# changelog

author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Add make sources target for koji build
  - Add make srpm target for copr build
  - Support port numbers in https urls
  - Return all received cookies in the final getcert step
  - Add sending Server Name Indication on https connections


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.6-1
changelog:
  - Fix DAGMan where descendants of removed retry-able jobs are marked futile
  - Ensure the condor_test_token works correctly when invoked as root
  - Fix bug where empty multi-line values could cause a crash
  - condor_qusers returns proper exit code for errors in formatting options
  - Fix crash in job router when a job transform is missing an argument


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.8-1
changelog:
  - Fix bug where ssh-agent processes were leaked with grid universe jobs
  - Fix DAGMan crash when a provisioner node was given a parent
  - Fix bug that prevented use of "ftp:" URLs in file transfer
  - Fix bug where jobs that matched an offline slot never start


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.10-1
changelog:
  - Preliminary support for Ubuntu 22.04 (Noble Numbat)
  - Warns about deprecated multiple queue statements in a submit file
  - Fix bug where plugins could not signify to retry a file transfer
  - The condor_upgrade_check script checks for proper token file permissions
  - Fix bug where the condor_upgrade_check script crashes on older platforms
  - The bundled version of apptainer was moved to libexec in the tarball


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.12-1
changelog:
  - Remote condor_history queries now work the same as local queries
  - Improve error handling when submitting to a remote scheduler via ssh
  - Fix bug on Windows where condor_procd may crash when suspending a job
  - Fix Python binding crash when submitting a DAG which has empty lines


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.14-1
changelog:
  - Docker and Container jobs run on EPs that match AP's CPU architecture
  - Fixed premature cleanup of credentials by the condor_credd
  - Fixed bug where a malformed SciToken could cause a condor_schedd crash
  - Fixed crash in condor_annex script
  - Fixed daemon crash after IDTOKEN request is approved by the collector


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.15-1
changelog:
  - Fix bug where Docker universe jobs reported zero memory usage on EL9
  - Fix bug where Docker universe images would not be removed from EP cache
  - Fix bug where condor_watch_q could crash
  - Fix bug that could cause the file transfer hold reason to be truncated
  - Fix bug where a Windows job with a bad executable would not go on hold


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.17-1
changelog:
  - Bug fix for PID namespaces and condor_ssh_to_job on EL9
  - Augment condor_upgrade_check to find unit suffixes in ClassAd expressions


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.18-1
changelog:
  - Proper error message and hold when Docker emits multi-line error message
  - The htcondor CLI now works on Windows


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.19-1
changelog:
  - Numerous updates in memory tracking with cgroups
    - Fix bug in reporting peak memory
    - Made cgroup v1 and v2 memory tracking consistent with each other
    - Fix bug where cgroup v1 usage included disk cache pages
    - Fix bug where cgroup v1 jobs killed by OOM were not held
    - Polls cgroups for memory usage more often
    - Can configure to always hold jobs killed by OOM
  - Make condor_adstash work with OpenSearch Python Client v2.x
  - Avoid OAUTH credmon errors by only signaling it when necessary
  - Restore case insensitivity to 'condor_status -subsystem'
  - Fix rare condor_schedd crash when a $$() macro could not be expanded


author: Derek Weitzel <dweitzel@unl.edu> - 2.3
changelog:
  - Fix tokens that are bigger than 1024 bytes
  - Fix the use of $BEARER_TOKEN when accessing data
  - Allow for multiple read operations, needed on el9


