# changelog

author: Tim Theisen <tim@cs.wisc.edu> - 1.104-1
changelog:
  - Update to IGTF 1.114 (SOFTWARE-4965)
  - SOFTWARE-4965: Remove expired Let's Encrypt ROOT CA X3
  - SOFTWARE-4965: Remove expired Let's Encrypt ROOT CA X4


author: Mátyás Selmeci <matyas@cs.wisc.edu> 2.3.1-1
changelog:
  - Replace info about GOC/OIM in 40-siteinfo.ini comments (SOFTWARE-3297)
  - More thoroughly disable WN proxy renewal in BLAHP config (SOFTWARE-3161)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 2.4.0-1
changelog:
  - Stop checking sponsor field in site information (SOFTWARE-3722)
  - Don't change batch system from slurm to pbs (SOFTWARE-3717)
  - Add option to configure blahp for PBS Pro (SOFTWARE-3674)
  - Stop osg-configure when a bad attribute is found (SOFTWARE-3581)
  - Own a section of the SSH config for bosco (SOFTWARE-3630)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.1.1-1
changelog:
  - Relax hostname validation in 40-siteinfo.ini (failing to resolve is now a warning) (SOFTWARE-3953)
  - No longer make resource_group mandatory for CEs in 40-siteinfo.ini (SOFTWARE-3949)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.11.0-1
changelog:
  - Add Pilot entries (SOFTWARE-4177)
  - Don't try to resolve Squid on the CE (SOFTWARE-4362)
  - Ignore all fetch-crl errors, but warn if no CRLs exist (SOFTWARE-4364)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4-1
changelog:
  - Remove osg-release requirement; ignore missing compat packages; only try to
    update packages that are installed (SOFTWARE-2146)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6-1
changelog:
  - Replace references to OSG Twiki with links to current docs (SOFTWARE-3083)
  - Replace help email (SOFTWARE-3015)


author: Dave Dykstra <dwd@fnal.gov> 1.1-1
changelog:
  - Correctly disable secret oauth module instead of incorrect auth module
    when something changes requiring clearing out of old secrets.
  - Allow dashes in names by converting them in bash variables to
    underscores, and reject any other non-alphanumeric or underscore in
    names.
  - Fix bug in RFC8693 token exchange pull request to puppetlabs plugin
    which caused comma-separated scopes to get sent to the token issuer
    instead of space-separated scopes.


author: Dave Dykstra <dwd@fnal.gov> 1.3-1
changelog:
  - Added license in COPYING file
  - Updated to vault-plugin-secrets-oauthapp-2.1.0
  - Updated the token exchange PR for vault-plugin-secrets-oauthapp to
      accept comma-separated lists of audiences
  - Added audit log at /var/log/htvault-config/auditlog
  - Enabled delayed log compression and daily logs instead of weekly
  - Add support for moving the master in a high-availability cluster from
    one machine to another and for changing the name of either peer
  - If 'name' is missing from a yaml list, give a helpful error message 
    instead of causing a python crash
  - Limit vault token policies for oidc and kerberos to a single role
    and issuer.  To use these limited policies for kerberos requires
    htgettoken >= 1.3 so for now the coarse-grained kerberos is still
    supported as well but it will be removed later.
  - Remove the default policy from vault tokens.


author: Dave Dykstra <dwd@fnal.gov> 1.4-1
changelog:
  - Updated the token exchange PR for vault-plugin-secrets-oauthapp to
      send the client secret in the initial authorization request in the
      device flow
  - Updated to vault-plugin-secrets-oauthapp-2.2.0


author: Dave Dykstra <dwd@fnal.gov> 1.5-1
changelog:
  - Require at least vault version 1.8.2
  - Update to vault-plugin-auth-jwt to the master branch at the time of the
    0.10.1 tag of the release-1.8 branch
  - Update to vault-plugin-secrets-oauthapp 3.0.0-beta.3 and use its new
    feature of combining all providers in a single plugin process
  - Include vault-plugin-secrets-oauthapp PR #64 which enables a default
    "legacy" server so older versions of htgettoken can still work.
  - Reconfigure kerberos if the service name changes.
  - Add a "kerbservice" issuers keyword to select non-default kerberos service
    for a particular issuer
  - Immediately fail with a clear message if there's a duplicate name in a
    configuration list
  - Allow vault tokens to read auth/token/lookup-self so clients can look up
    the remaining time to live on the tokens


