org/docs/.
  - Bug fixes
    - N/A


author: Eason Yu <eason.yu@delinea.com> 5.9.0 (Release 2022)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Upgraded OpenSSL from v3.0.0 to v3.0.1. (Ref: 410082, 419738)
      - This includes security fixes for CVE-2022-0778. For changelog and vulnerability fix details, please refer to https://www.openssl.org/news/vulnerabilities.html and https://www.openssl.org/news/cl30.txt.
  - Bug fixes
    - Fixed library conflict between openssl and DB2 server on AIX. This fixed the problem using DirectControl DB2 GSSAPI Kerberos plugin (Single Sign On) on AIX. (Ref: 418904)


author: Eason Yu <eason.yu@delinea.com> 5.9.1 (Release 2022.1)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Upgraded OpenSSL from v3.0.1 to v3.0.5. (Ref: 444612)
      - This includes security fixes for CVE-2022-1292, CVE-2022-1343, CVE-2022-1434, CVE-2022-1473, CVE-2022-2068, CVE-2022-2097 and CVE-2022-2274. For changelog and vulnerability fix details, please refer to https://www.openssl.org/news/vulnerabilities.html and https://www.openssl.org/news/cl30.txt.
  - Bug fixes
    - N/A


author: Eason Yu <eason.yu@delinea.com> 6.0.0 (Release 2023)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Upgraded OpenSSL from v3.0.5 to v3.0.8. (Ref: 487090)
      - For changelog and vulnerability fix details, please refer to https://www.openssl.org/news/vulnerabilities.html and https://www.openssl.org/news/cl30.txt.
  - Bug fixes
    - N/A


author: Eason Yu <eason.yu@delinea.com> 6.0.1 (Release 2023.1)
changelog:
  - For most up-to-date changes, please refer to Server Suite Release Notes on Delinea Web Site Product Documentation page (https://docs.delinea.com/ssuite/current)
  - Feature changes
    - Upgraded OpenSSL from v3.0.8 to v3.1.2. (Ref: 524065)
      - For changelog and vulnerability fix details, please refer to https://www.openssl.org/news/vulnerabilities.html and https://www.openssl.org/news/cl30.txt.
  - Bug fixes
    - N/A


author: Peter Oliver <rpm@mavit.org.uk> - 50:2020.12.07-3
changelog:
  - Recommend the installation of these dictionaries when both aspell and an English langpack are installed.


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.21-3.1
changelog:
  - update containerd binary to v1.6.21
  - update runc binary to v1.1.7
  - Update Golang runtime to 1.19.9


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.22-3.1
changelog:
  - update containerd binary to v1.6.22
  - update runc binary to v1.1.8
  - Update Golang runtime to 1.19.11


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.24-3.1
changelog:
  - update containerd binary to v1.6.24
  - update runc binary to v1.1.9
  - Update Golang runtime to 1.20.8


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.25-3.1
changelog:
  - update containerd binary to v1.6.25
  - update runc binary to v1.1.10
  - Update Golang runtime to 1.20.10


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.27-3.1
changelog:
  - update containerd binary to v1.6.27
  - update runc binary to v1.1.11
  - Update Golang runtime to 1.20.13


author: Sebastiaan van Stijn <thajeztah@docker.com> - 1.6.28-3.1
changelog:
  - update containerd binary to v1.6.28.
  - update runc binary to v1.1.12, which includes fixes for CVE-2024-21626.


author: Adam Jackson <ajax@redhat.com> - 3.3.12-36
changelog:
  - Don't require xorg-x11-utils at all, doesn't seem to be necessary
  - Require xclipboard xfontsel not xorg-x11-apps


author: Sérgio Basto <sergio@serjux.com> - 1.31-1
changelog:
  - Update fakeroot to 1.31 (#2167522)
  - Add fix from Debian
  - Drop fakeroot-inttypes.patch which had almost 10 year old and I dont know what his purpose
  - Drop relax_tartest.patch we don't need it anymore


author: Antonio Trande <sagitter@fedoraproject.org> - 4.2.15-6
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
  - Use bundled junit
  - Fix hamcrest symlinks in Fedora 35+