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.3
changelog:
  - Complete the fix from 5.7-1.2. An additional work-around was needed
     for the squid-4 to squid-5 upgrade to change a directory that was generating
     yum transaction errors into a link, which silenced the errors.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.8-1.1
changelog:
  - Update to squid-5.8 with release notes at
      https://www.squid-cache.org/Versions/v5/squid-5.8-RELEASENOTES.html and announcement at
      http://lists.squid-cache.org/pipermail/squid-announce/2023-February/000145.html
      Most important new features in 5.8:
      - A predefined ACL named "to_linklocal" which matches traffic attempting to access
       link-local network services has been added. It is set to "deny" in
       squid/files/postinstall/squid.conf.proto.
      - Bug fixed where cache manager API erroneously returns "mgr_index" instead of requested
       data.
   - Add support for rpmbuild on el9
   - Add object-*.cloud to the computecanada portion of MAJOR_CVMFS in
      squid/files/postinstall/squid.conf.proto.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.8-2.1
changelog:
  - For EL9, in this spec file replace calls to obsolete "service" and add new package
     requirements.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-1.1
changelog:
  - Update to squid-5.9, with announcement at
      http://lists.squid-cache.org/pipermail/squid-announce/2023-May/000147.html and
      release notes at http://www.squid-cache.org/Versions/v5/squid-5.9-RELEASENOTES.html.
      squid-5.9 contains small fixes including improvement of debug logging related to the
      reply_body_max_size parameter.
   - Consistent with squid5, disallow the combination of multiple workers, ufs cache,
      and memory_cache_shared even if collapsed_forwarding is off.
   - Limit the  maximum number of file descriptors to 65536 even if the OS would allow
      a higher number.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-1.2
changelog:
  - With the addtion of an EL9 repository, this release includes an EL9 RPM that was
      compiled on EL9 and that fully supports Web Proxy Auto Discovery. The EL7/EL8
      RPM in this release is unchanged from 5.9-1.1, except for version number.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-2.1
changelog:
  - Apply security patches from Squid 6 to address security concerns since 
      a version of Squid 6 suitable for frontier-squid is not available yet.
   - The following security vulnerabilities have been addressed with patches:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46724
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46847
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46848
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49285
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50269
      https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
   - The following two vulnerabilities are addressed by disabling Gopher and TRACE
      requests, respectively, in the squid.conf.proto file:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46728
      https://megamansec.github.io/Squid-Security-Audit/trace-uaf.html
   - To support SELinux, require /sbin/restorecon and apply it to the log directory,
      in addition to the cache directory.
   - Update to shoal-1.0.2 to fix setting of external_ip.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.1
changelog:
  - Upgrade to 5.9-3 tarball with the following release notes:
    - Add *.eessi.science to MAJOR_CVMFS in squid/files/postinstall/squid.conf.proto.
   - Move frontier-squid.sh from /etc/init.d to /usr/libexec/squid. Remove chkconfig
      because it is no longer needed. Move all steps of preparation of the
      frontier-squid-utils prototype files to this file to simplify future
      maintenance.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.2
changelog:
  - Fix building of RPM to properly choose Python36 or Python39.
       Also, restrict building to x86_64 architecture.


author: Marco Mambelli <marcom@fnal.gov> - 3.10.2
changelog:
  - Glideinwms v3.10.2
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_2/history.html
  - Release candidates 3.10.2-01.rc1 to 3.10.2-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.3
changelog:
  - Glideinwms v3.10.3
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_3/history.html
  - Release candidates 3.10.3-01.rc1 to 3.10.3-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.6
changelog:
  - Glideinwms v3.10.6
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_6/history.html
  - Release candidates 3.10.6-01.rc1 to 3.10.6-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.7-3
changelog:
  - Glideinwms v3.10.7
  - 3.10.7-1 was on Fri Jun 21 2024
  - Removed bash mangling in 3.10.7-3
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_7/history.html
  - Release candidates 3.10.7-01.rc1 to 3.10.7-03.rc3


author: Marco Mambelli <marcom@fnal.gov> - 3.10.8
changelog:
  - Glideinwms v3.10.8
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_8/history.html
  - Release candidates 3.10.8-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.9
changelog:
  - Glideinwms v3.10.9
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_9/history.html
  - Release candidates 3.10.9-01.rc1 to 3.10.9-03.rc3


author: Marco Mambelli <marcom@fnal.gov> - 3.10.10
changelog:
  - Glideinwms v3.10.10
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_10/history.html
  - Release candidates 3.10.10-01.rc1


author: Brian Lin <blin@cs.wisc.edu.> - 2.8.4-1
changelog:
  - HTCondor AP and CE probes now drop privileges to the 'condor' user
    if run as 'root' (SOFTWARE-5531)
  - Improve logging and failure modes when encountering unwriteable
    directories (SOFTWARE-5531)


author: Matt Westphall <westphall@wisc.edu.> - 2.8.5-1
changelog:
  - Log gratia probe failures to aid debugging (SOFTWARE-6037)
  - Fix NameError in post-install script (SOFTWARE-5558)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.0-1
changelog:
  - Release hosted-ce-tools 1.0 (SOFTWARE-5130)
  - Convert scripts to python3 (SOFTWARE-5131)
  - Timeout rsync in update-remote-wn-client (SOFTWARE-4670)
  - Dereference hardlinks when extracting tarball (SOFTWARE-5254)