author: Dave Dykstra <dwd@fnal.gov> 1.7-1
changelog:
  - Require at least vault version 1.8.4
  - Remove support for coarse-grained kerberos; requires htgettoken >= 1.3
  - Use /etc/krb5-<name>.keytab if it exists even for the first defined
    kerberos service, in preference to /etc/krb5.keytab.
  - Update to vault-plugin-secrets-oauthapp 3.0.0
  - Update to vault-plugin-auth-jwt 0.11.1


author: Dave Dykstra <dwd@fnal.gov> 1.8-1
changelog:
  - Restore part of the setup of kerberos; too much was taken out in 1.7
  - When an issuer is deleted, clean out the policies and kerberos modules
    related to its roles
  - Make policy names more consistent with module names


author: Dave Dykstra <dwd@fnal.gov> 1.10-1
changelog:
  - Fix problem that /etc/krb5-<name>.keytab was preferred for first service
    only when the kerbservice was explicitly defined for an issuer.  Now it
    also works for default first kerberos service.


author: Dave Dykstra <dwd@fnal.gov> - 2.1-1
changelog:
  - Merge LIGO changes to debian packaging
  - Move packaging/debian to debian and packaging/redhat to rpm, to work
    better with OBS and new OSG github packaging standard


author: Dave Dykstra <dwd@fnal.gov> - 2.2-1
changelog:
  - Just change the version number because the OSG github-source for
    reading spec files doesn't work with dash release tags.


author: Dave Dykstra <dwd@fnal.gov> - 2.3-1
changelog:
  - Change the changelog date on version 2.0.3 from Feb 28 2017 to
    May 28 2017 because osg-build complained about non-descending order
    of the dates.
  - Change the rpm/rpmbuild-cvmfs-config-osg development test script 
    to read from rpm instead of packaging/redhat.


author: Dave Dykstra <dwd@fnal.gov> - 2.4-1
changelog:
  - Change the server urls for the config-osg repository to use openhtc.io
    aliases when the proxy url can use DIRECT.


author: Dave Dykstra <dwd@fnal.gov> - 2.4-4
changelog:
  - Skipped release 2.4-2 and 2.4-3 to make consistent with cvmfs-config-egi.
  - Change Conflicts: cvmfs-config-default to Obsoletes: to make it
    easier to replace. Add Conflicts: cvmfs-config-egi because it
    is mutually exclusive.


author: Dave Dykstra <dwd@fnal.gov> - 2.5-1
changelog:
  - Update the configuration for the config repo to apply all the logic
    from the config repo's default.conf and common.conf.  That is, support
    USE_CVMFS_CDN and CVMFS_CLIENT_PROFILE and set default CVMFS_PAC_URLS
    covering the WLCG Web Proxy Auto Discovery.
  - Reverse the order of the fallback proxies because of the bug in 
    https://sft.its.cern.ch/jira/browse/CVM-1920


author: Edgar Fajardo <emfajard@ucsd.edu> - 3.4-3
changelog:
  - Merged osg-base-ce and osg-htcondor-ce into only one subpackages (SOFTWARE-2768)
  - Remove the osg-base-ce package


author: Brian Lin <blin@cs.wisc.edu> - 3.5-2
changelog:
  - Add Blahp location and Gratia cleanup configuration (SOFTWARE-3813)
  - Remove deprecated and 32-bit requirements
  - Add Ansible requirement (SOFTWARE-3813)
  - Add tools that automatically update WN tarball, CAs, and CRLs on the
  remote head node (SOFTWARE-3582)


author: Carl Edquist <edquist@cs.wisc.edu> - 3.5-3
changelog:
  - Add schedd cron config for gratia probe (SOFTWARE-3841)
  - Drop ansible requirement (SOFTWARE-3920)


author: Carl Edquist <edquist@cs.wisc.edu> - 3.5-5
changelog:
  - Add SCHEDD_CRON_GRATIA_ARGS to 51-gratia.conf (SOFTWARE-3973)
  - Move 51-gratia.conf to bosco subpackage


author: Diego Davila <didavila@ucsd.edu> - 3.5-3
changelog:
  - Changing "koji.chtc.wisc.edu" for "koji.opensciencegrid.org" (SOFTWARE-3863)
  - Fixing date issue on changelog Fri Feb 08 2018 -> Thu


