# changelog

author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.37.2-1.0.1
changelog:
  - Sync with hotfix XS82E006
  - CA-340619: Propagate errors from snaphot creation
  - CA-342578: fix switch case fall through error
  - CA-342553: don't try to read encryption key from raw parent


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.37.3-1.0.1
changelog:
  - Sync with CH 8.2.1
  - *** Upstream changelog ***
  - * Thu Oct  7 2021 Mark Syms <mark.syms@citrix.com> - 3.37.3-1.0
  - - CA-355145: guard vbd_stats
  - - CA-183182: Don't error if there are no tapdisks to signal


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.37.4-1.0.1
changelog:
  - Sync with hotfix XS82ECU1009
  - *** Upstream changelog ***
  - * Fri Apr 29 2022 Mark Syms <mark.syms@citrix.com> - 3.37.4-1.0
  - - CA-350300: remove duplicated and unchecked call to canonpath


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.37.4-2.1
changelog:
  - Sync with hotfix XS82ECU1051
  - *** Upstream changelog ***
  - * Mon Jun 26 2023 Mark Syms <mark.syms@citrix.com> - 3.37.4-2
  - - CA-366614: clean up old tapdisk log files


author: Gael Duperrey <gduperrey@vates.tech> - 3.37.4-3.1
changelog:
  - Sync with hotfix XS82ECU1056
  - *** Upstream changelog ***
  - * Thu Sep 07 2023 Mark Syms <mark.syms@citrix.com> - 3.37.4-3
  - - CP-45025: Avoid retries except in a few specific cases
  - - CA-382087: Only write the bitmap if the contents have changed


author: Gael Duperrey <gduperrey@vates.tech> - 3.37.4-4.1
changelog:
  - Sync with hotfix XS82ECU1075
  - *** Upstream changelog ***
  - * Tue Aug 13 2024 Mark Syms <mark.syms@cloud.com> - 3.37.4-4
  - - CP-37221: backport coalesce performance improvements


author: Gael Duperrey <gduperrey@vates.tech> - 8.6.0-2.1
changelog:
  - Synced from XS82ECU1063
  - Removed xenserver-specific test of the dist macro
  - Replaced perl-interpreter BuildRequires with perl
  - Replaced unsupported %lconfig_scriptlets macro with %post and %postun one liners


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1.9.4-1.1
changelog:
  - Sync with hotfix XS82E033
  - *** Upstream changelog ***
  - * Fri Aug 20 2021 Xihuan Yang <xihuan.yang@citrix.com> - 1.9.4-1
  - - CP-37595: Add template for Rocky Linux 8
  - * Wed Mar 17 2021 Xihuan Yang <xihuan.yang@citrix.com> - 1.9.2-1
  - - CP-36311: add template for gooroom os


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1.9.6-1.1
changelog:
  - Sync with CH 8.2.1
  - *** Upstream changelog ***
  - * Mon Oct 11 2021 Martin Harvey <martin.harvey@citrix.com> - 1.9.6-1
  - - CP-38270: Windows Server 2022 template not experimental in yangtze.
  - * Tue Sep 21 2021 Martin Harvey <martin.harvey@citrix.com> - 1.9.5-1
  - - CP-37828: Commit windows server 2022 template into release


author: Gael Duperrey <gduperrey@vates.fr> - 1.10.4-2.1
changelog:
  - Sync with hotfix XS82ECU1036
  - Remove XCP-ng's version of debian 11 template as it is now provided from upstream
  - *** Upstream changelog ***
  - * Thu Jun 29 2023 Lunfan Zhang <Lunfan.Zhang@citrix.com> - 1.10.4-1
  - - CP-42910: Add Debian 11 and Ubuntu 2204 template


author: Gael Duperrey <gduperrey@vates.fr> - 1.10.5-1.1
changelog:
  - Sync with hotfix XS82ECU1046
  - Remove XCP-ng's version of RHEL 9 template as it is now provided from upstream
  - *** Upstream changelog ***
  - * Fri Aug 18 2023 Lunfan Zhang <Lunfan.Zhang@citrix.com> - 1.10.5-1
  - - CP-42910: Add Red Hat Enterprise Linux 9 template