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.6-1
changelog:
  - HTCondor-CE now uses the C++ Collector plugin for payload job traceability
  - Fix HTCondor-CE mapfiles to be compliant with PCRE2 and HTCondor 9.10.0+
  - Add support for multiple APEL accounting scaling factors
  - Suppress spurious log message about a missing negotiator
  - Fix crash in HTCondor-CE View


author: Tim Theisen <tim@cs.wisc.edu> - 6.0.0-1
changelog:
  - Align HTCondor-CE security configuration with HTCondor defaults
  - Add example configuration on how to ban users
  - Add condor_ce_transform_ads command
  - Improve essential directory checking and creation at startup


author: Tim Theisen <tim@cs.wisc.edu> - 6.0.1-1
changelog:
  - Add grid CA and host certificate/key locations to default SSL search paths
  - Verifies that HTCondor-CE can access the local HTCondor's SPOOL directory
  - Can use condor_ce_trace without SciToken to test batch system integration
  - condor_ce_upgrade_check checks compatibility with next HTCondor version
  - Adds deprecation warnings for old job router configuration syntax


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.6-1
changelog:
  - Fix CE job route transform for job environment
  - Fix CERequirements when the default_CERequirements is not set
  - Add condor_ce_test_token tool to generate short lived SciToken for tests
  - Remove GSI from security method list to eliminate annoying warnings


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.18-0.rc2
changelog:
  - Does not pass WholeNode request expressions to non-HTCondor batch systems
  - Fix certificate subject parsing in condor_ce_host_network_check


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Fix httokendecode -H functionality to only attempt to convert a parsed word
    if it is entirely numeric, not if it just contains one digit.  At the same
    time, rewrite the functionality in native bash instead of using grep and sed.
  - Add htdestroytoken command.
  - Add a symlink htdecodetoken pointing to httokendecode.


author: Dave Dykstra <dwd@fnal.gov> 1.17-1
changelog:
  - Fix the usage of getaddrinfo, which caused a fatal error on python3.9
    on Mac.
  - Make --showbearerurl work properly in combination with --nobearertoken.
  - Change the httokendecode error message for a missing token file to
    stderr instead of stdin.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Fix crash introduced in 1.17 when using --nobearertoken while the
    credkey is not known.
  - Make source rpm buildable on el9.


author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Update httokensh to by default set the minimum vault token time to live to
    6 days, and to make sure that the background refresh never gets a new vault
    token.
  - Changed the preferred name of httokendecode to htdecodetoken, keeping
    links in the opposite direction.
  - Add man pages for httokensh, htdestroytoken, and htdecodetoken.


author: Dave Dykstra <dwd@fnal.gov> 2.0-1
changelog:
  - Replace use of m2crypto and pyOpenSSL with urllib3
  - Replace use of pykerberos with gssapi
  - Use standard Requires for Python modules instead of PyInstaller
  - Add --vaultcertname option to specify an alternative certificate name.
    That used to be an additional optional meaning of the --vaultalias option,
    but urllib3 requires only one name to match.
  - Add setuptools build infrastructure
  - Refactor htgettoken script into module with entry point.
    This enables invoking htgettoken as `htgettoken.main()` from Python.
  - Use wheels to build/install Python package, which simplified the entry
    points and improves (slightly) the metadata
  - Fix the httokensh background process's check for its parent process.
    That is only a backup in case only the parent process is hard-killed,
    because normally the parent process kills the background process when
    the parent exits.
  - Use newer `sts` secrets API for token exchanges.
  - Fix the `-o`/`--outfile` option to work with relative paths. 
  - Change the `--nobearertoken` option to always get and save a vault token.


author: Dave Dykstra <dwd@fnal.gov> 2.0-2
changelog:
  - Fix broken httokendecode symlink.
  - Use python wheels to build/install on el9.  It didn't work on el8 so
    the use of wheels was removed at the last minute before the 2.0-1
    release (without removing it from the changelog like it should have).


author: Dave Dykstra <dwd@fnal.gov> 1.14-1
changelog:
  - Add auditlog configuration option.  As part of that, disable the
    vault systemd ProtectFull and ProtectHome options.
  - Require vault >= 1.12.1.
  - Update the vault-plugin-auth-jwt to the latest upstream commit.
  - Include gox in the source tarball.


