<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="89">
<package pkgid="8369d32cae261fb55faee227d56235059a65030429e090728803d89c0b159fc2" name="apache-rpm-macros" arch="src">
  <version epoch="0" ver="20201124" rel="51.24"/>
  <changelog author="pgajdos@suse.com" date="1436788800">- new macro: %{apache_suse_maintenance_mmn} [bnc#915666] (internal)</changelog>
  <changelog author="pgajdos@suse.com" date="1437134400">- %{apache_suse_maintenance_mmn} expands to just 'apache2' when
  apache2 does not provide suse_maintenance_mmn_# symbol</changelog>
  <changelog author="pgajdos@suse.com" date="1437998400">- bump version to 20150717</changelog>
  <changelog author="pgajdos@suse.com" date="1438084800">- this is arch package</changelog>
  <changelog author="pgajdos@suse.com" date="1440763200">- added macros to test loading modules
  %apache_test_module_start_apache
  %apache_test_module_stop_apache
  %apache_test_module_load
  + macros.apache-module-test</changelog>
  <changelog author="pgajdos@suse.com" date="1441022400">- bump version to 20150902</changelog>
  <changelog author="pgajdos@suse.com" date="1441281600">- version 20150903
- %apache_test_module_start_apache:
  * better check that httpd is really running
  * add -p to mkdir test to not fail if test exist and do not
    remove test dir</changelog>
  <changelog author="pgajdos@suse.com" date="1441454400">- version 20150904
- new macros: %apache_test_module_curl, %apache_test_module_dir</changelog>
  <changelog author="pgajdos@suse.com" date="1442318400">- version 20150915
- new macro: %apache_access_syntax_version</changelog>
  <changelog author="pgajdos@suse.com" date="1442577600">- version 20150918
- -m is no longer required (see apache2-mod_apreq2 for usecase)</changelog>
  <changelog author="pgajdos@suse.com" date="1442923200">- version 20150921
- make package usable also for other rpm based distros
- %apache_test_module_start_apache: introduce -p, -u and -g options
- %apache_test_module_curl: introduce -p and -u option</changelog>
  <changelog author="pgajdos@suse.com" date="1443614400">- version 20150930
- %apache_test_module_start_apache, %apache_test_module_load:
  introduce -t option
- %apache_test_module_curl: introduce -r option</changelog>
  <changelog author="pgajdos@suse.com" date="1446724800">- do not append macros.apache-module-test to macros.apache, provide
  separate macros file instead</changelog>
  <changelog author="pgajdos@suse.com" date="1447156800">- require apache-rpm-macros-control [bsc#893659]</changelog>
  <changelog author="pgajdos@suse.com" date="1448539200">- version 20151211
- %apache_test_module_start_apache:
  * declare -p switch in function header
  * fix wording of messages when apache start failed
  * report unsuccessful start also to stderr to see it in build
    log, when stdout is redirected to a file (see apache-test:
    when apache test failed, macro is exiting 1, so the log is
    not cat'ed to output)
  * %{apache_branch} converted to a number: 204 for 2.4,
    202 for 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1452513600">- version 20160111
  * added %{apache_version}</changelog>
  <changelog author="pgajdos@suse.com" date="1453291200">- version 20161120
- %apache_test_module_start_apache: detect if module is built in
  statically before attempt to search for it in filesystem</changelog>
  <changelog author="ngompa13@gmail.com" date="1574596800">- Replace incorrect usage of %_libexecdir/rpm with %_rpmconfigdir</changelog>
  <changelog author="pgajdos@suse.com" date="1581422400">- version update to 20200211
  * remove %apache_test_* macros, %apache_rex_* is the replacement
    (package apache-rex)
- deleted sources
  - macros.apache-module-test (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1606392000">- version update to 20201124
  * change location of apache2_MMN</changelog>
</package>
<package pkgid="cbc679efd5c513c53d981dade03de854da1ab65d6f7dcf9c9130b255c08d713e" name="apache-rpm-macros" arch="x86_64">
  <version epoch="0" ver="20201124" rel="51.24"/>
  <changelog author="pgajdos@suse.com" date="1436788800">- new macro: %{apache_suse_maintenance_mmn} [bnc#915666] (internal)</changelog>
  <changelog author="pgajdos@suse.com" date="1437134400">- %{apache_suse_maintenance_mmn} expands to just 'apache2' when
  apache2 does not provide suse_maintenance_mmn_# symbol</changelog>
  <changelog author="pgajdos@suse.com" date="1437998400">- bump version to 20150717</changelog>
  <changelog author="pgajdos@suse.com" date="1438084800">- this is arch package</changelog>
  <changelog author="pgajdos@suse.com" date="1440763200">- added macros to test loading modules
  %apache_test_module_start_apache
  %apache_test_module_stop_apache
  %apache_test_module_load
  + macros.apache-module-test</changelog>
  <changelog author="pgajdos@suse.com" date="1441022400">- bump version to 20150902</changelog>
  <changelog author="pgajdos@suse.com" date="1441281600">- version 20150903
- %apache_test_module_start_apache:
  * better check that httpd is really running
  * add -p to mkdir test to not fail if test exist and do not
    remove test dir</changelog>
  <changelog author="pgajdos@suse.com" date="1441454400">- version 20150904
- new macros: %apache_test_module_curl, %apache_test_module_dir</changelog>
  <changelog author="pgajdos@suse.com" date="1442318400">- version 20150915
- new macro: %apache_access_syntax_version</changelog>
  <changelog author="pgajdos@suse.com" date="1442577600">- version 20150918
- -m is no longer required (see apache2-mod_apreq2 for usecase)</changelog>
  <changelog author="pgajdos@suse.com" date="1442923200">- version 20150921
- make package usable also for other rpm based distros
- %apache_test_module_start_apache: introduce -p, -u and -g options
- %apache_test_module_curl: introduce -p and -u option</changelog>
  <changelog author="pgajdos@suse.com" date="1443614400">- version 20150930
- %apache_test_module_start_apache, %apache_test_module_load:
  introduce -t option
- %apache_test_module_curl: introduce -r option</changelog>
  <changelog author="pgajdos@suse.com" date="1446724800">- do not append macros.apache-module-test to macros.apache, provide
  separate macros file instead</changelog>
  <changelog author="pgajdos@suse.com" date="1447156800">- require apache-rpm-macros-control [bsc#893659]</changelog>
  <changelog author="pgajdos@suse.com" date="1448539200">- version 20151211
- %apache_test_module_start_apache:
  * declare -p switch in function header
  * fix wording of messages when apache start failed
  * report unsuccessful start also to stderr to see it in build
    log, when stdout is redirected to a file (see apache-test:
    when apache test failed, macro is exiting 1, so the log is
    not cat'ed to output)
  * %{apache_branch} converted to a number: 204 for 2.4,
    202 for 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1452513600">- version 20160111
  * added %{apache_version}</changelog>
  <changelog author="pgajdos@suse.com" date="1453291200">- version 20161120
- %apache_test_module_start_apache: detect if module is built in
  statically before attempt to search for it in filesystem</changelog>
  <changelog author="ngompa13@gmail.com" date="1574596800">- Replace incorrect usage of %_libexecdir/rpm with %_rpmconfigdir</changelog>
  <changelog author="pgajdos@suse.com" date="1581422400">- version update to 20200211
  * remove %apache_test_* macros, %apache_rex_* is the replacement
    (package apache-rex)
- deleted sources
  - macros.apache-module-test (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1606392000">- version update to 20201124
  * change location of apache2_MMN</changelog>
</package>
<package pkgid="8e2b093c7768c9d1d9d9afe81b493d6294b0da855da25315db26ab196138c794" name="apache-rpm-macros-control" arch="src">
  <version epoch="0" ver="20151110" rel="12.3"/>
  <changelog author="pgajdos@suse.com" date="1447156800">- initial version of the package 20151110 [bsc#893659]
  macros: %define apache_restart_flag
    %apache_request_restart
    %apache_restart_if_needed</changelog>
  <changelog author="opensuse@cboltz.de" date="1450440000">- fix typo in %apache_request_restart</changelog>
  <changelog author="ngompa13@gmail.com" date="1574596800">- Replace incorrect usage of %_libexecdir/rpm with %_rpmconfigdir</changelog>
</package>
<package pkgid="1348eec48e40ff43924627cbf1eae9b0e645f9526f41ba3f1692dc45050f25d3" name="apache-rpm-macros-control" arch="x86_64">
  <version epoch="0" ver="20151110" rel="12.3"/>
  <changelog author="pgajdos@suse.com" date="1447156800">- initial version of the package 20151110 [bsc#893659]
  macros: %define apache_restart_flag
    %apache_request_restart
    %apache_restart_if_needed</changelog>
  <changelog author="opensuse@cboltz.de" date="1450440000">- fix typo in %apache_request_restart</changelog>
  <changelog author="ngompa13@gmail.com" date="1574596800">- Replace incorrect usage of %_libexecdir/rpm with %_rpmconfigdir</changelog>
</package>
<package pkgid="daed154d6ab4b64dc8e7ffb0c6fe39db3f42e7eb5e3d8bedab55f59d1f5335b4" name="apache2-debugging-modules" arch="src">
  <version epoch="0" ver="2.4" rel="15.3"/>
  <changelog author="poeml@suse.de" date="1169208000">- package created, bundling mod_backtrace,
    mod_backdoor,
  mod_whatkilledus,
  mod_diagnostics</changelog>
  <changelog author="poeml@suse.de" date="1169380800">- rename module file mod_diagnostics.so to mod_diagnostic_filter.so,
  so it matches the internal module name (since we require that
  they are the same, so the proper LoadModule statement is
  generated)</changelog>
  <changelog author="pgajdos@suse.com" date="1415102400">- call spec-cleaner
- use apache rpm macros
- fix build</changelog>
  <changelog author="lars@linux-schulserver.de" date="1431259200">- update modules
- call spec-cleaner again
- own apache libexecdirs</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1449576000">- use sources from https://emptyhammock.com/downloads/ for
  mod_backtrace, mod_crash and mod_whatkilledus
- test packages with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1450267200">- test mod_backtrace, mod_whatkilledus and mod_crash more deeply
- add wku.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1452254400">- test mod_diagnostics</changelog>
  <changelog author="pgajdos@suse.com" date="1452600000">- %check: access syntax depends rather on %{apache_branch}, as test
  does not use system setting (/etc/apache2) at all</changelog>
  <changelog author="pgajdos@suse.com" date="1581336000">- use apache-rex framework for %check</changelog>
  <changelog author="pgajdos@suse.com" date="1606737600">- mod_backtrace documention does not mention mpm while building
  should differ (but untested for now)</changelog>
  <changelog author="pgajdos@suse.com" date="1718798400">- do not buildrequire unmaintained apache-rex</changelog>