author: Robert Scheck <robert@fedoraproject.org> - 1.8.8-8
changelog:
  - Switch from Java 11 to 17 for Red Hat Enterprise Linux 9
  - Add patches for Java 21 support (#2323983, #2340633, #2363798)


author: Tomas Smetana <tsmetana@redhat.com> - 1.6.1-1
changelog:
  - New upstream version
  - Fix rhbz#1834969 - CVE-2020-12761 integer overflow in ICO color maps handling


author: Dominik Mierzejewski <rpm@greysector.net> - 20.2.1-1
changelog:
  - update to 20.2.1 (#1827296)
  - fix build with recent cmake macro changes
  - put the new Media SDK Tracer in a separate subpackage


author: Björn Esser <besser82@fedoraproject.org> - 1.9.4-1
changelog:
  - Update to version 1.9.4 (rhbz#1882874)
  - Package all files generated by doxygen
  - Run tests single threaded


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.8.14-24
changelog:
  - Rearrange whitespace
  - Use HTTPS URLs
  - Make glib2-devel dependency from -devel subpackage arch-specific
  - Use %autosetup, %make_build, and %make_install macros
  - Rather than removing the static library, skip building it with --disable-static
  - Drop obsolete %ldconfig_scriptlets macro
  - Use much stricter path globs
  - Use %name macro
  - Add well-considered patches for all compiler warnings
  - Drop explicitly versioned dependencies per Fedora guidelines
  - Build HTML and PDF versions of documentation; rebuld the info pages; and move
    it all to a -doc subpackage with the text file documentation (README, etc.)
  - Properly install the license (COPYING) file
  - Patch references to the old libIDL-config, which went away in the year 2002
  - Install the m4 script for Autoconf as part of the -devel package
  - Add a man page for the libIDL-config-2 script


author: Xavier Bachelot <xavier@bachelot.org> - 1.3.2-1
changelog:
  - Update to 1.3.2 (RHBZ#2112605, RHBZ#2113476, RHBZ#2089046)
  - Don't build bdj on i386 (RHBZ#2104068)


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.13-5
changelog:
  - Second attempt - Rebuilt for
    https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
  - Fix cmake changes


author: Simone Caronni <negativo17@gmail.com> - 2.2.6-7
changelog:
  - SPEC file cleanup.
  - Use proper macros everywhere.
  - Fix permissions for binaries.
  - Fix rpmlint issues.
  - Trim changelog.


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.36-2
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
  - add gtk-doc to build requirements (#1942967)


author: Paul Howarth <paul@city-fan.org> - 1.10.0-1
changelog:
  - Update to 1.10.0
    - Adds agent forwarding support
    - Adds OpenSSH Agent support on Windows
    - Adds ECDSA key support using the Mbed TLS backend
    - Adds ECDSA cert authentication
    - Adds diffie-hellman-group14-sha256, diffie-hellman-group16-sha512,
      diffie-hellman-group18-sha512 key exchanges
    - Adds support for PKIX key reading when using ed25519 with OpenSSL
    - Adds support for EWOULDBLOCK on VMS systems
    - Adds support for building with OpenSSL 3
    - Adds support for using FIPS mode in OpenSSL
    - Adds debug symbols when building with MSVC
    - Adds support for building on the 3DS
    - Adds unicode build support on Windows
    - Restores os400 building
    - Increases min, max and opt Diffie Hellman group values
    - Improves portability of the make file
    - Improves timeout behaviour with 2FA keyboard auth
    - Various improvements to the Wincng backend
    - Fixes reading partial packet replies when using an agent
    - Fixes Diffie Hellman key exchange on Windows 1903+ builds
    - Fixes building tests with older versions of OpenSSL
    - Fixes possible multiple definition warnings
    - Fixes potential cast issues _libssh2_ecdsa_key_get_curve_type()
    - Fixes potential use after free if libssh2_init() is called twice
    - Improved linking when using Mbed TLS
    - Fixes call to libssh2_crypto_exit() if crypto hasn't been initialized
    - Fixes crash when loading public keys with no id
    - Fixes possible out of bounds read when exchanging keys
    - Fixes possible out of bounds read when reading packets
    - Fixes possible out of bounds read when opening an X11 connection
    - Fixes possible out of bounds read when ecdh host keys
    - Fixes possible hang when trying to read a disconnected socket
    - Fixes a crash when using the delayed compression option
    - Fixes read error with large known host entries
    - Fixes various warnings
    - Fixes various small memory leaks
    - Improved error handling, various detailed errors will now be reported
    - Builds are now using OSS-Fuzz
    - Builds now use autoreconf instead of a custom build script
    - cmake now respects install directory
    - Improved CI backend
    - Updated HACKING-CRYPTO documentation
    - Use markdown file extensions
    - Improved unit tests