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Update vault-plugin-secrets-oauthapp to 3.1.1 which adds support for token
    exchange at a /sts path instead of /creds.  Keep applying the PR patch
    that also adds it under /creds for a transition period until htgettoken
    is updated everywhere to use the new path.
  - Update vault-plugin-auth-jwt to 0.15.2.
  - Update vault-plugin-auth-ssh to 0.3.0.
  - Require vault >= 1.13.
  - Require diffutils.
  - Fix bug where the kerberos policydomain option was ignored.


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Add 'ratelimits' keyword to put a limit on the number of requests per
    client per interval.
  - Allow '@' to be included in the ssh plugin's keys.
  - Fix bug that prevented reconfiguration when a policy name changed.
  - Update vault-plugin-auth-jwt to 0.18.0.
  - Update vault-plugin-auth-ssh to 0.3.1.
  - Require vault to be >= 1.15.


author: Dave Dykstra <dwd@fnal.gov> 1.17-1
changelog:
  - Add a patch of PR #90 to vault-plugin-secrets-oauthapp which adds caching
    of tokens exchanged via the /sts path and adds a minimum_seconds option to
    the API.
  - Give vault tokens the capabilities of deleting secrets and revoking
    themselves.
  - Update required vault to 1.17.
  - Update vault-plugin-auth-jwt to 0.21.0.
  - Update vault-plugin-auth-ssh to 0.3.2 which includes the patch for '@' 
    that was previously applied.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Restore patch #41 on vault-plugin-secrets-oauthapp which was accidentally
    dropped.
  - Update to latest commit on vault-plugin-auth-jwt because one of the
    other patches now depends on it in order to apply cleanly.


author: Carl Edquist <edquist@cs.wisc.edu> - 1.20.1-2.4.osg
changelog:
  - **** OSG CHANGELOG ****
      * Fri Dec 30 2022 Carl Edquist <edquist@cs.wisc.edu> - 1.20.1-2.4.osg
      - Bump and rebuild for new gpg key (SOFTWARE-5422)

      * Thu Jan 21 2021 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.20.1-2.3.osg
      - Add 2652-web-input-validation.patch and 2652a-python2.patch to fix XSS vulnerability
          - https://pagure.io/koji/pull-request/2652

      * Fri May 01 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.20.1-2.1.osg
      - Update to 1.20.1-2 from Fedora
      - Drop Fix-1.15-1.16-schema-upgrade-script.patch (upstream)

      * Fri May 01 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.19.1-4.1.osg
      - Update to 1.19.1-4 from Fedora
      - Drop kojid_setup_dns.patch (no longer applies; can do the same thing with editing /etc/mock/site-defaults.cfg instead of a patch)

      * Thu Apr 30 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.18.1-1.1.osg
      - Update to 1.18.1-1 from Fedora
      - Drop 1524-1-set-module_hotfixes-1.patch (upstream)
      - Drop Restore-Python-2.6-compatibility-to-kojid.patch (no longer applies; not needed for EL7, EL8)

      * Thu Apr 23 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.17.0-10.3.osg
      - Apply patches from Koji 1.18.0 to avoid "missing module metadata" error for EL8 builds
          - https://pagure.io/koji/pull-request/1524 (1st commit)

      * Sat Apr 04 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.17.0-10.2.osg
      - Fix kojid to use Python 2.6-compatible gzip (gzip.GzipFile did not support the 'with' statement)
        (Restore-Python-2.6-compatibility-to-kojid.patch)

      * Fri Mar 27 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.17.0-10.osg
      - Update to 1.17.0-10 from Fedora
      - Drop CVE-2019-17109.patch (upstream)