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.4-7
changelog:
  - Add mistakenly dropped gratia-probe-xrootd-transfer requirement to
    osg-gridftp-xrootd (SOFTWARE-3141)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.5-4
changelog:
  - Add configs and systemd files from OSG modifications of globus-gridftp-server (SOFTWARE-2996)
  - Drop env var to disable SSLv3 (no longer needed)


author: Dave Dykstra <dwd@fnal.gov>> - 1.5.11-1.1
changelog:
  - Updated to upstream 1.5.11-1.1, removed patch for unloading
      OpenSSL error strings (SOFTWARE-3282).


author: Mischa Salle <msalle@nikhef.nl> 1.5.1-2
changelog:
  - Add minimal lcmaps version.
  - Remove configure flag for moduledir.

  - Added plugin lcmaps_ban_dn including manpage.
  - Update URL.
  - Add run-time requirement for lcmaps for basic package.
  - Add architecture to run-time requirement for ldap subpackage.
  - Updated version


author: Mischa Salle <msalle@nikhef.nl> 1.6.2-1
changelog:
  - update builddep on lcmaps-devel instead of -interface
  - prevent unnecessary linking
  - specify BuildRoot (and clean section) for EPEL5
  - remove defattr
  - updated version


author: Mischa Salle <msalle@nikhef.nl> 1.6.2-2
changelog:
  - clean up installed documentation files (breaks Fedora20)
  - correct bogus dates in changelog (breaks Fedora20)
  - correct duplicate entry in filelist


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.4-1
changelog:
  - Add --dry-run option to update-all-remote-wn-clients script
  - Allow more characters in endpoint names in endpoints.ini


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.6-1
changelog:
  - Have update-all-remote-wn-ce run updaters with a timeout (SOFTWARE-4081)
  - If one update fails, keep going with the other updates instead of bailing out


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.8-1
changelog:
  - Download osg-ca-manage from GitHub instead of using a tarball client for fetching CAs (SOFTWARE-4242)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.11-1
changelog:
  - Generalize cvmfsexec-osg-wrapper (SOFTWARE-4722)
  - Have make-cvmfsexec-tarball generate a multiplatform tarball


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.1-1
changelog:
  - Use --location argument to specify destination; use /etc or $OSG_LOCATION/etc if not specified (SOFTWARE-2527)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.3.0-1
changelog:
  - Add osg-release requirement
  - Allow taking osg repo definition from osg-release installed in a tarball client (SOFTWARE-2527)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.7.1-1.5
changelog:
  - Document the options to toggle between considering the first VOMS FQAN or
    considering all of them. (SOFTWARE-2932)


author: Dave Dykstra <dwd@fnal.gov> - 1.7.1-1.6
changelog:
  - Look up lcmaps_is_set_to_verify_voms_attributes symbol instead of
    always calling it, because the symbol isn't available when used by
    llrun. (SOFTWARE-3255)


author: Diego Davila <didavila@ucsd.edu> - 1.7.7-3
changelog:
  - Removig patches: dont_link and find_libXrdSec
  - Making sure upcoming version is higher than testing


author: Diego Davila <didavila@ucsd.edu> - 1.7.7-3
changelog:
  - Adding XrootD major version to the shared file name
  - building against XrootD-4.12.2 (software-4093)


author: Brian Lin <blin@cs.wisc.edu> - 0.8.1-1
changelog:
  - Add the --pw-store option to the invocation of oidc-add and add a default
    scope of blank if no scopes are configured.  These are needed for the
    CILogon issuer (SOFTWARE-4983).


author: Brian Lin <blin@cs.wisc.edu> - 114-1
changelog:
  - Fix typo in CLAS12 and EIC VOMS certificate issuers (SOFTWARE-4701)
  - Add LSC files for CERN VO IAM endpoints (SOFTWARE-4595, SOFTWARE-4576, SOFTWARE-4695)


author: Dave Dykstra <dwd@fnal.gov> - 1.0-1
changelog:
  - Use the same root / $CWD as the target process.  Without this, the
    authz process may utilize the incorrect file for target processes
    that are in a chroot or provide a relative path for the X509 proxy.