</package>
<package pkgid="1981a693cfb34744327ef7196486575417805d980ae774f5892c0dc8dd8e4e26" name="apache2-debugging-modules" arch="x86_64">
  <version epoch="0" ver="2.4" rel="15.3"/>
  <changelog author="pgajdos@suse.com" date="1415102400">- call spec-cleaner
- use apache rpm macros
- fix build</changelog>
  <changelog author="lars@linux-schulserver.de" date="1431259200">- update modules
- call spec-cleaner again
- own apache libexecdirs</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1449576000">- use sources from https://emptyhammock.com/downloads/ for
  mod_backtrace, mod_crash and mod_whatkilledus
- test packages with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1450267200">- test mod_backtrace, mod_whatkilledus and mod_crash more deeply
- add wku.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1452254400">- test mod_diagnostics</changelog>
  <changelog author="pgajdos@suse.com" date="1452600000">- %check: access syntax depends rather on %{apache_branch}, as test
  does not use system setting (/etc/apache2) at all</changelog>
  <changelog author="pgajdos@suse.com" date="1581336000">- use apache-rex framework for %check</changelog>
  <changelog author="pgajdos@suse.com" date="1606737600">- mod_backtrace documention does not mention mpm while building
  should differ (but untested for now)</changelog>
  <changelog author="pgajdos@suse.com" date="1718798400">- do not buildrequire unmaintained apache-rex</changelog>
</package>
<package pkgid="8ded9fbafcea1ad7857757f52e4e174507f836d2aa180adc7205209207bd67b8" name="apache2-debugging-modules-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.4" rel="15.3"/>
  <changelog author="pgajdos@suse.com" date="1415102400">- call spec-cleaner
- use apache rpm macros
- fix build</changelog>
  <changelog author="lars@linux-schulserver.de" date="1431259200">- update modules
- call spec-cleaner again
- own apache libexecdirs</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1449576000">- use sources from https://emptyhammock.com/downloads/ for
  mod_backtrace, mod_crash and mod_whatkilledus
- test packages with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1450267200">- test mod_backtrace, mod_whatkilledus and mod_crash more deeply
- add wku.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1452254400">- test mod_diagnostics</changelog>
  <changelog author="pgajdos@suse.com" date="1452600000">- %check: access syntax depends rather on %{apache_branch}, as test
  does not use system setting (/etc/apache2) at all</changelog>
  <changelog author="pgajdos@suse.com" date="1581336000">- use apache-rex framework for %check</changelog>
  <changelog author="pgajdos@suse.com" date="1606737600">- mod_backtrace documention does not mention mpm while building
  should differ (but untested for now)</changelog>
  <changelog author="pgajdos@suse.com" date="1718798400">- do not buildrequire unmaintained apache-rex</changelog>
</package>
<package pkgid="8d14e6942cb3ce270c6780b88e584934dfeaa376b5aeeb8365368bcd3af85738" name="apache2-debugging-modules-debugsource" arch="x86_64">
  <version epoch="0" ver="2.4" rel="15.3"/>
  <changelog author="pgajdos@suse.com" date="1415102400">- call spec-cleaner
- use apache rpm macros
- fix build</changelog>
  <changelog author="lars@linux-schulserver.de" date="1431259200">- update modules
- call spec-cleaner again
- own apache libexecdirs</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1449576000">- use sources from https://emptyhammock.com/downloads/ for
  mod_backtrace, mod_crash and mod_whatkilledus
- test packages with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1450267200">- test mod_backtrace, mod_whatkilledus and mod_crash more deeply
- add wku.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1452254400">- test mod_diagnostics</changelog>
  <changelog author="pgajdos@suse.com" date="1452600000">- %check: access syntax depends rather on %{apache_branch}, as test
  does not use system setting (/etc/apache2) at all</changelog>
  <changelog author="pgajdos@suse.com" date="1581336000">- use apache-rex framework for %check</changelog>
  <changelog author="pgajdos@suse.com" date="1606737600">- mod_backtrace documention does not mention mpm while building
  should differ (but untested for now)</changelog>
  <changelog author="pgajdos@suse.com" date="1718798400">- do not buildrequire unmaintained apache-rex</changelog>
</package>
<package pkgid="ff663d5629d7b7ff8ac079bc9b6887ac6ae7e56090786723e8008c8042742073" name="apache2-mod_apparmor" arch="src">
  <version epoch="0" ver="2.0.2" rel="913.3"/>
  <changelog author="sbeattie@suse.de" date="1134043200">- rename package to mod-apparmor
- relicense to GPL for open source release
- reset version to 2.0-1</changelog>
  <changelog author="sbeattie@suse.de" date="1134129600">- Rename to apache2-mod-apparmor for consistency with SUSE packages
- Rename module to mod_apparmor.so</changelog>
  <changelog author="sbeattie@suse.de" date="1134907200">- Include symlink in %{_libdir}/apache2-prefork/</changelog>
  <changelog author="sbeattie@suse.de" date="1136548800">- Fixup SUSE autobuild require on apache-devel-packages
- Add svn revision number to the source tarball</changelog>
  <changelog author="sbeattie@suse.de" date="1137240000">- Add dependency on contents of /usr/lib/apache2_MMN</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="sbeattie@suse.de" date="1138536000">- Fix linking against libapparmor.so (renamed from libimmunix.so)
- No more neededforbuild in STABLE</changelog>
  <changelog author="poeml@suse.de" date="1138622400">- removed libapr-util1-devel from BuildRequires (apache2-devel does
  require it)</changelog>
  <changelog author="sbeattie@suse.de" date="1139227200">- Renamed apache config options:
  ImmhatName -&gt; AAHatName
  ImmDefaultHatName -&gt; AADefaultHatName</changelog>
  <changelog author="srarnold@suse.de" date="1143806400">- Relicense to LGPL (#157579)</changelog>
  <changelog author="schwab@suse.de" date="1148644800">- Don't strip binaries.</changelog>
  <changelog author="poeml@suse.de" date="1157544000">- rename to apache2-mod_apparmor
- use a2enmod instead of frob_sysconfig
- remove SuSEconfig calls</changelog>
  <changelog author="poeml@suse.de" date="1227355200">- remove annoying auto-enabling of mod_apparmor. It reenables the
  module each time the package is updated...</changelog>
  <changelog author="draht@suse.de" date="1299067200">- fix Makefile to find /lib64/libapparmor.so</changelog>
  <changelog author="pgajdos@suse.com" date="1414670400">- use apache rpm macros
- call spec cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1442491200">- test module with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1643889600">- use strings in conditions</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743508800">- remove obsolete versioning</changelog>
</package>
<package pkgid="76b1bdbc05c32527ef9016a27d7f05087343bd6fa4de54aed42957ec3fcd3e37" name="apache2-mod_apparmor" arch="x86_64">
  <version epoch="0" ver="2.0.2" rel="913.3"/>
  <changelog author="schwab@suse.de" date="1148644800">- Don't strip binaries.</changelog>
  <changelog author="poeml@suse.de" date="1157544000">- rename to apache2-mod_apparmor
- use a2enmod instead of frob_sysconfig
- remove SuSEconfig calls</changelog>
  <changelog author="poeml@suse.de" date="1227355200">- remove annoying auto-enabling of mod_apparmor. It reenables the
  module each time the package is updated...</changelog>
  <changelog author="draht@suse.de" date="1299067200">- fix Makefile to find /lib64/libapparmor.so</changelog>
  <changelog author="pgajdos@suse.com" date="1414670400">- use apache rpm macros
- call spec cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1442491200">- test module with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1643889600">- use strings in conditions</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743508800">- remove obsolete versioning</changelog>
</package>
<package pkgid="4a14cb76d0c3cd42a1f657bf5b799963c8b225f8a91f4a99a3594f3b22691c50" name="apache2-mod_apparmor-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.0.2" rel="913.3"/>
  <changelog author="schwab@suse.de" date="1148644800">- Don't strip binaries.</changelog>
  <changelog author="poeml@suse.de" date="1157544000">- rename to apache2-mod_apparmor
- use a2enmod instead of frob_sysconfig
- remove SuSEconfig calls</changelog>
  <changelog author="poeml@suse.de" date="1227355200">- remove annoying auto-enabling of mod_apparmor. It reenables the
  module each time the package is updated...</changelog>
  <changelog author="draht@suse.de" date="1299067200">- fix Makefile to find /lib64/libapparmor.so</changelog>
  <changelog author="pgajdos@suse.com" date="1414670400">- use apache rpm macros
- call spec cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1442491200">- test module with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1643889600">- use strings in conditions</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743508800">- remove obsolete versioning</changelog>
</package>
<package pkgid="c5193566bf247dabc8959df62ddb86c4e9d29ad3e3cd3d0cb5ff4639be12afe2" name="apache2-mod_apparmor-debugsource" arch="x86_64">
  <version epoch="0" ver="2.0.2" rel="913.3"/>
  <changelog author="schwab@suse.de" date="1148644800">- Don't strip binaries.</changelog>
  <changelog author="poeml@suse.de" date="1157544000">- rename to apache2-mod_apparmor
- use a2enmod instead of frob_sysconfig
- remove SuSEconfig calls</changelog>
  <changelog author="poeml@suse.de" date="1227355200">- remove annoying auto-enabling of mod_apparmor. It reenables the
  module each time the package is updated...</changelog>
  <changelog author="draht@suse.de" date="1299067200">- fix Makefile to find /lib64/libapparmor.so</changelog>
  <changelog author="pgajdos@suse.com" date="1414670400">- use apache rpm macros
- call spec cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1442491200">- test module with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1643889600">- use strings in conditions</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743508800">- remove obsolete versioning</changelog>
</package>
<package pkgid="759e983fca94591fcf4b354f0f29e36be9f3107d8517c2710a8488de6cca743f" name="apache2-mod_auth_cas" arch="src">
  <version epoch="0" ver="1.2" rel="6.2"/>
  <changelog author="adaugherity@tamu.edu" date="1536580800">- initial package from git master, with wanted patches (esp. OpenSSL 1.1
  compatibility)</changelog>
  <changelog author="adaugherity@tamu.edu" date="1573732800">- mod_auth_cas v1.2:
  * OpenSSL 1.1 support.
  * CASv2 attributes.
  * CASPreserveTicket, which allows tickets to pass through when a valid
    session exists.
  * CASGatewayCookieDomain, to set the gateway cookie domain.
  * Use a dynamic buffer to store the CAS validation response.