author: Paul Howarth <paul@city-fan.org> - 1.10.0-4
changelog:
  - In 8.8 OpenSSH disabled sha1 rsa-sha keys out of the box,
    so we need to re-enable them as a workaround for the test
    suite until upstream updates the tests
    See: https://github.com/libssh2/libssh2/issues/630
  - Drop other test workarounds, none of them being needed any longer


author: Paul Howarth <paul@city-fan.org> - 1.11.0-1
changelog:
  - Update to 1.11.0 (rhbz#2211200)
    - Adds support for encrypt-then-mac (ETM) MACs
    - Adds support for AES-GCM crypto protocols
    - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys
    - Adds support for RSA certificate authentication
    - Adds FIDO support with *_sk() functions
    - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends
    - Adds Agent Forwarding and libssh2_agent_sign()
    - Adds support for Channel Signal message libssh2_channel_signal_ex()
    - Adds support to get the user auth banner message libssh2_userauth_banner()
    - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519,
      AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options
    - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex()
    - Adds wolfSSL support to CMake file
    - Adds mbedTLS 3.x support
    - Adds LibreSSL 3.5 support
    - Adds support for CMake "unity" builds
    - Adds CMake support for building shared and static libs in a single pass
    - Adds symbol hiding support to CMake
    - Adds support for libssh2.rc for all build tools
    - Adds .zip, .tar.xz and .tar.bz2 release tarballs
    - Enables ed25519 key support for LibreSSL 3.7.0 or higher
    - Improves OpenSSL 1.1 and 3 compatibility
    - Now requires OpenSSL 1.0.2 or newer
    - Now requires CMake 3.1 or newer
    - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs
    - SFTP: No longer has a packet limit when reading a directory
    - SFTP: Now parses attribute extensions if they exist
    - SFTP: No longer will busy loop if SFTP fails to initialize
    - SFTP: Now clear various errors as expected
    - SFTP: No longer skips files if the line buffer is too small
    - SCP: Add option to not quote paths
    - SCP: Enables 64-bit offset support unconditionally
    - Now skips leading \r and \n characters in banner_receive()
    - Enables secure memory zeroing with all build tools on all platforms
    - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive
    - Speed up base64 encoding by 7x
    - Assert if there is an attempt to write a value that is too large
    - WinCNG: fix memory leak in _libssh2_dh_secret()
    - Added protection against possible null pointer dereferences
    - Agent now handles overly large comment lengths
    - Now ensure KEX replies don't include extra bytes
    - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER
    - Fixed possible buffer overflow in keyboard interactive code path
    - Fixed overlapping memcpy()
    - Fixed Windows UWP builds
    - Fixed DLL import name
    - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows
    - Support for building with gcc versions older than 8
    - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files
    - Restores ANSI C89 compliance
    - Enabled new compiler warnings and fixed/silenced them
    - Improved error messages
    - Now uses CIFuzz
    - Numerous minor code improvements
    - Improvements to CI builds
    - Improvements to unit tests
    - Improvements to doc files
    - Improvements to example files
    - Removed "old gex" build option
    - Removed no-encryption/no-mac builds
    - Removed support for NetWare and Watcom wmake build files
  - Avoid use of deprecated patch syntax
  - Build static library but don't package it since it's required for the
    test suite (https://github.com/libssh2/libssh2/issues/1056)
  - Remove redundant references to %{_libdir} from pkgconfig file
  - Add patch to work around strict permissions issues for sshd tests