      * Tue Mar 24 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.16.2-1.3.osg
      - Backport CVE-2019-17109 patch from 1.16.3; this replaces the 1635-os_path_join.patch
      - Fix 1.15->1.16 schema upgrade script
        (Fix-1.15-1.16-schema-upgrade-script.patch)
      - Replace kojira-accept-sleeptime-option.patch with kojira-add-sleeptime-to-conf.patch
        (partially upstreamed)

      * Mon Mar 23 2020 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.16.2-1.1.osg
      - Update to 1.16.2-1 from Fedora/EPEL

        Drop OSG patches that no longer apply:
        - Don-t-warn-on-compatrequests.patch
        - Don-t-warn-on-use_old_ssl-OSG-still-relies-on-it.patch
        - koji_passwd_cache.patch
        - koji_passwd_retry.patch
        - koji_proxy_cert.patch

      * Fri Dec 06 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.15.3-1.2.osg
      - Update based on Fedora's 1.15.1-3 spec file and upstream's 1.15.3 tarball.

      * Fri Nov 22 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.14.3-1.2.osg
      - Update based on Fedora's 1.14.0-4 spec file and upstream's 1.14.3 tarball.

      * Fri Nov 22 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.13.2-1.1.osg
      - Update based on Fedora's spec file and upstream's 1.13.2 tarball.

      * Fri Nov 22 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.12.2-1.1.osg
      - Add missing python-multilib and python-psycopg2 dependencies

      * Fri Nov 15 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.12.2-1.osg
      - Update to 1.12.2

      * Wed Oct 09 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.1-1.2.osg
      - Add patch for https://pagure.io/koji/pull-request/1635
        (1635-os_path_join.patch)

      * Thu Mar 14 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.1-1.1.osg
      - Drop python-libcomps requirement

      * Thu Feb 21 2019 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.1-1.osg
      - Update to 1.11.1 (SOFTWARE-3595)
      - Build from developer tarball

      * Tue Oct 30 2018 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.0-1.7
      - Add kojira-accept-sleeptime-option.patch

      * Fri Dec 22 2017 Mátyás Selmeci <matyas@cs.wisc.edu> - (no build)
      - Drop el5-isms (SOFTWARE-3050)
      - Drop createrepo_sha1.patch -- was only required for el5

      * Wed Aug 23 2017 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.0-1.6
      - Fix `koji add-group-pkg` to set the correct type (SOFTWARE-2870)
        (Fix-type-in-add-group-pkg.patch)

      * Thu Jan 19 2017 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.0-1.5
      - Require python-requests-2.6.0 (fixes "call 8 (rawUpload) failed: syntax error: line 1, column 49" error in kojid)

      * Thu Jan 12 2017 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.0-1.4
      - Add db-upgrade-1.10-to-1.11.patch to fix a failing constraint in DB upgrade
        script from 1.10 to 1.11

      * Wed Jan 11 2017 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.0-1.2
      - Add kojiweb_getfile_nontext_fix.patch to fix an error with 'getfile' kojiweb
        URLs

      * Tue Jan 03 2017 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.11.0-1.1
      - Merge OSG changes

      * Tue Oct 04 2016 Mátyás Selmeci <matyas@cs.wisc.edu> - 1.10.1-10.1
      - Merge OSG changes
          - Drop koji_no_sslv3.patch
          - Drop pkgorigins_filename.patch
          - Update other OSG patches

      * Fri Jan 30 2015 Mátyás Selmeci <matyas@cs.wisc.edu> 1.6.0-10
      - Patch kojid to request sha1 when running createrepo, for el5 compatibility
        (SOFTWARE-1442)

      * Thu Jan 29 2015 Carl Edquist <edquist@cs.wisc.edu> - 1.6.0-9
      - Bring in upstream fix to parse repomd.xml for pkgorigins filename,
        required for el6 koji upgrade (SOFTWARE-1442)
        (pkgorigins_filename.patch)

      * Thu Oct 16 2014 Carl Edquist <edquist@cs.wisc.edu> - 1.6.0-8
      - Add patch to allow using TLSv1 instead of SSLv3 (SOFTWARE-1637)
        (koji_no_sslv3.patch)