  * Various bug and documentation fixes:
    https://github.com/apereo/mod_auth_cas/milestone/6?closed=1</changelog>
  <changelog author="adaugherity@tamu.edu" date="1574337600">- fix CASCookiePath in apache conf: it requires a trailing /</changelog>
  <changelog author="pgajdos@suse.com" date="1743595200">- do not use %debug_package</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Introduce PCRE2 support
- Add patch:
  * enable_pcre2.patch</changelog>
</package>
<package pkgid="65357d1a71aa8b8ea72cab0c71191669c55f495c8238a03be7a92c6886bce5c2" name="apache2-mod_auth_cas" arch="x86_64">
  <version epoch="0" ver="1.2" rel="6.2"/>
  <changelog author="adaugherity@tamu.edu" date="1536580800">- initial package from git master, with wanted patches (esp. OpenSSL 1.1
  compatibility)</changelog>
  <changelog author="adaugherity@tamu.edu" date="1573732800">- mod_auth_cas v1.2:
  * OpenSSL 1.1 support.
  * CASv2 attributes.
  * CASPreserveTicket, which allows tickets to pass through when a valid
    session exists.
  * CASGatewayCookieDomain, to set the gateway cookie domain.
  * Use a dynamic buffer to store the CAS validation response.
  * Various bug and documentation fixes:
    https://github.com/apereo/mod_auth_cas/milestone/6?closed=1</changelog>
  <changelog author="adaugherity@tamu.edu" date="1574337600">- fix CASCookiePath in apache conf: it requires a trailing /</changelog>
  <changelog author="pgajdos@suse.com" date="1743595200">- do not use %debug_package</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Introduce PCRE2 support
- Add patch:
  * enable_pcre2.patch</changelog>
</package>
<package pkgid="f0cece12b45561e14d80ceca42286b2af5e8d12a4393d0da3374a48b2d6b6a7d" name="apache2-mod_auth_cas-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.2" rel="6.2"/>
  <changelog author="adaugherity@tamu.edu" date="1536580800">- initial package from git master, with wanted patches (esp. OpenSSL 1.1
  compatibility)</changelog>
  <changelog author="adaugherity@tamu.edu" date="1573732800">- mod_auth_cas v1.2:
  * OpenSSL 1.1 support.
  * CASv2 attributes.
  * CASPreserveTicket, which allows tickets to pass through when a valid
    session exists.
  * CASGatewayCookieDomain, to set the gateway cookie domain.
  * Use a dynamic buffer to store the CAS validation response.
  * Various bug and documentation fixes:
    https://github.com/apereo/mod_auth_cas/milestone/6?closed=1</changelog>
  <changelog author="adaugherity@tamu.edu" date="1574337600">- fix CASCookiePath in apache conf: it requires a trailing /</changelog>
  <changelog author="pgajdos@suse.com" date="1743595200">- do not use %debug_package</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Introduce PCRE2 support
- Add patch:
  * enable_pcre2.patch</changelog>
</package>
<package pkgid="16ca1b2c34a76fbc87e956e2d5ec4e1b4613de974fda61cf0cd00ac7618e48da" name="apache2-mod_auth_cas-debugsource" arch="x86_64">
  <version epoch="0" ver="1.2" rel="6.2"/>
  <changelog author="adaugherity@tamu.edu" date="1536580800">- initial package from git master, with wanted patches (esp. OpenSSL 1.1
  compatibility)</changelog>
  <changelog author="adaugherity@tamu.edu" date="1573732800">- mod_auth_cas v1.2:
  * OpenSSL 1.1 support.
  * CASv2 attributes.
  * CASPreserveTicket, which allows tickets to pass through when a valid
    session exists.
  * CASGatewayCookieDomain, to set the gateway cookie domain.
  * Use a dynamic buffer to store the CAS validation response.
  * Various bug and documentation fixes:
    https://github.com/apereo/mod_auth_cas/milestone/6?closed=1</changelog>
  <changelog author="adaugherity@tamu.edu" date="1574337600">- fix CASCookiePath in apache conf: it requires a trailing /</changelog>
  <changelog author="pgajdos@suse.com" date="1743595200">- do not use %debug_package</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Introduce PCRE2 support
- Add patch:
  * enable_pcre2.patch</changelog>
</package>
<package pkgid="c591b8720c650e73dea61d69441953e1ebe7c182b05aee6ea0cbdb8934934f0b" name="apache2-mod_auth_gssapi" arch="src">
  <version epoch="0" ver="1.6.5" rel="14.4"/>
  <changelog author="k0da@opensuse.org" date="1488283200">- Initial mod_gssapi-1.5 version</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1586347200">- version update to 1.6.1
  * lot of changes, see
    https://github.com/gssapi/mod_auth_gssapi/releases
- added patches
  python3 and other testsuite fixes
  + apache2-mod_auth_gssapi-test.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606305600">- version update to 1.6.3
  * add a few options to expose the mechanism used for authentication
    (when multiple are available) and to control the timeout interval
    for Basic Auth sessions
  * CI and other minor fixes, as well as a fix for gss_localname()
  * see
    https://github.com/gssapi/mod_auth_gssapi/releases
- modified patches
  % apache2-mod_auth_gssapi-test.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1643889600">- test only when test requirements are fulfilled</changelog>
  <changelog author="kastl@b1-systems.de" date="1689595200">- change upstream URL to https://github.com/gssapi/mod_auth_gssapi,
  because https://github.com/modauthgssapi/mod_auth_gssapi has no
  releases, no activity and looks fishy
- upgrade to 1.6.4:
  * tests: Catch errors during tests setup by @stanislavlevin in
    [#225]
  * tests: Don't override the specific environment by the global
    one by @stanislavlevin in #227
  * Emit error in logs if keytab files can't be opened by @simo5 in
    [#229]
  * Add warnings if s4u2proxy options are inconsistent by @simo5 in
    [#232]
  * Move to python3 by default by @frozencemetery in #235
  * Fix type/token distinction in parser.y by @frozencemetery in
    [#237]
  * Special ccache handling for {HOSTNAME} acceptor by @simo5 in
    [#238]
  * crypto: Handle EVP changes in OpenSSL 3 by @frozencemetery in
    [#256]</changelog>
  <changelog author="kastl@b1-systems.de" date="1689595201">- update to 1.6.5:
  * Fix a bad crash bug when the GssapiUseS4U2Proxy option is set
    but no GssapiCredStore directives are provided at all.
  - crash bug when s4u2proxy is configured by @simo5 in #272
- rebased patch apache2-mod_auth_gssapi-test.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1743681600">- turn the testsuite off even for Factory for now, it appears it
  requires certain kerberos tweaks
  [kinit: Configuration file does not specify default realm when parsing name maguser]</changelog>
</package>
<package pkgid="605554470758686f25ed0669fd33793d3e701405dd4190e3634517112c1fe59e" name="apache2-mod_auth_gssapi" arch="x86_64">
  <version epoch="0" ver="1.6.5" rel="14.4"/>
  <changelog author="k0da@opensuse.org" date="1488283200">- Initial mod_gssapi-1.5 version</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1586347200">- version update to 1.6.1
  * lot of changes, see
    https://github.com/gssapi/mod_auth_gssapi/releases
- added patches
  python3 and other testsuite fixes
  + apache2-mod_auth_gssapi-test.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606305600">- version update to 1.6.3
  * add a few options to expose the mechanism used for authentication
    (when multiple are available) and to control the timeout interval
    for Basic Auth sessions
  * CI and other minor fixes, as well as a fix for gss_localname()
  * see
    https://github.com/gssapi/mod_auth_gssapi/releases
- modified patches
  % apache2-mod_auth_gssapi-test.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1643889600">- test only when test requirements are fulfilled</changelog>
  <changelog author="kastl@b1-systems.de" date="1689595200">- change upstream URL to https://github.com/gssapi/mod_auth_gssapi,
  because https://github.com/modauthgssapi/mod_auth_gssapi has no
  releases, no activity and looks fishy
- upgrade to 1.6.4:
  * tests: Catch errors during tests setup by @stanislavlevin in
    [#225]
  * tests: Don't override the specific environment by the global
    one by @stanislavlevin in #227
  * Emit error in logs if keytab files can't be opened by @simo5 in
    [#229]
  * Add warnings if s4u2proxy options are inconsistent by @simo5 in
    [#232]
  * Move to python3 by default by @frozencemetery in #235
  * Fix type/token distinction in parser.y by @frozencemetery in
    [#237]
  * Special ccache handling for {HOSTNAME} acceptor by @simo5 in
    [#238]
  * crypto: Handle EVP changes in OpenSSL 3 by @frozencemetery in
    [#256]</changelog>
  <changelog author="kastl@b1-systems.de" date="1689595201">- update to 1.6.5:
  * Fix a bad crash bug when the GssapiUseS4U2Proxy option is set
    but no GssapiCredStore directives are provided at all.
  - crash bug when s4u2proxy is configured by @simo5 in #272
- rebased patch apache2-mod_auth_gssapi-test.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1743681600">- turn the testsuite off even for Factory for now, it appears it
  requires certain kerberos tweaks
  [kinit: Configuration file does not specify default realm when parsing name maguser]</changelog>
</package>
<package pkgid="d039bc518a97906511dad7a32e0ba571fb2e95955f9fbca726aaca46c1ff85d0" name="apache2-mod_auth_gssapi-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.6.5" rel="14.4"/>
  <changelog author="k0da@opensuse.org" date="1488283200">- Initial mod_gssapi-1.5 version</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1586347200">- version update to 1.6.1
  * lot of changes, see
    https://github.com/gssapi/mod_auth_gssapi/releases
- added patches
  python3 and other testsuite fixes
  + apache2-mod_auth_gssapi-test.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606305600">- version update to 1.6.3
  * add a few options to expose the mechanism used for authentication
    (when multiple are available) and to control the timeout interval
    for Basic Auth sessions
  * CI and other minor fixes, as well as a fix for gss_localname()
  * see
    https://github.com/gssapi/mod_auth_gssapi/releases
- modified patches
  % apache2-mod_auth_gssapi-test.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1643889600">- test only when test requirements are fulfilled</changelog>
  <changelog author="kastl@b1-systems.de" date="1689595200">- change upstream URL to https://github.com/gssapi/mod_auth_gssapi,
  because https://github.com/modauthgssapi/mod_auth_gssapi has no
  releases, no activity and looks fishy
- upgrade to 1.6.4:
  * tests: Catch errors during tests setup by @stanislavlevin in
    [#225]
  * tests: Don't override the specific environment by the global
    one by @stanislavlevin in #227
  * Emit error in logs if keytab files can't be opened by @simo5 in
    [#229]
  * Add warnings if s4u2proxy options are inconsistent by @simo5 in
    [#232]
  * Move to python3 by default by @frozencemetery in #235
  * Fix type/token distinction in parser.y by @frozencemetery in
    [#237]
  * Special ccache handling for {HOSTNAME} acceptor by @simo5 in
    [#238]
  * crypto: Handle EVP changes in OpenSSL 3 by @frozencemetery in
    [#256]</changelog>
  <changelog author="kastl@b1-systems.de" date="1689595201">- update to 1.6.5:
  * Fix a bad crash bug when the GssapiUseS4U2Proxy option is set
    but no GssapiCredStore directives are provided at all.