author: Dave Dykstra <dwd@fnal.gov> - 2.2-1
changelog:
  - Prevent exiting after the first token authentication
  - Close token file descriptor after use
  - Enable token debug messages
  - Implement WLCG bearer token discovery standard
  - Add libscitokens-dev build dependency on debian


author: Matyas Selmeci <matyas@cs.wisc.edu> 1.3.0-1
changelog:
  - Add SELinux audit logs to osg-system-profiler and URL support to
    osg-system-profiler-viewer (SOFTWARE-2275)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.4.0-1
changelog:
  - Include dump of tomcat server config (SOFTWARE-1099)
  - Create osg-profile.txt in temp dir, do not include old profiles in
    directory dumps (SOFTWARE-1773)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.1-1
changelog:
  - Drop osg-version check (SOFTWARE-2916)
  - Update instructions for getting help (SOFTWARE-2908)
  - Don't include logs for deprecated software (SOFTWARE-2905)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.3-1
changelog:
  - Drop unused files:
      - httpcert.pem
      - tomcat config
      - edg-mkgridmap.log
      - bestman2 logs


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6.0-1
changelog:
  - Query multiple python executables, not just `which python` (which may not exist on EL8) (SOFTWARE-4146)


author: Dave Dykstra <dwd@fnal.gov> 0.2.4-1.3.osg
changelog:
  - Change gsi-authz.conf to have the callout commented out by default
    so globus will fall back to the grid-mapfile


author: Mischa Salle <msalle@nikhef.nl> 0.3.1-1
changelog:
  - remove README file which is now a manpage
  - rename gt4-interface-install script
  - add gt4-interface-install man page
  - remove globus-core and globus-gsi-callback-devel build dependencies
  - update builddep on lcmaps-devel instead of -interface
  - prevent unnecessary linking
  - specify BuildRoot (and clean section) for EPEL5
  - remove defattr
  - cleanup docdir
  - adding BUGS and NEWS files
  - updated version


author: Derek Weitzel <dweitzel@cse.unl.edu> - 1.2.0-1
changelog:
  - Add issuer for latter mapping decisions by issuer
  - Correct access control when allowing only reads


author: Diego Davila <didavila@ucsd.edu> - 0.4.4-2
changelog:
  - adding patch: reserve_on_new.patch to prevent crash on start when ofs.authlib is defined (SOFTWARE-4106)


author: Dave Dykstra <dwd@fnal.gov> 1.1-1
changelog:
  - Integrate with htcondor, including these changes:
   - Change --authpath option name to --oidcpath.
   - Add --noidc option.
   - Add --vaulttokenttl option.
   - Make --vaulttokenfile default to /dev/stdout if the ttl is more than
      a million seconds, and also require it to start with /dev/std or
      /dev/fd if the ttl is more than a million seconds.
   - Add --vaulttokeninfile option.
   - Add --nobearertoken option.
   - Add --showbearerurl option.
   - Send progress output to stderr if --vaulttokenfile is /dev/stdout or
       --showbearerurl option is enabled.
  - Use a separate version number for the python library downloads tarball.


author: Dave Dykstra <dwd@fnal.gov> 1.2-1
changelog:
  - Fix working with a kerberos domain that is missing from krb5.conf
  - Extract more formatted information from http exceptions
  - Improve format of printed kerberos exceptions


author: Dave Dykstra <dwd@fnal.gov> 1.3-1
changelog:
  - Add --kerbprincipal option
  - Change the default kerbpath to include issuer and role
  - Limit oidc polling to 2 minutes
  - Disable oidc authentication when running in the background, that is, when
      none of stdin, stdout, or stderr are on a tty
  - Document that audience can be a comma or space separated list
  - Updated pip-installed dependent packages to latest versions


author: Dave Dykstra <dwd@fnal.gov> 1.4-1
changelog:
  - Add --vaulttokenminttl option
  - Add --web-open-command option, and default it to xdg-open only when
    $SSH_CLIENT is not set
  - Send the extra 'server' parameter recognized by htvault-config >= 1.5
    when --secretpath=secret/oauth/creds/%issuer/%credkey:%role, to use
    shared vault secrets instance (will be default later)
  - Use the new pyinstaller 4.5 exclude_system_libraries() function instead
    of the previous hack to exclude system libraries from being bundled


author: Dave Dykstra <dwd@fnal.gov> 1.6-1
changelog:
  - Try a default cafile of '/etc/pki/tls/cert.pem' if system default is empty.
    This can happen when the SSL_CERT_FILE environment variable is empty.