      * Wed May 22 2013 Matyas Selmeci <matyas@cs.wisc.edu> - 1.6.0-7
      - Add use_host_resolv to opts in koji cli so koji --mock-config makes configs with DNS set up
        (kojicli_setup_dns.patch)

      * Wed Oct 31 2012 Matyas Selmeci <matyas@cs.wisc.edu> - 1.6.0-6
      - Add Brian Bockelman's patch to allow using proxy certs
        (koji_proxy_cert.patch)

      * Wed Jun 13 2012 Matyas Selmeci <matyas@cs.wisc.edu> - 1.6.0-5
      - Allow user to retry entering SSL key password
        (koji_passwd_retry.patch)

      * Fri Oct 28 2011 Matyas Selmeci <matyas@cs.wisc.edu> - 1.6.0-4
      - add patch to check for spec file only after running source_cmd in a build from an scm
        (kojid_scmbuild_check_spec_after_running_sourcecmd.patch)

      * Tue Oct 11 2011 Matyas Selmeci <matyas@cs.wisc.edu> - 1.6.0-3
      - add setup_dns to rootopts in kojid
        (kojid_setup_dns.patch)

      * Mon Aug 08 2011 Brian Bockelman <bbockelm@cse.unl.edu> - 1.6.0-2
      - Cache passwords to decrypt SSL key in memory.
        (koji_passwd_cache.patch)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.21.1-1.1.osg
changelog:
  - Update to 1.21.1 and merge OSG changes
  - Drop kojicli_setup_dns.patch (don't need that feature anymore)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.33.0-1.1.osg
changelog:
  - Update to 1.33.0 and merge OSG changes
  - Tentatively drop Fix-type-in-add-group-pkg.patch (doesn't apply, not sure it's needed)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 5.0.1-1
changelog:
  - Update to version 5.0.1
  - Drop patch oidc-agent-webkit.patch (previously backported
  - Drop patch oidc-agent.patch (accepted upstram)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.2.0-1
changelog:
  - Turn osg-configure-rsv into a dummy package (SOFTWARE-4511)
  - Add "queue" to OSG_ResourceCatalog for Pilot sections (SOFTWARE-5881)


author: Mats Rynge <rynge@isi.edu> 1.7-1
changelog:
  - Moved to the new ospool.osg-htc.org central managers in high
    availability setup
  - Removed pre-9.0 HTCondor config - this is no longer
    supported by the OSPool (IDTOKENS only)
  - Change the VO override to the lowercase "osg" (SOFTWARE-4905)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.8-1
changelog:
  - Include the package version in the schedd classad (SOFTWARE-5105)
  - Disable .sif images on 3.x kernels (OSPOOL-18)
  - Improve OS_VERSION handling
  - Drop Map* ProbeConfig overrides (SOFTWARE-5042)


author: Brian Lin <blin@cs.wisc.edu> - 3.6.0
changelog:
  - Add configuration file for osg-incommon-cert-request (SOFTWARE-5668)
  - Update default CSR key length to 4096, add CLI option (SOFTWARE-5651)


author: Brian Lin <blin@cs.wisc.edu> - 3.6.1
changelog:
  - Fix bug with default CA config file option (SOFTWARE-5668)
  - Update default InCommon IGTF CA IDs to point to CA 3


author: Dave Dykstra <dwd@fnal.gov> - 3.7.0
changelog:
  - Convert osg-incommon-cert-request to use urllib3 instead of M2crypto 
    for its https connection, to make it work properly on EL9.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 23-6
changelog:
  - Use osg-htc.org (SOFTWARE-5986)
  - Use "distrepo" repos for minefield (SOFTWARE-5986)
  - Drop osg-next repo files (SOFTWARE-5986)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.7.0-1
changelog:
  - Convert osg-system-profiler-viewer to Python 3
  - Add XRootD cconfig dumps (SOFTWARE-4933)
  - Print crypto policy if available (SOFTWARE-5330)
  - Fix email address in help message


author: Brian Lin <blin@cs.wisc.edu> - 0.8.1-1
changelog:
  - Add the --pw-store option to the invocation of oidc-add and add a default
    scope of blank if no scopes are configured.  These are needed for the
    CILogon issuer (SOFTWARE-4983).