author: Frantisek Sumsal <frantisek@sumsal.cz> - 1.2.0-7
changelog:
  - Initial EPEL 9 build for BZ#2029481
  - Temporarily skip building docs due to work around BZ#2031879


author: Adam Williamson <awilliam@redhat.com> - 0.9.13-8
changelog:
  - Rebase all patches so Patch12 applies
  - Backport PR #444 to fix crash on all runs after the first (#1882718)


author: Davide Cavalca <dcavalca@fedoraproject.org> - 2023.06.20-1
changelog:
  - Update to 2023.06.20
  - Update license tag and convert it to SPDX
  - Tweak package summary and description
  - Rework specfile to follow the Fedora packaging guidelines


author: Richard Shaw <hobbes1069@gmail.com> - 0.2-2
changelog:
  - Update per reviewer comments.
  - Renamed package to lpcnetfreedv (same as library), repo will be renamed in
    the near future.
  - Made library private as it is essentially a plugin for freedv.


author: Daniel Resare <noa@resare.com> 1.2-2
changelog:
  - removed tahoma due to unclear licensing
  - parametrized ttmkfdir path (for mandrake users)
  - changed description text to reflect the new microsoft policy


author: Daniel Resare <noa@resare.com> 1.3-1
changelog:
  - removed python hack
  - removed python hack info from description
  - made tahoma inclusion depend on define
  - added some info on the ttmkfdir define


author: Daniel Resare <noa@resare.com> 1.3-3
changelog:
  - the install dir is now deleted when the package is uninstalled
  - executable permission removed from the fonts
  - executes fc-cache after install if it is available


author: Mikel Olasagasti Uranga <mikel@olasagasti.info> - 7.0.0-1
changelog:
  - Update to 7.0.0 - Closes rhbz#2123699 rhbz#2113532
  - Change license from GPL2 to Apache2
  - Adapt Source for GitHub releases
  - Switch to cmake version
  - Move conversion scripts to doc


author: Ján ONDREJ (SAL) <ondrejj(at)salstar.sk> - 4.0.3-5
changelog:
  - Wait for network-online.target (bz#1898469).
  - Apply /etc/sysconfig/nrpe settings (bz#1806659).
  - Changed /var/run to /run (bz#1870146).


author: Ján ONDREJ (SAL) <ondrejj(at)salstar.sk> - 4.0.3-9
changelog:
  - Don't use get_dh on Fedora 36 - OpenSSL 3. (bz#2021958)
  - Remove unknown --with-init-dir configure parameter.


author: Filip Januš <fjanus@redhat.com> - 3.1-7
changelog:
  - improve recommandation of 32 bit-version
  - resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1803161


author: Neal Gompa <ngompa@datto.com> - 2:2021.8.22-1
changelog:
  - Rebase to version 2021.8.22 to fix various CVEs (RHBZ#1999869)
  - Clean up old cruft for RHEL < 7
  - Split libraries out to libs subpackage


author: Richard W.M. Jones <rjones@redhat.com> - 2:2022.5.17-1
changelog:
  - New upstream version 2022.5.17
  - Fixes: CVE-2021-46790, CVE-2022-30783, CVE-2022-30784, CVE-2022-30785,
    CVE-2022-30786, CVE-2022-30787, CVE-2022-30788, CVE-2022-30789


author: Kalev Lember <klember@redhat.com> - 2.1.1-2
changelog:
  - Update gstreamer plugin to 1.18.2
  - Remove totem supplements as totem has recommends on
    gstreamer1-plugin-openh264 instead


author: Paul Howarth <paul@city-fan.org> - 2.71-1
changelog:
  - Update to 2.71
    - Skip Test::Fork on freebsd (GH#25)
  - Filter unversioned provide of perl(GD::Polygon)


author: Paul Howarth <paul@city-fan.org> - 2.72-1
changelog:
  - Update to 2.72
    - Fix for colorMatch with older unpatched libgd versions, which has an
      exploitable heap overflow (CVE-2019-6977)
  - Note: libgd in Fedora is already patched for CVE-2019-6977