author: Dave Dykstra <dwd@fnal.gov> 1.7-1
changelog:
  - Start using new vault secrets plugin feature that allows it to be shared
     between all issuers.  Requires htvault-config >= 1.5.
  - Expand the --vaultalias option to also additionally allow that name
  -  in vault's host certificate.
  - Support finding python3 from PATH and not only /usr/bin
  - Support python38
  - Add httokendecode -H option
  - Fix bug that caused traceback when handling an error writing the credkey
  - Update python dependencies to current versions in pip


author: Dave Dykstra <dwd@fnal.gov> 1.8-1
changelog:
  - If kerberos initialization fails with the default KRB5_CONFIG="", try
      again without it.  Observed to be needed at CNAF, although not for
      FNAL, CERN, or LIGO.  Don't do second try if the first error was due
      to an expired ticket, because that sometimes erroneously succeeds on
      second try.


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.12-1
changelog:
  - Added a family of version comparison functions to ClassAds
  - Increased default Globus proxy key length to meet current NIST guidance


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.13-1
changelog:
  - condor_ssh_to_job now maps CR and NL to work with editors like nano
  - Improved the performance of data transfer in condor_ssh_to_job
  - HA replication now accepts SHA-2 checksums to prepare for MD5 removal
  - Submission to NorduGrid ARC CE works with newer ARC CE versions
  - Fixed condor_annex crashes on platforms with newer compilers
  - Fixed "use feature: GPUsMonitor" to locate the monitor binary on Windows
  - Fixed a bug that prevented using the '@' character in an event log path


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.14-1
changelog:
  - Fix for security issue
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0003.html


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.16-1
changelog:
  - Fix for security issue
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0003.html


author: Derek Weitzel <dweitzel@cse.unl.edu> - 1.3.1-1
changelog:
  - Fix dependency change of behavior in PyJWT
  - Add lifetime argument to scitokens-admin-create-token


author: Derek Weitzel <dweitzel@cse.unl.edu> - 1.5.0-1
changelog:
  - Include tests in distribution
  - Bump pyjwt version
  - Add test run with minimum dependencies
  - Run continuous integration on macOS and windows
  - Check verified claims for issuer in SciToken.serialize
  - Add base SciTokensException class
  - Remove verify=False keyword from calls to decode()
  - Print package list in CI jobs
  - Use python3_pkgversion macro in RPM package names
  - Move package version declaration into 'scitokens' module
  - Fix deprecation warning from cryptography.utils.int_from_bytes


author: Brian Lin <blin@cs.wisc.edu> - 1.7.0-1
changelog:
  - Reference test files using relative paths
  - Use shutil.move instead of os.rename
  - Add error message for when SciToken.discover doesn't find a token
  - SciToken.serialize: fix str/bytes mismatch
  - Add rpmbuild github actions workflow
  - Update the bogus url used in the tests
  - Fix bug decoding a token with no audience
  - Use unittest.mock to check UnableToCreateCache
  - Add obsoletes for smoother Yum updates on EL7
  - Update algorithm used to test UnsupportedKeyException
  - Run test suite using pytest during rpmbuild
  - Update pyjwt version in requirements.txt
  - small typo fix in readme
  - Default cached public keys set to 4 days


author: Jason Patton <jpatton@cs.wisc.edu> - 0.8-1
changelog:
  - Python 3 compatibility
  - Credmon subprocess returns on parent exit
  - condor_who now reports credmon as Ready
  - Local issuer no longer refreshes tokens every loop


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.8.1-1.2
changelog:
  - Fix Python 3 bytes/str issue
    Added patch Open-temp-file-as-bytes-for-atomic_output-to-fix-str.patch


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 6.0.0-1
changelog:
  - Update to 6.0.0.  This release adds Python 3 support and changes the
    statistics collector to collector.atlas-ml.org