  - crash bug when s4u2proxy is configured by @simo5 in #272
- rebased patch apache2-mod_auth_gssapi-test.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1743681600">- turn the testsuite off even for Factory for now, it appears it
  requires certain kerberos tweaks
  [kinit: Configuration file does not specify default realm when parsing name maguser]</changelog>
</package>
<package pkgid="e288e09f43d638bbb0ced60b48d610d5627455796ab883dde8addb20e39bcd0b" name="apache2-mod_auth_gssapi-debugsource" arch="x86_64">
  <version epoch="0" ver="1.6.5" rel="14.4"/>
  <changelog author="k0da@opensuse.org" date="1488283200">- Initial mod_gssapi-1.5 version</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1586347200">- version update to 1.6.1
  * lot of changes, see
    https://github.com/gssapi/mod_auth_gssapi/releases
- added patches
  python3 and other testsuite fixes
  + apache2-mod_auth_gssapi-test.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1606305600">- version update to 1.6.3
  * add a few options to expose the mechanism used for authentication
    (when multiple are available) and to control the timeout interval
    for Basic Auth sessions
  * CI and other minor fixes, as well as a fix for gss_localname()
  * see
    https://github.com/gssapi/mod_auth_gssapi/releases
- modified patches
  % apache2-mod_auth_gssapi-test.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1643889600">- test only when test requirements are fulfilled</changelog>
  <changelog author="kastl@b1-systems.de" date="1689595200">- change upstream URL to https://github.com/gssapi/mod_auth_gssapi,
  because https://github.com/modauthgssapi/mod_auth_gssapi has no
  releases, no activity and looks fishy
- upgrade to 1.6.4:
  * tests: Catch errors during tests setup by @stanislavlevin in
    [#225]
  * tests: Don't override the specific environment by the global
    one by @stanislavlevin in #227
  * Emit error in logs if keytab files can't be opened by @simo5 in
    [#229]
  * Add warnings if s4u2proxy options are inconsistent by @simo5 in
    [#232]
  * Move to python3 by default by @frozencemetery in #235
  * Fix type/token distinction in parser.y by @frozencemetery in
    [#237]
  * Special ccache handling for {HOSTNAME} acceptor by @simo5 in
    [#238]
  * crypto: Handle EVP changes in OpenSSL 3 by @frozencemetery in
    [#256]</changelog>
  <changelog author="kastl@b1-systems.de" date="1689595201">- update to 1.6.5:
  * Fix a bad crash bug when the GssapiUseS4U2Proxy option is set
    but no GssapiCredStore directives are provided at all.
  - crash bug when s4u2proxy is configured by @simo5 in #272
- rebased patch apache2-mod_auth_gssapi-test.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1743681600">- turn the testsuite off even for Factory for now, it appears it
  requires certain kerberos tweaks
  [kinit: Configuration file does not specify default realm when parsing name maguser]</changelog>
</package>
<package pkgid="8c44ceadb211fc3b22ee27dcc32ac63929ad8e6d3ccb5d6dff28bcd634b0b843" name="apache2-mod_auth_openidc" arch="src">
  <version epoch="0" ver="2.4.19.3" rel="95.1"/>
  <changelog author="michael@stroeder.com" date="1658750400">- removed obsolete BuildRequires autoconf and automake
- update to 2.4.11.2
  + release 2.4.11.2
  * Features
  - add support for Apache expressions in OIDCPathAuthRequestParams and OIDCPathScope; see #594
  * Bugfixes
  - add Cache-Control headers to logout response; see #846; thanks @blackwhiser1
  * Other
  - don't strip the header from encrypted JWTs as future versions of cjose may use compact
  - encoding for JWEs; this slightly increases state cookie size, by-value session cookies
  - and encrypted cache contents again at the benefit of forward cjose compatibility
  + release 2.4.11.1
  * Bugfixes
  - fix OIDCUnAuthAction pass not passing claims for authenticated users, see #790, thanks @cm0s
  - fix race conditions in the file cache backend, see #777, thanks @dbakker and @blackwhiser1
  - fix memory leaks over graceful restarts, see #823 and #824, thanks @smanolache
  - avoid using %llu print formatter and switch to %lu for unsigned long so it works cross platform
  - add a check to make sure URLs do not contain unencoded Unicode characters, see #796, thanks @cnico
  * Features
  - warn about mismatch between incoming X-Forwarded-* headers and OIDCXForwardedHeaders configuration
  - add support for OpenSSL 3.0
  * Other
  - remove test-cmd jwk2cert command
  - correct ap_hook_insert_filter function signature in stub.c, part 2, closes #784, thanks @stroeder
  - add Valgrind Github action
  + release 2.4.11
  * Bugfixes
  - fix use of regular expressions in Require statements
  - no longer defer multi-OP Discovery to the content handler to allow RequireAll and Require not directives in multi-OP setups; closes #775; thanks @rajeevn1
  - improve handling session duration expiry when combined with OIDCUnAuthAction pass or Discovery; see #778
  - terminate on startup when the crypto passphrase generated by exec: is empty; see #767
  - allow authorization on info requests, see #746
  - avoid debug printout of payload as header when the latter is stripped
  - fix race condition in file cache backend reading truncated files under load; see #777; thanks @dbakker
  * Features
  - make interpretation of X-Forwarded-* headers configurable, defaulting to none so mod_auth_openidc running behind a reverse proxy that sets X-Forwarded-* headers needs explicit configuration of OIDCXForwardedHeaders
  - make X-Frame-Options header returned on OIDC front-channel logout requests configurable through OIDCLogoutXFrameOptions; closes #464
  - add x5t to JWT header in private_key_jwt client assertions; for interop with Azure AD; see #762; thanks @juur
  - improve detection of suspicious redirect URLs; add test list
  - add administrative session revocation capability via &lt;redirect_uri&gt;?revoke_session=&lt;sessionid&gt;
  * Packaging
  - add support for libpcre2; see #740
  - add AM_PROG_CC_C_O to configure.ac (at least for RHEL 7.7); see #765; thanks @bitmagewb
  - include &lt;openssl/bn.h&gt; in jose.c to compile with OpenSSL 1.0.x
  - install taking into account DESTDIR; see #674; thanks @alerque
  + release 2.4.10
  * Features
  - add check for Sec-Fetch-Dest header != "document" value and Sec-Fetch-Mode header != "navigate" to auto-detect requests that are not capable of handling an authentication round trip to the Provider; see #714; thanks @studersi
  - add redirect/text options to OIDCUnAutzAction; see #715; thanks @chrisinmtown
  - log require claims failure on info level
  - backport ap_get_exec_line, supporting the exec: option in OIDCCryptoPassphrase to Apache 2.2
  * Bugfixes
  - return HTTP 200 for OPTIONS requests in auth-openidc mixed mode
  - don't apply claims based authorization for OPTIONS requests so paths protected with Require claim directives will now also return HTTP 200 for OPTIONS requests
  - fix memory leak when parsing JWT access token fails (in RS mode)
  - fix regexp substition crash using OIDCRemoteUserClaim; thanks @nneul; closes #720
  * Packaging
  - complete usage of autoconf/automake; see #674
  - add .deb for Debian Bullseye</changelog>
  <changelog author="michael@stroeder.com" date="1661256000">- update to 2.4.11.3
  * Bugfixes
  - avoid memory leak when using PCRE2 regular expressions with
    array matching; closes #902
  - avoid memory leak when cjose_jws_get_plaintext fails; closes #903
  - fix handling of IPv6 based logout URLs
  * Features
  - Use optionally provided sid and iss request parameters during
    front channel logout; see #855
  - support Forwarded header in addition to X-Forwarded-*; see #853</changelog>
  <changelog author="michael@stroeder.com" date="1666008000">- update to 2.4.12
  * Features
  - allow storing the id_token in a client-cookie based session; see #812 and #888
  - allow setting connection pool parameters for Memcache server connections; see #916
  - add option to set a username for Redis authentication via OIDCRedisCacheUsername
  - register request_object_signing_alg in dynamic client registration when using request_uri
  * Bugfixes
  - increase size of the output buffer when using libpcre2 for substitution; closes #915
  - support OIDCSessionInactivityTimeout values greater than 30 days
    when using Memcache; see #936
  - allow for step-up discovery with an external URL using HTML refresh;
    fixes behaviour on CentOS 7/8 when combined with ProxyPass
  - apply exact length matching for at_hash and c_hash validation
  - store access token obtained from backchannel in session over the one
    returned in the frontchannel for code token and code id_token token flows
  - check ID token signed response algorithm on backchannel logout_token
    and retrieve its configuration value from the client metadata file</changelog>
  <changelog author="michael@stroeder.com" date="1668513600">- update to 2.4.12.1
  * Features
  - add option to use ISO-8859-1 encoding for propagated claim values by
    adding latin1 option to OIDCPassClaimsAs &lt;&gt; latin1; see #957
  - Note that the encoding - including the existing "base64url" - apply to
    both header and environment variables as well now
  * Bugfixes
  - switch to using apr_generate_random_bytes instead of apr_uuid_get to
    generate session identifiers so there's no longer a (rather implicit)
    dependency on a libapr that is compiled against libuuid on Linux
    platforms; see #431, #603 and #694
  - fix cache file backend: delete the correct file upon logout; closes #955
  - fix cleanup of semaphores on graceful restarts; see #522, closes #458
  - fix OIDCProviderMetadataRefreshInterval since it was interpreted in
    microseconds instead of the documented and intended seconds; setting in
    to seconds would effectively turn of caching and pull the configuration
    document on each request
  - define APLOG_TRACE1 if it does not exist
  - correct ap_hook_insert_filter function signature in stub.c, part 3; see #784
  - fixed printout of cache mutex errors in cache/common.c
  - prefer APR_LOCK_POSIXSEM over APR_LOCK_DEFAULT in apr_global_mutex_create
    which is apparently required for (some) ARM based builds
  - fix potential memory leak in proto.c when oidc_util_create_symmetric_key fails
  - fix potential memory leak in proto.c when oidc_proto_validate_access_token
    fails (at_hash validation)</changelog>
  <changelog author="michael@stroeder.com" date="1671537600">- update to 2.4.12.2
  * Security
  - CVE-2022-23527: prevent open redirect in default setup when
    OIDCRedirectURLsAllowed is not configured
    see: GHSA-q6f2-285m-gr53
  * Features
  - allow overriding the type of lock used at compile time with OIDC_LOCK</changelog>
  <changelog author="danilo.spinella@suse.com" date="1701345600">- update to 2.4.14.4:
  * for the complete list of changes, please have a look at ChangeLog</changelog>
  <changelog author="danilo.spinella@suse.com" date="1708084800">- Update to 2.4.15.3:
  * for the complete list of changes, please have a look at ChangeLog
- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911</changelog>