author: Gael Duperrey <gduperrey@vates.fr> - 1.10.6-1.1
changelog:
  - Sync with hotfix XS82ECU1050
  - Remove XCP-ng's versions of Debian 12, Rocky Linux 9, and Centos Stream 9 templates as they are now provided from upstream
  - *** Upstream changelog ***
  - * Thu Sep 14 2023 Lunfan Zhang <Lunfan.Zhang@citrix.com> - 1.10.6-1
  - - UPD-956: Backport Rocky Linux 9, CentOS Stream 9 and Debian 12's templates to Yangtze


author: Gael Duperrey <gduperrey@vates.tech> - 1.10.7-1.1
changelog:
  - Sync with hotfix XS82ECU1069
  - *** Upstream changelog ***
  - * Tue May 21 2024 Lunfan Zhang <Lunfan.Zhang@cloud.com> - 1.10.7-1
  - - CP-48730: Oracle 8 Requires Minimum 2 vCPUs
  - - CP-44647: Add Ubuntu 24.04 template


author: Ronan Abhamon <ronan.abhamon@vates.fr> - 1.1.0-1
changelog:
  - HTTP server can reuse binding address now
  - Notify when HTTP server is ready
  - Better error handling and command logs
  - SIGTERM can be safely sent to NBD server


author: Gael Duperrey <gduperrey@vates.fr> - 2.22.20-3.1
changelog:
  - initial package, version 2.22.20-3.1
  - Synced from XS driver SRPM intel-i40e-2.22.20-3.xs8~2_1.src.rpm


author: Gael Duperrey <gduperrey@vates.tech> - 2.22.20-5.1
changelog:
  - Synced with intel-i40e-2.22.20-5.xs8~2_1.src.rpm
  - *** Upstream changelog ***
  - * Tue Feb 27 2024 Ross Lagerwall <ross.lagerwall@citrix.com> - 2.22.20-5
  - - CA-386057: Enable legacy-rx by default to resolve performance issue
  - - Note: 2.22.20-5 is for Yangtze, while 2.22.20-4 is for XS8 (rt-next)


author: Rushikesh Jadhav <rushikesh7@gmail.com> - 4.19.140-1
changelog:
  - Update patch level to 4.19.140
  - Enable Kernel modules to support Wireless, Dell RBU
  - Enable NTFS RW


author: Rushikesh Jadhav <rushikesh7@gmail.com> - 4.19.142-1
changelog:
  - Add fix for XSA-331 from kernel package
  - Add fix for XSA-332 from kernel package
  - Update patch level to 4.19.142


author: Rushikesh Jadhav <rushikesh7@gmail.com> - 4.19.142-3
changelog:
  - Security update
  - Fix XSAs 361 362 365
  - Fix use-after-free in xen-netback caused by XSA-332
  - See https://xenbits.xen.org/xsa/
  - Updated to patch-4.19.93-94-mod to resolve XSA 365 conflict


author: Rushikesh Jadhav <rushikesh7@gmail.com> - 4.19.154-1
changelog:
  - Security (XSAs 367 and 371) and bugfix update
  - XSA-367: Linux: netback fails to honor grant mapping errors
  - XSA-371: Linux: blkback driver may leak persistent grants
  - Patches backported from linus kernel to fix event-related issues caused by XSA-332
  - Update patch level to 4.19.154


author: Rushikesh Jadhav <rushikesh7@gmail.com> - 4.19.227-1
changelog:
  - Fixes issue #522
  - Cumulative update till 4.19.227
  - Disabled Citrix patches that were taken from upstream
  - Disabled GFS2 and gvt patches as its not support by the distro


author: Rushikesh Jadhav <rushikesh7@gmail.com> - 4.19.265-1
changelog:
  - Update patch level to 4.19.265
  - Don't provide kernel Provides
  - We don't want kernel-alt to be pulled as build deps instead of main kernel packages


author: Gael Duperrey <gduperrey@vates.tech> - 5.9_0.5.5.0-1.1
changelog:
  - Update to version 5.9_0.5.5.0-1.1
  - Synced from XS driver SRPM mellanox-mlnxen-5.9_0.5.5.0-1.xs8~2_1.src.rpm
  - *** Upstream changelog ***
  - * Mon Aug 28 2023 Stephen Cheng <stephen.cheng@citrix.com> - 5.9_0.5.5.0-1
  - - CP-43274: Update to version 5.9-0.5.5.0