author: Carl Edquist <edquist@cs.wisc.edu> - 0.8.2-1
changelog:
  - Increase renewal frequency to ensure continual validity (SOFTWARE-5137)
  - Fix password file handling for restricted permissions in setup script (#17)
  - Use newer --pw-file option for oidc-add (SOFTWARE-5050)
  - Bump version requirement for oidc-agent package (SOFTWARE-5050)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 23-5
changelog:
  - Log DNs of incoming certificates (SOFTWARE-5370); raise required XRootD version to 1:5.6.0 for the feature


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.0.1-1.1
changelog:
  - Build for OSG; add setuptools_scm build dependency (SOFTWARE-4877)
    Ignore byte-compile errors: they fail on Python 2 code in the examples


author: Dave Dykstra <dwd@fnal.gov> 1.17.2-1
changelog:
  - Update to upstream 1.17.2
  - Add a temporary wrapper script on the vault command to avoid an irrelevant
    warning issued by the gosnowflake dependency when DBUS_SESSION_BUS_ADDRESS
    is not set


author: Dave Dykstra <dwd@fnal.gov> 1.17.2-2
changelog:
  - Stop including go in the source tarball, instead assume the build pulls
    in a new enough version of golang.


author: Brian Lin <blin@cs.wisc.edu> - 132-1
changelog:
  - Update certificates for FNAL and SLAC VOMS servers
  - Update certificates for CLAS12, EIC, GLOW, and HCC
  - Drop stale certificates for nanohub, STAR, and wisc.edu lz


author: Mátyás Selmeci <mselmeci@wisc.edu> - 138-1
changelog:
  - Add new CERN IAM endpoint for CMS (SOFTWARE-6072)
  - Remove lcg-voms2.cern.ch and voms2.cern.ch LSC files and vomses entries (SOFTWARE-6072)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.27.rc3
changelog:
  - Update to version 2.1.0-rc3
  - Drop patches accepted upstream
  - Add new patches (the PRs have been accepted upstream)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.4.0-2
changelog:
  - Add python3-condor and python3-xrootd build dependencies so we don't build RPMs for repos
    which they can't be installed from.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.5.0-1
changelog:
  - Have the authfile updater get a grid-mapfile from Topology for
    stash-cache-auth and stash-origin-auth (SOFTWARE-5467)


author: Matt Westphall <westphall@wisc.edu> - 3.6.0-1
changelog:
  - Make redirector line in cache config customizable (SOFTWARE-5641)
  - check for *.local files in /etc/xrootd in authfile-updater (SOFTWARE-5597)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.7.0-1
changelog:
  - Make use of grid-mapfile downloaded from Topology.
    Requires osg-xrootd >= 3.6-24 (for OSG 3.6) or >= 23-6 (for OSG 23)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.7.0-2
changelog:
  - Relax main package version requirement in stash-cache and stash-origin subpackages
    to make upgrades to OSG 24 easier (SOFTWARE-6045)


author: Brian Bockelman <bbockelman@morgridge.org> - 0.9.2-1
changelog:
  - Add support for the `pelican://` protocol, allowing XCache to consume
    the federation metadata directly.


author: Brian Bockelman <bbockelman@morgridge.org> - 0.9.3-1
changelog:
  - Add support for requesting reversed connections from the Pelican connection broker.
  - Plugin no longer drops query parameters when `pelican://` is used; fixes
    issues with missing authorization from URL.


author: Brian Bockelman <bbockelman@morgridge.org> - 1.0.0-1
changelog:
  - Switch to using PROPFIND for stat, preventing opening a directory as a file
  - Implement directory listings at the cache
  - Cache the results of the director response, skipping director lookup when not needed
  - Forward pelican.timeout header to the remote origin
  - Fix a bug that invoked a callback twice, potentially segfaulting the process
  - Add unit tests to the project