author: Paul Howarth <paul@city-fan.org> - 2.73-1
changelog:
  - Update to 2.73
    - Allow Makefile.PL --options to override the libgd options; not recommended
      (see GH#33 and CPAN RT#130045)


author: Paul Howarth <paul@city-fan.org> - 1:1.54-11
changelog:
  - Spec tidy-up
    - Use author-independent source URL
    - Use %{make_build} and %{make_install}
    - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 0.86-42
changelog:
  - Spec tidy-up
    - Use author-independent source URL
    - Classify buildreqs by usage
    - Use %{make_build} and %{make_install}
    - Make %files list more explicit


author: Kalev Lember <klember@redhat.com> - 1.27.0-1
changelog:
  - Update to 1.27.0
  - Use make_build and make_install macros
  - Tighten soname globs
  - Use license macro for COPYING*
  - Tighten requires with _isa macro


author: Kalev Lember <klember@redhat.com> - 1.27.0-2
changelog:
  - Update pkcs11-helper-rfc7512.patch from
    https://github.com/OpenSC/pkcs11-helper/pull/4 (#1849259)


author: Paul Howarth <paul@city-fan.org> - 2.10.1-1
changelog:
  - Update to 2.10.1
    - CVE-2022-24302: Creation of new private key files using
      '~paramiko.pkey.PKey' subclasses was subject to a race condition between
      file creation and mode modification, which could be exploited by an
      attacker with knowledge of where the Paramiko-using code would write out
      such files; this has been patched by using 'os.open' and 'os.fdopen' to
      ensure new files are opened with the correct mode immediately (we've left
      the subsequent explicit 'chmod' in place to minimize any possible
      disruption, though it may get removed in future backwards-incompatible
      updates)
    - Add support for the '%C' token when parsing SSH config files (GH#1976)
    - Add support for OpenSSH's Windows agent as a fallback when Putty/WinPageant
      isn't available or functional (GH#1509, GH#1837, GH#1868)
    - Significantly speed up low-level read/write actions on
      '~paramiko.sftp_file.SFTPFile' objects by using 'bytearray'/'memoryview'
      (GH#892); this is unlikely to change anything for users of the higher level
      methods like 'SFTPClient.get' or 'SFTPClient.getfo', but users of
      'SFTPClient.open' will likely see orders of magnitude improvements for
      files larger than a few megabytes in size
    - Add 'six' explicitly to install-requires; it snuck into active use at some
      point but has only been indicated by transitive dependency on 'bcrypt'
      until they somewhat-recently dropped it (GH#1985); this will be short-lived
      until we drop Python 2 support


author: Paul Howarth <paul@city-fan.org> - 2.10.2-1
changelog:
  - Update to 2.10.2
    - Fix Python 2 compatibility breakage introduced in 2.10.1 (GH#2001)
  - Re-enable sftp tests, no longer failing under mock


author: Paul Howarth <paul@city-fan.org> - 2.10.3-1
changelog:
  - Update to 2.10.3
    - Certificate-based pubkey auth was inadvertently broken when adding SHA2
      support in version 2.9.0 (GH#1963, GH#1977)
    - Switch from module-global to thread-local storage when recording thread IDs
      for a logging helper; this should avoid one flavor of memory leak for
      long-running processes (GH#2002, GH#2003)


author: Paul Howarth <paul@city-fan.org> - 2.10.4-1
changelog:
  - Update to 2.10.4
    - Update 'camelCase' method calls against the 'threading' module to be
      'snake_case'; this and related tweaks should fix some deprecation warnings
      under Python 3.10 (GH#1838, GH#1870, GH#2028)
    - '~paramiko.pkey.PKey' instances' '__eq__' did not have the usual safety
      guard in place to ensure they were being compared to another 'PKey' object,
      causing occasional spurious 'BadHostKeyException', among other things
      (GH#1964, GH#2023, GH#2024)
    - Servers offering certificate variants of hostkey algorithms (e.g.
      'ssh-rsa-cert-v01@openssh.com') could not have their host keys verified by
      Paramiko clients, as it only ever considered non-cert key types for that
      part of connection handshaking (GH#2035)