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-18
changelog:
  - fix CVE-2018-0734 - DSA signature local timing side channel
  - fix CVE-2019-1559 - 0-byte record padding oracle
  - close the RSA decryption One & done EM side channel (#1619558)


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
  - fix CVE-2021-23841 openssl: NULL pointer dereference
    in X509_issuer_and_serial_hash()
  - fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
  - Resolves: rhbz#1932132, rhbz#1932126


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
  - fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
  - Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
  - Resolves: rhbz#2039993


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
  - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Related: rhbz#2067160


author: Guillaume Thouvenin <guillaume.thouvenin@vates.tech> - 1:1.0.2k-26.1
changelog:
  - Add openssl-1.0.2k-update-expiring-certificates.patch to fix build time tests
  - Added gcc to BuildRequires


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 2.5.3-2.3.10.2
changelog:
  - Rebuild for updated xs-openssl in XCP-ng 8.2.1
  - Not sure it's required but better safe than sorry


author: Gael Duperrey <gduperrey@vates.fr> - 2.5.3-2.3.11.2
changelog:
  - Sync to hotfix XS82ECU1008
  - *** Upstream changelog ***
  - * Thu Mar 24 2022 Ross Lagerwall <ross.lagerwall@citrix.com> - 2.5.3-2.3.11
  - - CA-364343: Honour updelay when LACP is used
  - - CA-367973: Backport bond-related patches to fix XSI-1198


author: Gael Duperrey <gduperrey@vates.fr> - 2.5.3-2.3.12.1
changelog:
  - Sync to hotfix XS82ECU1017
  - *** Upstream changelog ***
  - * Mon Aug 08 2022 Ross Lagerwall <ross.lagerwall@citrix.com> - 2.5.3-2.3.12
  - - CA-351960 / CA-369139: CVE-2020-35498: Support extra padding length
  - - CA-357261: Hide expected errors from logrotate script


author: David Morel <david.morel@vates.tech> - 2.5.3-2.3.12.2
changelog:
  - Comment out tests that fail
  - Enable make check in spec file, without parallel tests
  - Fix CVE-2023-5366, manual backport from 2.17
  - Backport fix for CVE-2023-1668 from XS 8.3/8.4 version 2.5.3-2.3.14
  - *** Upstream changelog ***
  - * Tue Apr 18 2023 Ross Lagerwall <ross.lagerwall@citrix.com> - 2.5.3-2.3.14
  - - CA-376367: Fix CVE-2023-1668


author: David Morel <david.morel@vates.tech> - 2.5.3-2.3.12.3
changelog:
  - link with xs-openssl instead of openssl
  - fix compilation with an openssl from 1.1.1 branch
  - add an openssl configuration to disable weak ciphers and older TLS versions


author: Ronan Abhamon <ronan.abhamon@vates.fr> - 2.30.8-7.1
changelog:
  - Sync with hotfix XS82ECU1051
  - Sync patches with our latest 2.30.8-8.2 branch
  - *** Upstream changelog ***
  - * Thu Sep 28 2023 Mark Syms <mark.syms@citrix.com> - 2.30.8-7
  - - CP-45514: set ownership and perms on backeend device
  - * Fri Aug 04 2023 Mark Syms <mark.syms@citrix.com> - 2.30.8-6
  - - Fixes for CA-379329, monitor for missing iSCSI sessions
  - * Fri Jun 30 2023 Mark Syms <mark.syms@citrix.com> - 2.30.8-5
  - - CA-375968: multi session iSCSI updates
  - * Fri Jun 30 2023 Mark Syms <mark.syms@citrix.com> - 2.30.8-4
  - - Rebuild
  - * Mon Jun 26 2023 Mark Syms <mark.syms@citrix.com> - 2.30.8-3
  - - Backport fix for CA-378768