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.7.1-1.2
changelog:
  - Update 2300-stat-call-reduction.patch (SOFTWARE-6003)
  - Add 2348-cache-age-logic.patch (SOFTWARE-6003)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.7.2-1.1
changelog:
  - Update to 5.7.2 and drop upstreamed patches (SOFTWARE-6036)
    - Drop 2300-stat-call-reduction.patch
    - Update 2348-cache-age-logic.patch
      (replace with https://github.com/bbockelm/xrootd/commit/2160a23febe1782cc3590a473209f0e74f965084)
    - Drop 2357-fix-errSocketTimeout-loop.patch
    - Drop 2363-reset-runstatus-in-redrive-thread.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.7.2-1.3
changelog:
  - Use patches from PelicanPlatform/xrootd (SOFTWARE-6063)
      - Replace 1868-env-hostname-override.patch with 0001-Allow-hostname-used-by-XRootD-to-be-overridden-by-en.patch (PelicanPlatform/xrootd #1)
      - Replace 2348-cache-age-logic.patch with 0002-XrdHttp-determines-the-presence-of-the-Age-header-in.patch (PelicanPlatform/xrootd #2)
      - Replace 2395-cinfo-read-fd-leak.patch with 0003-Fix-FD-leak-when-reading-file-size-from-cinfo-file-i.patch (PelicanPlatform/xrootd #3)
      - Replace 2269-defer-client-auth.patch with 0004-Defer-client-TLS-auth-until-after-HTTP-parsing.patch (PelicanPlatform/xrootd #4)
      - Replace bbockelm-3-oss-statistics.patch with 0005-Add-new-filesystem-load-counter-plugin.patch (PelicanPlatform/xrootd #5)
      - Add 0006-XrdSciTokens-Handle-multiple-authorization-token-set.patch (PelicanPlatform/xrootd #6)
      - Add 0007-XrdHttp-Add-http.staticheader.patch (PelicanPlatform/xrootd #7)
      - Add 0008-XrdHttp-Set-oss.asize-if-object-size-is-known.patch (PelicanPlatform/xrootd #8)


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.7.2-1.4
changelog:
  - Two more patches from PelicanPlatform/xrootd (SOFTWARE-6063)
      - Add 0010-do_WriteSpan-Add-written-bytes-in-file-statistics.patch (PelicanPlatform/xrootd #10)
      - Add 0011-Xrd-Fix-MacOS-poller.patch (PelicanPlatform/xrootd #11)


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.7.2-1.4.purge
changelog:
  - Add purge plugin patch 0009-Second-rebase-of-alja-purge-main-rb1-onto-master-5.7.patch
      (PelicanPlatform/xrootd #9)


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.7.3-1.1
changelog:
  - Update to XRootD 5.7.3 (SOFTWARE-6071)
  - Drop upstreamed patches:
      - 0003-Fix-FD-leak-when-reading-file-size-from-cinfo-file-i~a219487.patch
      - 0008-XrdHttp-Set-oss.asize-if-object-size-is-known~d710312.patch
      - 0010-do_WriteSpan-Add-written-bytes-in-file-statistics~98a22ba.patch
      - 0011-Xrd-Fix-MacOS-poller~79a5439.patch
  - Replace patches with updated versions:
      - 0004-Defer-client-TLS-auth-until-after-HTTP-parsing~323a16b.patch
          -> 0003-XrdTls-Allow-disabling-of-X.509-client-auth.patch~18e1c81.patch
      - 0005-Add-new-filesystem-load-counter-plugin~3c1be23.patch
          -> 0004-Add-new-filesystem-load-counter-plugin.patch~3c1be23.patch
      - 0006-XrdSciTokens-Handle-multiple-authorization-token-set~7433116.patch
          -> 0005-XrdSciTokens-Handle-multiple-authorization-token-set.patch~a33ca13.patch
      - 0007-XrdHttp-Add-http.staticheader~2175ae2.patch
          -> 0006-XrdHttp-Add-http.staticheader.patch~5c6ee05.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.7.3-1.2
changelog:
  - Fix patch file names
  - Add:
      - 0007-XrdPfc-Check-for-a-null-pointer-dereference~121f60b.patch
      - 0008-XrdHttp-Undo-HTTP-PUT-response-code-change~956b9fa.patch


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 2.1.3-1
changelog:
  - Fail plugin initialization if we can't get the OSS (SOFTWARE-5388)
  - If user cannot be mapped to uid, continue as anonymous
  - Change from named daemon to exec