author: Paul Howarth <paul@city-fan.org> - 2.11.0-1
changelog:
  - Update to 2.11.0
    - Align signature verification algorithm with OpenSSH re: zero-padding
      signatures that don't match their nominal size/length; this shouldn't
      affect most users, but will help Paramiko-implemented SSH servers handle
      poorly behaved clients such as PuTTY (GH#1933)
    - OpenSSH 7.7 and older has a bug preventing it from understanding how to
      perform SHA2 signature verification for RSA certificates (specifically
      certs - not keys), so when we added SHA2 support it broke all clients using
      RSA certificates with these servers; this has been fixed in a manner similar
      to what OpenSSH's own client does - a version check is performed and the
      algorithm used is downgraded if needed (GH#2017)
    - Recent versions of Cryptography have deprecated Blowfish algorithm support;
      in lieu of an easy method for users to remove it from the list of
      algorithms Paramiko tries to import and use, we've decided to remove it
      from our "preferred algorithms" list, which will both discourage use of a
      weak algorithm, and avoid warnings (GH#2038, GH#2039)
    - Windows-native SSH agent support as merged in 2.10 could encounter
      'Errno 22' 'OSError' exceptions in some scenarios (e.g. server not cleanly
      closing a relevant named pipe); this has been worked around and should be
      less problematic (GH#2008, GH#2010)
    - Add SSH config token expansion (eg '%h', '%p') when parsing 'ProxyJump'
      directives (GH#1951)
    - Apply unittest 'skipIf' to tests currently using SHA1 in their critical
      path, to avoid failures on systems starting to disable SHA1 outright in
      their crypto backends (e.g. RHEL 9) (GH#2004, GH#2011)


author: Paul Howarth <paul@city-fan.org> - 2.12.0-1
changelog:
  - Update to 2.12.0 (rhbz#2140281)
    - Add a 'transport_factory' kwarg to 'SSHClient.connect' for advanced users
      to gain more control over early Transport setup and manipulation (GH#2054,
      GH#2125)
    - Update '~paramiko.client.SSHClient' so it explicitly closes its wrapped
      socket object upon encountering socket errors at connection time; this
      should help somewhat with certain classes of memory leaks, resource
      warnings, and/or errors (though we hasten to remind everyone that Client
      and Transport have their own '.close()' methods for use in non-error
      situations!) (GH#1822)
    - Raise '~paramiko.ssh_exception.SSHException' explicitly when blank private
      key data is loaded, instead of the natural result of 'IndexError'; this
      should help more bits of Paramiko or Paramiko-adjacent codebases to
      correctly handle this class of error (GH#1599, GH#1637)
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 2.12.0-2
changelog:
  - Address CVE 2023-48795 (a.k.a. the "Terrapin Attack", a vulnerability found
    in the SSH protocol re: treatment of packet sequence numbers) as follows:
    - The vulnerability only impacts encrypt-then-MAC digest algorithms in tandem
      with CBC ciphers, and ChaCha20-poly1305; of these, Paramiko currently only
      implements ``hmac-sha2-(256|512)-etm`` in tandem with 'AES-CBC'
    - As the fix for the vulnerability requires both ends of the connection to
      cooperate, the below changes will only take effect when the remote end is
      OpenSSH ≥ 9.6 (or equivalent, such as Paramiko in server mode, as of this
      patch version) and configured to use the new "strict kex" mode
    - Paramiko will always attempt to use "strict kex" mode if offered by the
      server, unless you override this by specifying 'strict_kex=False' in
      'Transport.__init__'
    - Paramiko will now raise an 'SSHException' subclass ('MessageOrderError')
      when protocol messages are received in unexpected order; this includes
      situations like receiving 'MSG_DEBUG' or 'MSG_IGNORE' during initial key
      exchange, which are no longer allowed during strict mode
    - Key (re)negotiation, i.e. 'MSG_NEWKEYS', whenever it is encountered, now
      resets packet sequence numbers (this should be invisible to users during
      normal operation, only causing exceptions if the exploit is encountered,
      which will usually result in, again, 'MessageOrderError')
    - Sequence number rollover will now raise 'SSHException' if it occurs during
      initial key exchange (regardless of strict mode status)
  - Tweak 'ext-info-(c|s)' detection during KEXINIT protocol phase; the original
    implementation made assumptions based on an OpenSSH implementation detail
  - 'Transport' grew a new 'packetizer_class' kwarg for overriding the
    packet-handler class used internally; this is mostly for testing, but advanced
    users may find this useful when doing deep hacks
  - A handful of lower-level classes (notably 'paramiko.message.Message' and
    'paramiko.pkey.PKey') previously returned 'bytes' objects from their
    implementation of '__str__', even under Python 3, and there was never any
    '__bytes__' method; these issues have been fixed by renaming '__str__' to
    '__bytes__' and relying on Python's default "stringification returns the
    output of '__repr__'" behavior re: any real attempts to 'str()' such objects