  <changelog author="pgajdos@suse.com" date="1711368000">- version update to 2.4.15.6
  03/14/2024
  - fix userinfo refresh interval parsing; closes #1200; thanks @HolgerHees
    avoid refreshing userinfo on each request until access token expiry
  - store interval as JSON integer in session
  - use SameSite=Lax when OIDCCookieSameSite is On (also by default) instead of
    Strict as overriding from Lax to Strict does not work reliably anymore (Chrome)
  - release 2.4.15.6
  03/13/2024
  - fix compilation without libhiredis; closes #1195 ; thanks @HolgerHees
    conditionally define oidc_set_redis_connect_timeout
  - fix `OIDCPassClaimsAs environment` bug introduced in 2.4.15.4; see #1196; thanks @HolgerHees
  - release 2.4.15.5
  03/12/2024
  - release 2.4.15.4
  - fix setting the default PCKE method to "none" in a multi-provider setup</changelog>
  <changelog author="pgajdos@suse.com" date="1726574400">- version update to 2.4.16.3
  09/06/2024
  - allow overriding globally set OIDCCacheType back to shm in vhosts
  - correct typo in child initialization routines when using multiple vhosts; closes #1208; thanks @studersi
    this fixes possible segmentation faults when using Redis and Metrics settings in vhosts
  09/05/2024
  - fix OIDCCacheShmMax min/max settings; see #1260; thanks @bbartke
  08/29/2024
  - fix setting OIDCPKCEMethod none; closes #1256; thanks @eoliphan
  08/28/2024
  - re-introduce OIDCSessionMaxDuration 0; see #1252
  - add some resilience when both Forwarded and X-Forwarded-* are configured
  - fix disabled OIDCStateCookiePrefix command; closes #1254; thanks @damisanet
  - remove support for OIDCHTMLErrorTemplate, deprecated since 2.4.14
  08/26/2024
  - fix parsing OIDCXForwardedHeaders; closes #1250; thanks @maltesmann
  07/03/2024
  - cfg/provider: use oidc_jwk_list_copy when merging client_keys
  06/18/2024
  - memcache: correct dead server check on APR_NOTFOUND; see #1230; thanks @rpluem-vf
  06/08/2024
  - support DPoP nonces to the userinfo endpoint
  06/06/2024
  - add OIDCDPoPMode [off|optional|required] primitive
  - store the token_type in the session
  06/05/2024
  - add "nbf" claim in the Request Object as per https://openid.net/specs/openid-financial-api-part-2-1_0-final.html#rfc.section.5.2.2
  06/04/2024
  - add (client) support for RFC 9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)
  - replace multi-provider .conf "issuer_specific_redirect_uri" boolean with "response_require_iss" boolean
  - tighten up the "aud" claim validation in ID tokens
  - add support for the FAPI 2.0 Security Profile https://openid.net/specs/fapi-2_0-security-profile-ID2.html
  05/30/2024
  - add support for RFC 9126 OAuth 2.0 Pushed Authorization Requests
  04/23/2024
  - disable support for the RSA PKCS v1.5 JWE encryption algorithm as it is deemed unsafe
    due to the Marvin attack and is removed from libcjose as well
  04/05/2024
  - add debug printout for OIDCUnAuthAction expression evaluation
  04/03/2024
  - when an expression is configured for OIDCUnAuthAction (i.e. in the 2nd argument), also apply
    it to OIDCUnAutzAction so that it can be used to enable step-up authentication for SPAs with
    non-conformant browsers (some versions of Safari) and in (potentially insecure) iframes
    see #1205; thanks @ryanwilliamnicholls
  04/02/2024
  - major rewrite of config primitive handling:
  - split out over different files, use header files consistently
  - encapsulate config record with getters/setters
  - allow overriding defined global configuration primitives to their default value on the individual vhost level
  - apply input/boundary checking on all configuration values, shared with provider metadata parsing
  - various fixes to applying default config values and allowing primitives in vhost/directory scopes
  - return HTTTP 502 when refreshing acces token or userinfo fails (default: "502_on_error")
  - use a singleton token refresh mutex
  - add support for OIDCOAuthIntrospectionEndpointKeyPassword
  - bump to 2.4.16dev
  04/01/2024
  - release 2.4.15.7
  03/29/2024
- fix OIDCUserInfoRefreshInterval, interval seconds would be interpreted as microseconds</changelog>
  <changelog author="pgajdos@suse.com" date="1733918400">- version update to 2.4.16.6
  12/05/2024
  - metadata: fix caching of JWKs from jwks_uri when using the default expiry setting (i.e. not using OIDCJWKSRefreshInterval)
    and avoid fetching JWKs from the jwks_uri for each user login; also addresses Redis cache
    error entries the log [ERR invalid expire time in 'setex' command]
  - avoid segfault and improve error reporting in case apr_temp_dir_get fails when a temp directory cannot be found
    on the system upon initalizing cache mutexes and file cache; see #1288; thanks @ErmakovDmitriy
  11/21/2024
  - add option to set local address for outgoing HTTP requests; see #1283; thanks @studersi
    using e.g. SetEnvIfExpr true OIDC_CURL_INTERFACE=192.168.10.2
  - try and address metris cleanup segmentation fault on shutdown; see #1207
    by not flushing metrics to the shared memory segment upon exit
  11/14/2024
  - allow specific settings Strict|Lax|None|Disabled for OIDCCookieSameSite in addition to On(=Lax)|Off(=None)
  - fix: default behaviour Lax
  - fix: apply OIDCCookieSameSite Off/None properly to state cookies instead of always setting Lax
  - re-introduces the option to configure a Strict SameSite session cookie policy, which will turn the initial
    Lax session cookie - set upon receving the response to the Redirect URI - into a Strict session cookie
    immediately after the first application request
  - allows for a "Disabled" value that does not set any SameSite flag on the cookies, in which case a browser
    falls back to its default browser behaviour (which should be Lax by spec)
  11/07/2024
  - info: fix requests to the info hook with extend_session=false; see #1279; thanks @fnieri-cdp
  - properly reflect the (unmodified) inactivity timeout in the response ("timeout")
  - avoid refreshing an access token (since the session is not saved)
  - avoid refreshing claims from the user info endpoint, and possibly refreshing the access token
  10/23/2024
  - metadata: allow plain HTTP URLs in metadata elements `jwks_uri` and `signed_jwks_uri`
    to ensure backwards compatibility with &lt;=2.4.15.7 and to support private/test deployments
  10/22/2024
  - address warnings from static code analysis tool CodeChecker
  10/04/2024
  - ensure backwards compatibility with versions &lt;2.4.16.x when a JSON array of string values
    is provided in the "aud" claim of the ID token; required by (at least) Oracle IDCS
    see #1272 and #1273; thanks @lufik and @tydalforce
  - add OIDCIDTokenAudValues configuration primitive that allows for explicit (and exhaustive)
    configuration of the list of accepted values in the "aud" claim of the ID token
    e.g. as required for passing FAPI 2 conformance testing
  09/27/2024
  - correct usage of free() for json_dumps return values instead of cjose_get_dealloc()()
  - use compact encoding and preserve order where appropriate for most calls to json_dumps
  - replace json_dumps/free combos with oidc_util_encode_json
  - refactor oidc_jwk_to_json
  09/26/2024
  - fix oidc_jwk_copy wrt. "x5t", which broke private_key_jwt authentication to Azure AD since 2.4.13
    see #1269; thanks @uoe-pjackson
  09/21/2024
  - refactor state and userinfo
  09/11/2024
  - change warnings about not passing unknown claim types into debug messages; see #1263; thanks @nclarkau
  09/09/2024
  - fix accepting custom cookie names in OIDCOAuthAcceptTokenAs cookie:&lt;name&gt;; see #1261; thanks @bbartke
  - improve basic authentication parsing when using OIDCOAuthAcceptTokenAs basic</changelog>
  <changelog author="pgajdos@suse.com" date="1739188800">- version update to 2.4.16.7
  01/29/2025
  - add OIDCProfile to configure OpenID Connect profile behaviours for, so far "FAPI20" only, which configures:
    Authentication Request method, DPoP, PKCE, ID token aud values requirements
    token endpoint JWT authentication "aud" values, "iss" parameter requirement in authentication reponses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1741953600">- update to 2.4.16.8:
  * add support for claim value counters in OIDCMetricsData
  * do not reset Prometheus counters by default, only when
    explicitly specified
  * metrics: reset to 0 in case of an integer overflow
- build with pcre2</changelog>
  <changelog author="pgajdos@suse.com" date="1744113600">- version update to 2.4.16.11 (CVE-2025-31492 [bsc#1240893])
  - fix protected content leakage when using OIDCProviderAuthRequestMethod POST, see:
    https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-59jp-rwph-878r
  - allow for regular Apache processing (e.g. setting response headers) when using OIDCProviderAuthRequestMethod POST
  - core: complete case-insensitive protocol/hostname/domain-name comparisons
  2.4.16.10
  - core: compare hostnames and domains in a case insensitive way in:
    oidc_request_check_cookie_domain
    oidc_util_cookie_domain_valid
    oidc_validate_redirect_url
    oidc_cfg_parse_is_valid_url_scheme
    oidc_discovery_target_link_uri_match
  - cookie: fix oidc_util_cookie_domain_valid so that it checks the incoming request against OIDCCookieDomain
    rather than the OIDCRedirectURI and displays the correct error message if they don't match
  2.4.16.9
  - cookie: use case insensitive hostname/domain comparison in oidc_check_cookie_domain
  - authz: remove the Location header from HTML based step up authentication redirects
    as it may conflict with its HTTP 200 status code and confuse middle boxes
  - metrics: avoid double-free on shutdown by not calling pthread_exit; fixes #1207; thanks @studersi
  - metrics: upon exit, do write cached metrics into shared memory before exiting</changelog>
  <changelog author="pgajdos@suse.com" date="1746014400">- version update to 2.4.17
  * Features
  - proto: pass the scope parameter as returned from the token endpoint in the OIDC_scope
    header/environment variable and make it available for Require claim scope: purposes,
    if not available as a claim returned in the id_token or userinfo endpoint; thanks Amaury Buffet
  * Bugfixes
  - metadata: fix parsing the OPs token_endpoint_auth_methods_supported and avoid the log error:
  - oidc_metadata_provider_parse: oidc_provider_token_endpoint_auth_set: invalid value
    and falling back to client_secret_basic after that; thanks François Kooman
  - fix memory leaks when using provider specific client keys and/or signed_jwks_uri_key in.a
    multi-provider setup; thanks Sami Korvonen
  - allow for regular Apache processing (e.g. setting response/security headers) by deferring HTML/HTTP
    output generation to the content handler (instead of user id check handler) for the following use cases:
    OIDCProviderAuthRequestMethod POST
    OIDCPreservePost On (both internal and template-based)
    POST page for the implicit grant type
    Request URI handler
    internally generated POST logout page
    session management RP iframe
    session management logout HTML top-window redirect page</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- build with hiredis for openSUSE only [bsc#1243922]</changelog>