author: Ronan Abhamon <ronan.abhamon@vates.fr> - 2.30.8-9.1
changelog:
  - Sync with hotfix XS82ECU1056
  - Sync patches with our latest 2.30.8-8.2 branch
  - *** Upstream changelog ***
  - * Fri Oct 27 2023 Mark Syms <mark.syms@citrix.com> - 2.30.8-9
  - - Backport fix for CP-45927, set Equalogic path checker
  - * Thu Oct 19 2023 Mark Syms <mark.syms@citrix.com> - 2.30.8-8
  - - Backport fix for CA-375367
  - - Backport fix for CA-379315
  - - Backport fix for CA-381221


author: Benjamin Reis <benjamin.reis@vates.fr> - 2.30.8-9.2
changelog:
  - Add 0020-Backport-NFS4-only-support.patch
  - Add 0021-Backport-probe-for-NFS4-when-rpcinfo-does-not-includ.patch


author: Ronan Abhamon <ronan.abhamon@vates.fr> - 2.30.8-10.1
changelog:
  - Sync with hotfix XS82ECU1060
  - Sync patches with our latest 2.30.8-8.2 branch
  - - *** Upstream changelog ***
  - * Fri Jan 19 2024 Mark Syms <mark.syms@citrix.com> - 2.30.8-10
  - - Backport fix for CA-386479, log into all iSCSI targets


author: Ronan Abhamon <ronan.abhamon@vates.fr> - 2.30.8-12.1
changelog:
  - Add 0023-feat-LVHDSR-add-a-way-to-modify-config-of-LVMs-56.patch
  - Sync with hotfix XS82ECU1065
  - Sync patches with our latest 2.30.8-8.2 branch
  - - *** Upstream changelog ***
  - * Wed Mar 13 2024 Mark Syms <mark.syms@citrix.com> - 2.30.8-12
  - - CA-389576: in Python 2.7 IOError is not a subclass of OSError
  - * Mon Feb 26 2024 Mark Syms <mark.syms@citrix.com> - 2.30.8-11
  - - CA-387770 Improve error message for readonly shares
  - - CA-388451: Ensure that xapi sessions are logged out
  - - CP-47841: update multipath confiugration for PURE FlashArray
  - - Backport fix for NFS attach from config
  - - CA-387770: Backport Check for R/O FS at create


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 2.30.8-12.3
changelog:
  - %preun: Move command above exit 0 so that it's executed
  - Properly disable the removed sr_health_check.timer
  - Also remove the dangling symlink if still present due to improper removal
    of the timer in sm-2.30.8-12.2


author: Ronan Abhamon <ronan.abhamon@vates.tech> - 2.30.8-13.1
changelog:
  - Sync with hotfix XS82ECU1075
  - Sync patches with our latest 2.30.8-8.2 branch
  - - *** Upstream changelog ***
  - * Tue Aug 13 2024 Mark Syms <mark.syms@cloud.com> - 2.30.8-13
  - - Update multipath.conf with backports for HPE MSA SAN
  - - Backport fix for CA-393194
  - - UPD-1002: backport updates to multipath.conf for several SANs


author: Benjamin Reis <benjamin.reis@vates.fr> - 1.7.0-1
changelog:
  - Fix lock in updater plugin (See: https://github.com/xcp-ng/xcp/issues/523)
  - Normalize plugins output
  - Add plugin to display return of lsblk


author: Benjamin Reis <benjamin.reis@vates.fr> - 1.7.2-1
changelog:
  - Really disable unwanted repos when running yum update
  - Fix exception handling when a command fails


author: Ronan Abhamon <ronan.abhamon@vates.fr> - 1.8.0-1
changelog:
  - Add LVM plugin to list and create PVs, VGs and LVs
  - RAID plugin: handle gracefully when no RAID is present
  - Add a way to install packages with updater.py
  - xcp-ng-linstor is now a default repo of updater.py


author: Ronan Abhamon <ronan.abhamon@vates.fr> - 1.10.0-1
changelog:
  - Add check_installed function in updater.py
  - Exclude smartctl plugin, only available on XCP-ng 8.3