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 6.1.0-1
changelog:
  - Update to 6.1.0.  This release changes the behavior of stashcp to use
    multiple caches and never go back to the origin.  (SOFTWARE-4255)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 4.2.3-1.1
changelog:
  - Update to 4.2.3-1 from upstream (SOFTWARE-4885)
  - Add Check-for-DT_REG-macro.patch to avoid compile error on EL7 due to missing DT_REG macro


author: Dave Dykstra <dwd@fnal.gov> 4.13-2.1
changelog:
  - Upgrade to 4.13-2 tarball with the following release note:
   - Move temporary logrotate config file to the log directory, to keep
     SELinux on CentOS8 happy.


author: Dave Dykstra <dwd@fnal.gov> 4.13-3.1
changelog:
  - Upgrade to 4.13-3 tarball with the following release notes:
   - Change log rotates to no longer use reconfigure signal but to instead
      set logfile_rotate to zero and use the rotate signal.  This is much
      lighter weight and works around squid bug #5113.  Administrators can
      still set logfile_rotate to non-default values, but it is used only
      by fn-local-squid.sh and overridden for squid.
   - With multiple squid services, send the rotate signal only once to each
      squid.
   - Add timestamps to squidcron.log for the beginning and end of rotation.
  - Remove el6 support


author: Dave Dykstra <dwd@fnal.gov> 4.13-4.1
changelog:
  - Increase shoal-agent version to 1.0.0.
  - Upgrade to 4.13-4 tarball with the following release notes:
   - Add Compute Canada stratum 1s to MAJOR_CVMFS
   - Add any parameters passed in by $SQUID_START_ARGS to the starting of
      squid.  This is set to --foreground by the OSG frontier-squid docker
      container.


author: Dave Dykstra <dwd@fnal.gov> 4.13-5.1
changelog:
  - Upgrade to 4.13-5 tarball with the following release notes:
   - Use /bin/bash instead of $SHELL in fn-local-squid.sh because $SHELL
      is sometimes set to /bin/nologin (in particular when the squid user
      directly invokes fn-local-squid.sh).  This affected cleaning out old
      cache files and starting shoal.
   - Do not attempt to set net.core.somaxconn higher than the kernel
      maximum of 65335.


author: Dave Dykstra <dwd@fnal.gov> 4.13-5.2
changelog:
  - Fix bad permissions on one of the shoal-agent dependency directories.
    Only caused a problem when rebuilding from src rpm.


author: Dave Dykstra <dwd@fnal.gov> 4.15-1.1
changelog:
  - Upgrade to 4.15-1 tarball with the following release notes:
   - Update to squid-4.15 with release announcement at
       http://lists.squid-cache.org/pipermail/squid-announce/2021-May/000127.html
      The update includes security fixes, and at least one (SQUID-2020:11)
      is relevant because it enables someone that is allowed by access
      controls to use squid for some purpose to bypass any other access
      controls and use it for any purpose.  That one can be worked around
      with "uri_whitespace deny", but other denial of service vulnerabilities
      fixed in this version have no workaround.
   - Set "uri_whitespace deny" by default to avoid any other related
      vulnerabilities in the future.
   - Exit with an error if either of the two required logfile_rotate entries
      are not in squid.conf.  This is for the protection of who are using
      SQUID_CUSTOMIZE=false and have not properly merged the changes from
      squid.conf.frontierdefault.
   - Update the customhelps.awk function setoption() to work correctly
      after a setoptionparameter().
   - Allow cache_dir null type which means no disk cache, for systems that
      have very large cache_mem and maximum_object_size_in_memory.


author: Dave Dykstra <dwd@fnal.gov> 4.15-2.1
changelog:
  - Upgrade to 4.15-2 tarball with the following release notes:
   - Fix SQUID_COMPRESS_LOGS=false, which was broken since 4.13-3.  Change
      it to also use the external logrotate command instead of the squid
      builtin log rotation.