  <changelog author="pgajdos@suse.com" date="1750766400">- version update to 2.4.17.1
  * fix usage of OIDCSessionType client-cookie:persistent:store_id_token; see #1331; thanks @rgcv
  * fix usage of OIDCPreservePostTemplates, regression in 2.4.17; see #1325; thanks @perry19987
  * javascript: use HTMLFormElement.prototype.submit.call(document.forms[0]) on all Javascript
    auto-submit POST forms to prevent browser Javascript error: "form.submit is not a function"
  * metrics: avoid possible segfault after restart twice; thanks @atzm
  * code: refactor util.c into util/ directory
  * allow adding a prefix to the cache (section) key through environment variable OIDC_CACHE_PREFIX</changelog>
  <changelog author="pgajdos@suse.com" date="1757419200">- version update to 2.4.18
  * add Valgrind target to Makefile and to Github Build action
  * release 2.4.18
  * revise test/check and code coverage functions
  * revise autoconf/automake, split over subdirs now
  * add tests for memcache TTL
  * fix check OIDC_CONFIG_POS_TIMEOUT_UNSET for memcache TTL getter; #1345
  * bump to 2.4.18dev
  * fix parsing the value set via OIDCMemCacheConnectionsTTL and interpret it in
    seconds correctly now (instead of microseconds); see #1345; thanks @rpluem
  * use the server process pool for static variable allocation rather than the pconf pool
    to prevents possible segmentation faults after (graceful) restarting the same process</changelog>
  <changelog author="pgajdos@suse.com" date="1770724800">- version update to 2.4.19.1
  * backwards incompatible session format so existing sessions (created by versions
    &lt;=2.4.18.x) are invalid
  * oauth: fix segfault when using OIDCOAuthVerifySharedKeys, regression since 2.4.16; closes #1373
  * jwk: fix parsing RSA JWKs with only an x5c parameter (i.e. no n and e parameters)
- version update to 2.4.19
  * cookie: support individual SameSite cookie settings on the session cookie, state cookie
    and Discovery CSRF cookie by adding 2 more arguments to OIDCCookieSameSite
  * id_token: add off option to OIDCPassIDTokenAs so no claims from the ID token will be passed on
  * passphrase: generate a crypto key when OIDCCryptoPassphrase is not set
  * note that the OIDCCryptoPassphrase does need to be configured statically if you want sessions
    to survive server restarts, or for a cluster that shares a session storage backend
  * metadata: avoid double-free when validation of provider metadata fails
  * response: avoid proto state memory leaks upon errors in response processing
  * util/key.c: check for unsupported symmetric key hashing algorithms and avoid a memory
    leak in such cases
  * session: remove expired session from cache with oidc_session_kill instead of just clearing it
  * memory: rewrite pconf pool memory allocation handling to avoid increasing memory (pool)
    consumption over graceful restarts
  * drop support for Apache 2.2
  * redis: use SET..EX %d when storing cached data instead of the deprecated SETEX
  * session/cookie: save 20-40 bytes on the session and client-cookie size
  * request: set the OIDC_ERROR variables when PAR is configured but not enabled by the Provider
  * code: avoid compiler warnings on curl_easy_setopt in http.c
  * test: add more unit tests in test/test_*.c and migrate proto tests from test.c</changelog>
  <changelog author="pgajdos@suse.com" date="1771329600">- run the testsuite (make check)</changelog>
  <changelog author="mardnh@gmx.de" date="1780401600">- Update to version 2.4.19.3
  Bugfixes
  * proto: add scope=openid to the authorization request when
    passing a Request Object by reference (request_uri) as
    defined by spec; see #1385;
  * config: fix intermittent core dumps on a large number of
    (first) incoming parallel requests after startup in threaded
    MPM environments.
  * code: fix a memory leak in
    oidc_metadata_jwks_retrieve_and_cache when JSON validation
    fails.
  * http: skip cookies that are only whitespace after the
    leading-space strip and avoid leaving a malformed segment in
    the forwarded Cookie header.
  * metrics: switch _oidc_metrics_thread_exit to a volatile
    apr_uint32_t accessed via apr_atomic_read32/set32 and avoid
    strand the post-join cleanup.
  * util: guard oidc_util_rand_int with a mod==0 short-circuit -
    to avoid division by zero - and rejection-sample before
    reducing modulo so v % mod is uniformly distributed.
  * userinfo: skip the DPoP-nonce retry path for non-DPoP token
    types to avoid dereference NULL inside apr_hash_get and crash
    the worker.
  * config: validate format specifiers (only %% and exactly two/one
    %s) in oidc_util_html_send_in_template so a stray %s in custom
    templates configured with OIDCPreservePostTemplates) can't
    crash or corrupt memory.
  Security
  * code: fix &gt;25 cases of potential string/URL matching attacks,
    XSS attacks, buffer overload etc.
  * config: fix low-risk - insider admin attack based- security
    vulnerabilities.
  * log: do not log refresh tokens at warn/error levels.
  Other
  * code: cast curl timeouts in options to long to avoid compiler
    warnings.
  * test: re-factor the framework and add more unit tests.
  * build: conditionally add --coverage to AM_LDFLAGS in
    Makefile.am
- Update to version 2.4.19.2
  Bugfixes
  * authz: fix claims based authorization in OAuth 2.0 RS mode
    (AuthType oauth20 and AuthType auth-openidc);
    regression introduced in 2.4.19</changelog>
</package>
<package pkgid="d017ccfca99da5acb707643704427a56f3501cff4a9f1f4b5aa2247626f62b08" name="apache2-mod_auth_openidc" arch="x86_64">
  <version epoch="0" ver="2.4.19.3" rel="95.1"/>
  <changelog author="michael@stroeder.com" date="1658750400">- removed obsolete BuildRequires autoconf and automake
- update to 2.4.11.2
  + release 2.4.11.2
  * Features
  - add support for Apache expressions in OIDCPathAuthRequestParams and OIDCPathScope; see #594
  * Bugfixes
  - add Cache-Control headers to logout response; see #846; thanks @blackwhiser1
  * Other
  - don't strip the header from encrypted JWTs as future versions of cjose may use compact
  - encoding for JWEs; this slightly increases state cookie size, by-value session cookies
  - and encrypted cache contents again at the benefit of forward cjose compatibility
  + release 2.4.11.1
  * Bugfixes
  - fix OIDCUnAuthAction pass not passing claims for authenticated users, see #790, thanks @cm0s
  - fix race conditions in the file cache backend, see #777, thanks @dbakker and @blackwhiser1
  - fix memory leaks over graceful restarts, see #823 and #824, thanks @smanolache
  - avoid using %llu print formatter and switch to %lu for unsigned long so it works cross platform
  - add a check to make sure URLs do not contain unencoded Unicode characters, see #796, thanks @cnico
  * Features
  - warn about mismatch between incoming X-Forwarded-* headers and OIDCXForwardedHeaders configuration
  - add support for OpenSSL 3.0
  * Other
  - remove test-cmd jwk2cert command
  - correct ap_hook_insert_filter function signature in stub.c, part 2, closes #784, thanks @stroeder
  - add Valgrind Github action
  + release 2.4.11
  * Bugfixes
  - fix use of regular expressions in Require statements
  - no longer defer multi-OP Discovery to the content handler to allow RequireAll and Require not directives in multi-OP setups; closes #775; thanks @rajeevn1
  - improve handling session duration expiry when combined with OIDCUnAuthAction pass or Discovery; see #778
  - terminate on startup when the crypto passphrase generated by exec: is empty; see #767
  - allow authorization on info requests, see #746
  - avoid debug printout of payload as header when the latter is stripped
  - fix race condition in file cache backend reading truncated files under load; see #777; thanks @dbakker
  * Features
  - make interpretation of X-Forwarded-* headers configurable, defaulting to none so mod_auth_openidc running behind a reverse proxy that sets X-Forwarded-* headers needs explicit configuration of OIDCXForwardedHeaders
  - make X-Frame-Options header returned on OIDC front-channel logout requests configurable through OIDCLogoutXFrameOptions; closes #464
  - add x5t to JWT header in private_key_jwt client assertions; for interop with Azure AD; see #762; thanks @juur
  - improve detection of suspicious redirect URLs; add test list
  - add administrative session revocation capability via &lt;redirect_uri&gt;?revoke_session=&lt;sessionid&gt;
  * Packaging
  - add support for libpcre2; see #740
  - add AM_PROG_CC_C_O to configure.ac (at least for RHEL 7.7); see #765; thanks @bitmagewb
  - include &lt;openssl/bn.h&gt; in jose.c to compile with OpenSSL 1.0.x
  - install taking into account DESTDIR; see #674; thanks @alerque
  + release 2.4.10
  * Features
  - add check for Sec-Fetch-Dest header != "document" value and Sec-Fetch-Mode header != "navigate" to auto-detect requests that are not capable of handling an authentication round trip to the Provider; see #714; thanks @studersi
  - add redirect/text options to OIDCUnAutzAction; see #715; thanks @chrisinmtown
  - log require claims failure on info level
  - backport ap_get_exec_line, supporting the exec: option in OIDCCryptoPassphrase to Apache 2.2
  * Bugfixes
  - return HTTP 200 for OPTIONS requests in auth-openidc mixed mode
  - don't apply claims based authorization for OPTIONS requests so paths protected with Require claim directives will now also return HTTP 200 for OPTIONS requests
  - fix memory leak when parsing JWT access token fails (in RS mode)
  - fix regexp substition crash using OIDCRemoteUserClaim; thanks @nneul; closes #720
  * Packaging
  - complete usage of autoconf/automake; see #674
  - add .deb for Debian Bullseye</changelog>
  <changelog author="michael@stroeder.com" date="1661256000">- update to 2.4.11.3
  * Bugfixes
  - avoid memory leak when using PCRE2 regular expressions with
    array matching; closes #902
  - avoid memory leak when cjose_jws_get_plaintext fails; closes #903
  - fix handling of IPv6 based logout URLs
  * Features
  - Use optionally provided sid and iss request parameters during
    front channel logout; see #855
  - support Forwarded header in addition to X-Forwarded-*; see #853</changelog>
  <changelog author="michael@stroeder.com" date="1666008000">- update to 2.4.12
  * Features
  - allow storing the id_token in a client-cookie based session; see #812 and #888
  - allow setting connection pool parameters for Memcache server connections; see #916
  - add option to set a username for Redis authentication via OIDCRedisCacheUsername
  - register request_object_signing_alg in dynamic client registration when using request_uri
  * Bugfixes
  - increase size of the output buffer when using libpcre2 for substitution; closes #915
  - support OIDCSessionInactivityTimeout values greater than 30 days
    when using Memcache; see #936
  - allow for step-up discovery with an external URL using HTML refresh;
    fixes behaviour on CentOS 7/8 when combined with ProxyPass
  - apply exact length matching for at_hash and c_hash validation