author: Ross Lagerwall <ross.lagerwall@citrix.com> - 1.3.7-1
changelog:
  - CP-38441: Add bugtool support for vTPM
  - CA-369841: XSI-1298 xen-bugtool command takes over 1 hour to collect xenserver-databases


author: Ross Lagerwall <ross.lagerwall@citrix.com> - 1.3.12-1
changelog:
  - CA-378768: capture block schedulers
  - Capture the contents of the cron dirs
  - CP-41107: Store bug tool log in status report
  - CP-43806: Collect `xen-cpuid -p`
  - Collect customised multipath configuration
  - Remove obsolete MPP from bugtool
  - CP-42688: Collect NRPE config files
  - XSI-1385: Collect plain text (human-readable) SAR file reports


author: Bernhard Kaindl <bernhard.kaindl@cloud.com> - 1.3.13-1
changelog:
  - CP-45506: Also add testcase for the subarchive at etc/systemd.tar
  - CP-45506: Archive /etc/systemd as a tar archive inside the output


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1:1.1.1k-5.1
changelog:
  - Manually sync with CentOS 8's 1.1.1k-5 as Citrix did not update for CH 8.2.1
  - Use the hobbled sources instead of the full sources, as RHEL/CentOS does
  - Rediff Citrix's patch use-linux-random-header.patch


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1:1.1.1k-5.2
changelog:
  - Fix failing tests due to expired certificates in test data
  - Disable zlib to remove TLS compression support
  - Remove extraneous --system-ciphers-file configure option


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1:1.1.1k-6.1
changelog:
  - Sync with Centos 8 Stream's 1.1.1k-6.
  - *** Upstream changelog ***
  - * Wed Mar 23 2022 Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
  - - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - - Resolves: rhbz#2067146


author: David Morel <david.morel@vates.fr> - 1:1.1.1k-9.1
changelog:
  - Sync with Centos 8 Stream's 1.1.1k-9.
  - Remove update-expired-SCT-certificates patch as it is integrated upstream
  - *** Upstream changelog ***
  - * Wed Feb 08 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
  - - Fixed Timing Oracle in RSA Decryption
  -   Resolves: CVE-2022-4304
  - - Fixed Double free after calling PEM_read_bio_ex
  -   Resolves: CVE-2022-4450
  - - Fixed Use-after-free following BIO_new_NDEF
  -   Resolves: CVE-2023-0215
  - - Fixed X.400 address type confusion in X.509 GeneralName
  -   Resolves: CVE-2023-0286
  - * Thu Jul 21 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-8
  - - Fix no-ec build
  -   Resolves: rhbz#2071020
  - * Tue Jul 05 2022 Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
  - - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
  -   Resolves: CVE-2022-2097
  - - Update expired certificates used in the testsuite
  -   Resolves: rhbz#2092462
  - - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
  -   Resolves: rhbz#2090372
  - - Fix CVE-2022-2068: the c_rehash script allows command injection
  -   Resolves: rhbz#2098279


author: David Morel <david.morel@vates.tech> - 1:1.1.1k-12.1
changelog:
  - Sync with Centos 8 Stream's 1.1.1k-12.
  - Do not package openssl.cnf at all for xs-openssl, the system-wide one will be
    the one packaged with openssl.
  - *** Upstream changelog ***
  - * Thu Nov 30 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-12
  - - Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series
  -   (a proper fix for CVE-2020-25659)
  -   Resolves: RHEL-17696
  - * Wed Nov 15 2023 Clemens Lang <cllang@redhat.com> - 1:1.1.1k-11
  - - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
  -   excessively long X9.42 DH keys or parameters may be very slow
  -   Resolves: RHEL-16538
  - * Thu Oct 19 2023 Clemens Lang <cllang@redhat.com> - 1:1.1.1k-10
  - - Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
  -   Resolves: RHEL-14245
  - - Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
  -   Resolves: RHEL-14239


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.5.1-2
changelog:
  - Disable amd64 assembly on non-intel architectures (#2035802):
    this should avoid the issue where an executable stack is created.