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 12.12-1
changelog:
  - GT6 update:
    - Use 2048 bit keys to support openssl 1.1.1 (12.10)
    - Log remote http connection address for legacy s3 transfers (12.11/12.12)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 13.8-1
changelog:
  - Switch upstream to Grid Community Toolkit
  - Grid Community Toolkit merged a number of outstanding pull requests (13.0)
    - Add option to send IPv6 address in EPSV response
    - Add function to get the command string
    - Be more selective in what config files we skip
    - Add unames for GNU/Hurd and kfreebsd to chroot setup script
  - Merge GT6 update 12.5 into GCT (13.1)
  - First Grid Community Toolkit release (13.2)
    - Disable usage statistics reporting by default
    - Add man page for globus-gridftp-password - contribution from IGE
  - Use 2048 bit RSA key for tests (13.3)
  - Merge GT6 update 12.6 into GCT (13.4)
  - Merge GT6 update 12.7 into GCT (13.5)
  - Merge GT6 update 12.8 into GCT (13.6)
  - Merge GT6 update 12.9 into GCT (13.7)
  - Merge GT6 update 12.12 into GCT (13.8)
  - Drop patches globus-gridftp-server-unames.patch, -epsv-ip.patch,
    -cmd-string.patch and -config.patch (accepted upstream)
  - Drop the man page for globus-gridftp-password from the source package
    (accepted upstream)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 13.11-1
changelog:
  - Improvements for filesystems that encounter listing timeouts (13.10)
  - Remove usage statistics collection support (13.11)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 13.20-1
changelog:
  - Fake stat responses when slow listings enabled (13.12)
  - Send markers in stream mode when requested by 'OPTS RETR Markers=n;'
    (13.13)
  - Update documentation links to always point to the latest documentation
    (13.14)
  - Fix doxygen warning (13.15)
  - Remove obsolete acconfig.h file (13.16)
  - Add simple checksum read throttling (13.17)
  - Add support for supported checksum advertising (13.18)
  - Add support for SHA1, SHA256, SHA512 to POSIX DSI (13.18)
  - Avoid unknown secondary groups in test. Causes failures on launchpad
    (13.19)
  - Fix problems between dual-stack (IPv4/IPv6) servers and IPv4-only clients
    (13.20)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 13.20-1.1.osg
changelog:
  - Add patch for gridcf/gct#117 "Restore log transfer functionality that was accidentally removed" (SOFTWARE-4041)


author: Brian Lin <blin@cs.wisc.edu> - 1.4-1
changelog:
  - Add support to GLOBUS_GFS_CMD_SITE_RDEL
  - Add GRIDFTP_APPEND_XROOTD_CGI hook (environment variable) to support Xrootd space token.
  - Renamed xrootd-dsi packaging to reflect upstream


author: Brian Lin <blin@cs.wisc.edu> - 1:1.4-2
changelog:
  - Added architecture-specific provides for xrootd-dsi
  - Refer to gridftp-dsi-posix paths in globus-gridftp-server-plugin


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1:1.4-3
changelog:
  - Packaging changes for EL8 (SOFTWARE-4231):
      - Apparently (x86-64) is not allowed in Obsoletes clauses on EL8; package names only
      - Disable debuginfo package generator since it doesn't find any files


author: Carl Edquist <edquist@cs.wisc.edu> - 1.18.44
changelog:
  - Add Slurm SystemCpu accounting when job completes (SOFTWARE-3825)
  - Add support for decimal seconds fields from sacct (SOFTWARE-3826)
  - Pull in various updates to slurm scripts from htcondor's blap (SOFTWARE-3587)
  - Move local submit attributes scripts from spec to sources (SOFTWARE-3749)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.18.46
changelog:
  - Fix an issue where the slurm binpath always returned scontrol (SOFTWARE-3986)
  - Python 3 compatibility (#7)
  - Handle extra-quoted arguments to condor_submit.sh (SOFTWARE-3993)
  - Expand env vars in configured slurm_binpath (#10)
  - Fix cluster handling in slurm_status.py (#13)
  - Introduce blah_job_env_confs for dynamic env var expansion (SOFTWARE-2521)
  - Add EXIT trap to remove barrier file (SOFTWARE-3930)
  - Amended file credits for Matt Farrellee (#17)


author: Brian Lin <blin@cs.wisc.edu> - 1.18.48-1
changelog:
  - Add an option for HTCondor batch system to expand references to $HOME in the job environment (#23)
  - Add efficient querying of LSF job statuses (#14)
  - Improve logic when proxy refresh is disabled (#24)
  - Fix invalid argument, output, and error format for HTCondor job submission (#22)


author: Derek Weitzel <dweitzel@unl.edu> - 0.6.0-1
changelog:
  - Fix compilation errors on c++11
  - Update to jwt-cpp-0.4.0 vendor
  - Change scitoken profile name to match spec, scitoken:2.0