  - store access token obtained from backchannel in session over the one
    returned in the frontchannel for code token and code id_token token flows
  - check ID token signed response algorithm on backchannel logout_token
    and retrieve its configuration value from the client metadata file</changelog>
  <changelog author="michael@stroeder.com" date="1668513600">- update to 2.4.12.1
  * Features
  - add option to use ISO-8859-1 encoding for propagated claim values by
    adding latin1 option to OIDCPassClaimsAs &lt;&gt; latin1; see #957
  - Note that the encoding - including the existing "base64url" - apply to
    both header and environment variables as well now
  * Bugfixes
  - switch to using apr_generate_random_bytes instead of apr_uuid_get to
    generate session identifiers so there's no longer a (rather implicit)
    dependency on a libapr that is compiled against libuuid on Linux
    platforms; see #431, #603 and #694
  - fix cache file backend: delete the correct file upon logout; closes #955
  - fix cleanup of semaphores on graceful restarts; see #522, closes #458
  - fix OIDCProviderMetadataRefreshInterval since it was interpreted in
    microseconds instead of the documented and intended seconds; setting in
    to seconds would effectively turn of caching and pull the configuration
    document on each request
  - define APLOG_TRACE1 if it does not exist
  - correct ap_hook_insert_filter function signature in stub.c, part 3; see #784
  - fixed printout of cache mutex errors in cache/common.c
  - prefer APR_LOCK_POSIXSEM over APR_LOCK_DEFAULT in apr_global_mutex_create
    which is apparently required for (some) ARM based builds
  - fix potential memory leak in proto.c when oidc_util_create_symmetric_key fails
  - fix potential memory leak in proto.c when oidc_proto_validate_access_token
    fails (at_hash validation)</changelog>
  <changelog author="michael@stroeder.com" date="1671537600">- update to 2.4.12.2
  * Security
  - CVE-2022-23527: prevent open redirect in default setup when
    OIDCRedirectURLsAllowed is not configured
    see: GHSA-q6f2-285m-gr53
  * Features
  - allow overriding the type of lock used at compile time with OIDC_LOCK</changelog>
  <changelog author="danilo.spinella@suse.com" date="1701345600">- update to 2.4.14.4:
  * for the complete list of changes, please have a look at ChangeLog</changelog>
  <changelog author="danilo.spinella@suse.com" date="1708084800">- Update to 2.4.15.3:
  * for the complete list of changes, please have a look at ChangeLog
- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911</changelog>
  <changelog author="pgajdos@suse.com" date="1711368000">- version update to 2.4.15.6
  03/14/2024
  - fix userinfo refresh interval parsing; closes #1200; thanks @HolgerHees
    avoid refreshing userinfo on each request until access token expiry
  - store interval as JSON integer in session
  - use SameSite=Lax when OIDCCookieSameSite is On (also by default) instead of
    Strict as overriding from Lax to Strict does not work reliably anymore (Chrome)
  - release 2.4.15.6
  03/13/2024
  - fix compilation without libhiredis; closes #1195 ; thanks @HolgerHees
    conditionally define oidc_set_redis_connect_timeout
  - fix `OIDCPassClaimsAs environment` bug introduced in 2.4.15.4; see #1196; thanks @HolgerHees
  - release 2.4.15.5
  03/12/2024
  - release 2.4.15.4
  - fix setting the default PCKE method to "none" in a multi-provider setup</changelog>
  <changelog author="pgajdos@suse.com" date="1726574400">- version update to 2.4.16.3
  09/06/2024
  - allow overriding globally set OIDCCacheType back to shm in vhosts
  - correct typo in child initialization routines when using multiple vhosts; closes #1208; thanks @studersi
    this fixes possible segmentation faults when using Redis and Metrics settings in vhosts
  09/05/2024
  - fix OIDCCacheShmMax min/max settings; see #1260; thanks @bbartke
  08/29/2024
  - fix setting OIDCPKCEMethod none; closes #1256; thanks @eoliphan
  08/28/2024
  - re-introduce OIDCSessionMaxDuration 0; see #1252
  - add some resilience when both Forwarded and X-Forwarded-* are configured
  - fix disabled OIDCStateCookiePrefix command; closes #1254; thanks @damisanet
  - remove support for OIDCHTMLErrorTemplate, deprecated since 2.4.14
  08/26/2024
  - fix parsing OIDCXForwardedHeaders; closes #1250; thanks @maltesmann
  07/03/2024
  - cfg/provider: use oidc_jwk_list_copy when merging client_keys
  06/18/2024
  - memcache: correct dead server check on APR_NOTFOUND; see #1230; thanks @rpluem-vf
  06/08/2024
  - support DPoP nonces to the userinfo endpoint
  06/06/2024
  - add OIDCDPoPMode [off|optional|required] primitive
  - store the token_type in the session
  06/05/2024
  - add "nbf" claim in the Request Object as per https://openid.net/specs/openid-financial-api-part-2-1_0-final.html#rfc.section.5.2.2
  06/04/2024
  - add (client) support for RFC 9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)
  - replace multi-provider .conf "issuer_specific_redirect_uri" boolean with "response_require_iss" boolean
  - tighten up the "aud" claim validation in ID tokens
  - add support for the FAPI 2.0 Security Profile https://openid.net/specs/fapi-2_0-security-profile-ID2.html
  05/30/2024
  - add support for RFC 9126 OAuth 2.0 Pushed Authorization Requests
  04/23/2024
  - disable support for the RSA PKCS v1.5 JWE encryption algorithm as it is deemed unsafe
    due to the Marvin attack and is removed from libcjose as well
  04/05/2024
  - add debug printout for OIDCUnAuthAction expression evaluation
  04/03/2024
  - when an expression is configured for OIDCUnAuthAction (i.e. in the 2nd argument), also apply
    it to OIDCUnAutzAction so that it can be used to enable step-up authentication for SPAs with
    non-conformant browsers (some versions of Safari) and in (potentially insecure) iframes
    see #1205; thanks @ryanwilliamnicholls
  04/02/2024
  - major rewrite of config primitive handling:
  - split out over different files, use header files consistently
  - encapsulate config record with getters/setters
  - allow overriding defined global configuration primitives to their default value on the individual vhost level
  - apply input/boundary checking on all configuration values, shared with provider metadata parsing
  - various fixes to applying default config values and allowing primitives in vhost/directory scopes
  - return HTTTP 502 when refreshing acces token or userinfo fails (default: "502_on_error")
  - use a singleton token refresh mutex
  - add support for OIDCOAuthIntrospectionEndpointKeyPassword
  - bump to 2.4.16dev
  04/01/2024
  - release 2.4.15.7
  03/29/2024
- fix OIDCUserInfoRefreshInterval, interval seconds would be interpreted as microseconds</changelog>
  <changelog author="pgajdos@suse.com" date="1733918400">- version update to 2.4.16.6
  12/05/2024
  - metadata: fix caching of JWKs from jwks_uri when using the default expiry setting (i.e. not using OIDCJWKSRefreshInterval)
    and avoid fetching JWKs from the jwks_uri for each user login; also addresses Redis cache
    error entries the log [ERR invalid expire time in 'setex' command]
  - avoid segfault and improve error reporting in case apr_temp_dir_get fails when a temp directory cannot be found
    on the system upon initalizing cache mutexes and file cache; see #1288; thanks @ErmakovDmitriy
  11/21/2024
  - add option to set local address for outgoing HTTP requests; see #1283; thanks @studersi
    using e.g. SetEnvIfExpr true OIDC_CURL_INTERFACE=192.168.10.2
  - try and address metris cleanup segmentation fault on shutdown; see #1207
    by not flushing metrics to the shared memory segment upon exit
  11/14/2024
  - allow specific settings Strict|Lax|None|Disabled for OIDCCookieSameSite in addition to On(=Lax)|Off(=None)
  - fix: default behaviour Lax
  - fix: apply OIDCCookieSameSite Off/None properly to state cookies instead of always setting Lax
  - re-introduces the option to configure a Strict SameSite session cookie policy, which will turn the initial
    Lax session cookie - set upon receving the response to the Redirect URI - into a Strict session cookie
    immediately after the first application request
  - allows for a "Disabled" value that does not set any SameSite flag on the cookies, in which case a browser
    falls back to its default browser behaviour (which should be Lax by spec)
  11/07/2024
  - info: fix requests to the info hook with extend_session=false; see #1279; thanks @fnieri-cdp
  - properly reflect the (unmodified) inactivity timeout in the response ("timeout")
  - avoid refreshing an access token (since the session is not saved)
  - avoid refreshing claims from the user info endpoint, and possibly refreshing the access token
  10/23/2024
  - metadata: allow plain HTTP URLs in metadata elements `jwks_uri` and `signed_jwks_uri`
    to ensure backwards compatibility with &lt;=2.4.15.7 and to support private/test deployments
  10/22/2024
  - address warnings from static code analysis tool CodeChecker
  10/04/2024
  - ensure backwards compatibility with versions &lt;2.4.16.x when a JSON array of string values
    is provided in the "aud" claim of the ID token; required by (at least) Oracle IDCS
    see #1272 and #1273; thanks @lufik and @tydalforce
  - add OIDCIDTokenAudValues configuration primitive that allows for explicit (and exhaustive)
    configuration of the list of accepted values in the "aud" claim of the ID token
    e.g. as required for passing FAPI 2 conformance testing
  09/27/2024
  - correct usage of free() for json_dumps return values instead of cjose_get_dealloc()()
  - use compact encoding and preserve order where appropriate for most calls to json_dumps
  - replace json_dumps/free combos with oidc_util_encode_json
  - refactor oidc_jwk_to_json
  09/26/2024
  - fix oidc_jwk_copy wrt. "x5t", which broke private_key_jwt authentication to Azure AD since 2.4.13
    see #1269; thanks @uoe-pjackson
  09/21/2024
  - refactor state and userinfo
  09/11/2024
  - change warnings about not passing unknown claim types into debug messages; see #1263; thanks @nclarkau
  09/09/2024
  - fix accepting custom cookie names in OIDCOAuthAcceptTokenAs cookie:&lt;name&gt;; see #1261; thanks @bbartke
  - improve basic authentication parsing when using OIDCOAuthAcceptTokenAs basic</changelog>
  <changelog author="pgajdos@suse.com" date="1739188800">- version update to 2.4.16.7
  01/29/2025
  - add OIDCProfile to configure OpenID Connect profile behaviours for, so far "FAPI20" only, which configures:
    Authentication Request method, DPoP, PKCE, ID token aud values requirements
    token endpoint JWT authentication "aud" values, "iss" parameter requirement in authentication reponses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1741953600">- update to 2.4.16.8:
  * add support for claim value counters in OIDCMetricsData
  * do not reset Prometheus counters by default, only when
    explicitly specified
  * metrics: reset to 0 in case of an integer overflow
- build with pcre2</changelog>
  <changelog author="pgajdos@suse.com" date="1744113600">- version update to 2.4.16.11 (CVE-2025-31492 [bsc#1240893])