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.16-19
changelog:
  - Python 2 binary package renamed to python2-saslwrapper
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Dominik Mierzejewski <dominik@greysector.net> - 2.6.2-28
changelog:
  - apply Debian patch to fix CVE-2021-42260 (rhbz#2253716, rhbz#2253718)
  - apply Debian patch to fix CVE-2023-34194 and its duplicate, CVE-2023-40462
    (rhbz#2254376, rhbz#2254381)
  - fix incorrect text element encoding (upstream isssue #51)
  - compile and run tests


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.0.6-3
changelog:
  - Adjust whitespace and ordering to personal preference
  - Add missing autoconf BR and drop bogus libtool BR
  - Add --force to autoreconf
  - Drop --disable-silent-rules configure argument, redundant with V=1 in
    make_build macro
  - Slightly nicer description
  - Install ChangeLog and README
  - Add cryptographic source archive verification


author: Simone Caronni <negativo17@gmail.com> - 1:1.1.4-2
changelog:
  - Clean up SPEC file, fix rpmlint warnings.
  - Rewrite completely init script and install logic completely according to
    packaging guidelines.
  - Add systemd files (starting Fedora 22 / RHEL 8).
  - Remove upgrade stuff (~2005/2006).
  - xfsinfo 1.0.5
  - fslsfonts 1.0.5
  - fstobdf 1.0.6
  - showfont 1.0.5


author: Paul Howarth <paul@city-fan.org> - 5.0.0-1.0
changelog:
  - Update to 5.0.0
    - Removed all of the obsolete (and no longer used) make/imake-based build
      infrastructure
    - Removed the bundled copies of the source code for the external libraries
      used for JPEG and TIFF support (which were not used anyway)
  - Avoid duplicate documentation files by hard linking them together


author: Paul Howarth <paul@city-fan.org> - 6.0.0-1.0
changelog:
  - Update to 6.0.0
    - Add basic HiDPI support
    - Improve the compatibility of the source code with more modern C standards
      (e.g., C23)
    - Fix the build with link-time optimization (GH#25)
    - Fix many other bugs
  - Package NEWS.txt


author: Paul Howarth <paul@city-fan.org> - 6.0.1-1.0
changelog:
  - Update to 6.0.1
    - xvjpeg.c, xvpng.c: Fix gcc warnings on -Wclobbered
    - xvjpeg.c: Fix a bad memory access on jpegs with inverted data
    - Fix xvtext.c overwrite exposed by the link-time optimization fix


author: Paul Howarth <paul@city-fan.org> - 6.0.2-1.0
changelog:
  - Update to 6.0.2
    - Added -isize option to control the icon size in the browser: the syntax is
      -isize <width> or -isize <width>x<height>
      If the height is omitted, it defaults to the width * 3/4
    - xv now checks the XV_OPTIONS environment variable before reading the
      command line; xv splits it into words and parses it like command line
      options
      Use XV_OPTIONS to set default options


author: Ben Woodard <woodard@redhat.com> - 4.3.4-2
changelog:
  - disable building with libunwind to fix C++ exceptions when a C applicaion loads
    a module written in C++ #2175966