author: Dave Dykstra <dwd@fnal.gov> - 0.6.3-1
changelog:
  - Add support for building Debian packages on the OpenSUSE Build System
  - Add patch to jwt-cpp to update its picojson dependency in order to
    enable it to compile on Debian 11 and Ubuntu 21.04
  - Fix el7 build by requiring epel-rpm-macros


author: Derek Weitzel <dweitzel@unl.edu> - 0.7.0-1
changelog:
  - Changes from static analysis
  - If only one key is available, do not error on no kid
  - Support at+jwt profile


author: Dave Dykstra <dwd@fnal.gov> - 3.1.1-1
changelog:
  - Rename request.py to cert_request.py
  - Move common crypto code to cert_utils.py
  - Change permissions on generated keys to 644
  - Make -k and -c required in osg-incommon-cert-request, with no default
  - Expand tildes in --cert= and --key= osg-incommon-cert-request options
  - Immediately fail osg-incommon-cert-request if InCommon authentication fails


author: Jeny Teheran <jteheran@fnal.gov> - 3.2.0
changelog:
  - Change -f/--hostfile to -F/--hostfile
  - Change -T/--test to -t/--test
  - Switch argparsing to ArgumentParser
  - Validate if filepath exists and can be read at the ArgumentParser
  - Stop wrapping text messages
  - Include the program name in error messages
  - Show message per certificate when request or retrieval fails
  - Increased the number of retries for certificate retrieval


author: Jeny Teheran <jteheran@fnal.gov> - 3.2.1
changelog:
  - Add man page for osg-incommon-cert-request
  - Add .html version of man page for osg-incommon-cert-request


author: Jeny Teheran <jteheran@fnal.gov> - 3.2.2
changelog:
  - Fix format error for message when retrieval times out
  - Increased the wait time between retrieval attempts
  - Improve formatting of osg-incommon-cert-request man page


author: Dave Dykstra <dwd@fnal.gov> - 3.3.0
changelog:
  - Bump to new middle version number because of the new -O/--orgid option.
  - Slightly reorganize the man page documentation of the new option.


author: Dave Dykstra <dwd@fnal.gov> 1.7.1-1
changelog:
  - Update to upstream 1.7.1.  Add patch for el7 to allow go 1.15.5.
  - Stop disabling vault service on upgrade.


author: Edgar Fajardo <emfajard@ucsd.edu> 3.3-8
changelog:
  - Drop the setup.sh script no longer necessary in 3.4 (SOFTWARE-2676)
  - Drop the glexec subpackages since glexec is dropped in 3.4


author: Brian Lin <blin@cs.wisc.edu> 1.1.6-1
changelog:
  - Change software.grid.iu.edu to repo.grid.iu.edu in osg-ca-scripts (SOFTWARE-2666)
  - Remove unsupported compat links for old OpenSSL hashes
  - Added `ITB` options back to help text


author: Carl Edquist <edquist@cs.wisc.edu> - 1.22.0-1
changelog:
  - Initial release of osg-container-pilot probe (SOFTWARE-4169)
  - More el8 / python3 build fixes (SOFTWARE-4348)
  - Fix bug in cmd.communicate() handling of stderr (SOFTWARE-4348)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.22.1-1
changelog:
  - Add multi-site handling for osg-pilot-container probe (SOFTWARE-4386)
  - More python3 packaging fixes for el8 (SOFTWARE-4398)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.22.2-1
changelog:
  - Fix duration formatting in xml for python3 (SOFTWARE-4416)
  - Report partial jobs for osg pilot container probe (SOFTWARE-4404)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.23.1-1
changelog:
  - Add python2/3 compat for sge probe (SOFTWARE-4286)
  - Add 'QueueTime' collection (SOFTWARE-4479)
  - Add 'GratiaVersion' to UsageRecords (SOFTWARE-4455)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.23.2-1
changelog:
  - Fix attribute list handling for QueueTime (#94) (SOFTWARE-4521)
  - Fix python3 int division in niceNum (#92)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.24.0-1
changelog:
  - Get VO info from AuthToken (SciToken) attrs (SOFTWARE-4615)
  - Lock Version-Release across sub-packages (SOFTWARE-4667)
  - Move 99_gratia-ce.conf to /usr/share location (SOFTWARE-4611)
  - Fix exception handling in condor_meter (SOFTWARE-4711)