  - fix protected content leakage when using OIDCProviderAuthRequestMethod POST, see:
    https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-59jp-rwph-878r
  - allow for regular Apache processing (e.g. setting response headers) when using OIDCProviderAuthRequestMethod POST
  - core: complete case-insensitive protocol/hostname/domain-name comparisons
  2.4.16.10
  - core: compare hostnames and domains in a case insensitive way in:
    oidc_request_check_cookie_domain
    oidc_util_cookie_domain_valid
    oidc_validate_redirect_url
    oidc_cfg_parse_is_valid_url_scheme
    oidc_discovery_target_link_uri_match
  - cookie: fix oidc_util_cookie_domain_valid so that it checks the incoming request against OIDCCookieDomain
    rather than the OIDCRedirectURI and displays the correct error message if they don't match
  2.4.16.9
  - cookie: use case insensitive hostname/domain comparison in oidc_check_cookie_domain
  - authz: remove the Location header from HTML based step up authentication redirects
    as it may conflict with its HTTP 200 status code and confuse middle boxes
  - metrics: avoid double-free on shutdown by not calling pthread_exit; fixes #1207; thanks @studersi
  - metrics: upon exit, do write cached metrics into shared memory before exiting</changelog>
  <changelog author="pgajdos@suse.com" date="1746014400">- version update to 2.4.17
  * Features
  - proto: pass the scope parameter as returned from the token endpoint in the OIDC_scope
    header/environment variable and make it available for Require claim scope: purposes,
    if not available as a claim returned in the id_token or userinfo endpoint; thanks Amaury Buffet
  * Bugfixes
  - metadata: fix parsing the OPs token_endpoint_auth_methods_supported and avoid the log error:
  - oidc_metadata_provider_parse: oidc_provider_token_endpoint_auth_set: invalid value
    and falling back to client_secret_basic after that; thanks François Kooman
  - fix memory leaks when using provider specific client keys and/or signed_jwks_uri_key in.a
    multi-provider setup; thanks Sami Korvonen
  - allow for regular Apache processing (e.g. setting response/security headers) by deferring HTML/HTTP
    output generation to the content handler (instead of user id check handler) for the following use cases:
    OIDCProviderAuthRequestMethod POST
    OIDCPreservePost On (both internal and template-based)
    POST page for the implicit grant type
    Request URI handler
    internally generated POST logout page
    session management RP iframe
    session management logout HTML top-window redirect page</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- build with hiredis for openSUSE only [bsc#1243922]</changelog>
  <changelog author="pgajdos@suse.com" date="1750766400">- version update to 2.4.17.1
  * fix usage of OIDCSessionType client-cookie:persistent:store_id_token; see #1331; thanks @rgcv
  * fix usage of OIDCPreservePostTemplates, regression in 2.4.17; see #1325; thanks @perry19987
  * javascript: use HTMLFormElement.prototype.submit.call(document.forms[0]) on all Javascript
    auto-submit POST forms to prevent browser Javascript error: "form.submit is not a function"
  * metrics: avoid possible segfault after restart twice; thanks @atzm
  * code: refactor util.c into util/ directory
  * allow adding a prefix to the cache (section) key through environment variable OIDC_CACHE_PREFIX</changelog>
  <changelog author="pgajdos@suse.com" date="1757419200">- version update to 2.4.18
  * add Valgrind target to Makefile and to Github Build action
  * release 2.4.18
  * revise test/check and code coverage functions
  * revise autoconf/automake, split over subdirs now
  * add tests for memcache TTL
  * fix check OIDC_CONFIG_POS_TIMEOUT_UNSET for memcache TTL getter; #1345
  * bump to 2.4.18dev
  * fix parsing the value set via OIDCMemCacheConnectionsTTL and interpret it in
    seconds correctly now (instead of microseconds); see #1345; thanks @rpluem
  * use the server process pool for static variable allocation rather than the pconf pool
    to prevents possible segmentation faults after (graceful) restarting the same process</changelog>
  <changelog author="pgajdos@suse.com" date="1770724800">- version update to 2.4.19.1
  * backwards incompatible session format so existing sessions (created by versions
    &lt;=2.4.18.x) are invalid
  * oauth: fix segfault when using OIDCOAuthVerifySharedKeys, regression since 2.4.16; closes #1373
  * jwk: fix parsing RSA JWKs with only an x5c parameter (i.e. no n and e parameters)
- version update to 2.4.19
  * cookie: support individual SameSite cookie settings on the session cookie, state cookie
    and Discovery CSRF cookie by adding 2 more arguments to OIDCCookieSameSite
  * id_token: add off option to OIDCPassIDTokenAs so no claims from the ID token will be passed on
  * passphrase: generate a crypto key when OIDCCryptoPassphrase is not set
  * note that the OIDCCryptoPassphrase does need to be configured statically if you want sessions
    to survive server restarts, or for a cluster that shares a session storage backend
  * metadata: avoid double-free when validation of provider metadata fails
  * response: avoid proto state memory leaks upon errors in response processing
  * util/key.c: check for unsupported symmetric key hashing algorithms and avoid a memory
    leak in such cases
  * session: remove expired session from cache with oidc_session_kill instead of just clearing it
  * memory: rewrite pconf pool memory allocation handling to avoid increasing memory (pool)
    consumption over graceful restarts
  * drop support for Apache 2.2
  * redis: use SET..EX %d when storing cached data instead of the deprecated SETEX
  * session/cookie: save 20-40 bytes on the session and client-cookie size
  * request: set the OIDC_ERROR variables when PAR is configured but not enabled by the Provider
  * code: avoid compiler warnings on curl_easy_setopt in http.c
  * test: add more unit tests in test/test_*.c and migrate proto tests from test.c</changelog>
  <changelog author="pgajdos@suse.com" date="1771329600">- run the testsuite (make check)</changelog>
  <changelog author="mardnh@gmx.de" date="1780401600">- Update to version 2.4.19.3
  Bugfixes
  * proto: add scope=openid to the authorization request when
    passing a Request Object by reference (request_uri) as
    defined by spec; see #1385;
  * config: fix intermittent core dumps on a large number of
    (first) incoming parallel requests after startup in threaded
    MPM environments.
  * code: fix a memory leak in
    oidc_metadata_jwks_retrieve_and_cache when JSON validation
    fails.
  * http: skip cookies that are only whitespace after the
    leading-space strip and avoid leaving a malformed segment in
    the forwarded Cookie header.
  * metrics: switch _oidc_metrics_thread_exit to a volatile
    apr_uint32_t accessed via apr_atomic_read32/set32 and avoid
    strand the post-join cleanup.
  * util: guard oidc_util_rand_int with a mod==0 short-circuit -
    to avoid division by zero - and rejection-sample before
    reducing modulo so v % mod is uniformly distributed.
  * userinfo: skip the DPoP-nonce retry path for non-DPoP token
    types to avoid dereference NULL inside apr_hash_get and crash
    the worker.
  * config: validate format specifiers (only %% and exactly two/one
    %s) in oidc_util_html_send_in_template so a stray %s in custom
    templates configured with OIDCPreservePostTemplates) can't
    crash or corrupt memory.
  Security
  * code: fix &gt;25 cases of potential string/URL matching attacks,
    XSS attacks, buffer overload etc.
  * config: fix low-risk - insider admin attack based- security
    vulnerabilities.
  * log: do not log refresh tokens at warn/error levels.
  Other
  * code: cast curl timeouts in options to long to avoid compiler
    warnings.
  * test: re-factor the framework and add more unit tests.
  * build: conditionally add --coverage to AM_LDFLAGS in
    Makefile.am
- Update to version 2.4.19.2
  Bugfixes
  * authz: fix claims based authorization in OAuth 2.0 RS mode
    (AuthType oauth20 and AuthType auth-openidc);
    regression introduced in 2.4.19</changelog>
</package>
<package pkgid="ad46ff9b3deed9920200aa4816f8c1cd0091b9233ab77bdd937502e862c12a77" name="apache2-mod_auth_openidc-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.4.19.3" rel="95.1"/>
  <changelog author="michael@stroeder.com" date="1658750400">- removed obsolete BuildRequires autoconf and automake
- update to 2.4.11.2
  + release 2.4.11.2
  * Features
  - add support for Apache expressions in OIDCPathAuthRequestParams and OIDCPathScope; see #594
  * Bugfixes
  - add Cache-Control headers to logout response; see #846; thanks @blackwhiser1
  * Other
  - don't strip the header from encrypted JWTs as future versions of cjose may use compact
  - encoding for JWEs; this slightly increases state cookie size, by-value session cookies
  - and encrypted cache contents again at the benefit of forward cjose compatibility
  + release 2.4.11.1
  * Bugfixes
  - fix OIDCUnAuthAction pass not passing claims for authenticated users, see #790, thanks @cm0s
  - fix race conditions in the file cache backend, see #777, thanks @dbakker and @blackwhiser1
  - fix memory leaks over graceful restarts, see #823 and #824, thanks @smanolache
  - avoid using %llu print formatter and switch to %lu for unsigned long so it works cross platform
  - add a check to make sure URLs do not contain unencoded Unicode characters, see #796, thanks @cnico
  * Features
  - warn about mismatch between incoming X-Forwarded-* headers and OIDCXForwardedHeaders configuration
  - add support for OpenSSL 3.0
  * Other
  - remove test-cmd jwk2cert command
  - correct ap_hook_insert_filter function signature in stub.c, part 2, closes #784, thanks @stroeder
  - add Valgrind Github action
  + release 2.4.11
  * Bugfixes
  - fix use of regular expressions in Require statements
  - no longer defer multi-OP Discovery to the content handler to allow RequireAll and Require not directives in multi-OP setups; closes #775; thanks @rajeevn1
  - improve handling session duration expiry when combined with OIDCUnAuthAction pass or Discovery; see #778
  - terminate on startup when the crypto passphrase generated by exec: is empty; see #767
  - allow authorization on info requests, see #746
  - avoid debug printout of payload as header when the latter is stripped
  - fix race condition in file cache backend reading truncated files under load; see #777; thanks @dbakker
  * Features
  - make interpretation of X-Forwarded-* headers configurable, defaulting to none so mod_auth_openidc running behind a reverse proxy that sets X-Forwarded-* headers needs explicit configuration of OIDCXForwardedHeaders
  - make X-Frame-Options header returned on OIDC front-channel logout requests configurable through OIDCLogoutXFrameOptions; closes #464
  - add x5t to JWT header in private_key_jwt client assertions; for interop with Azure AD; see #762; thanks @juur
  - improve detection of suspicious redirect URLs; add test list
  - add administrative session revocation capability via &lt;redirect_uri&gt;?revoke_session=&lt;sessionid&gt;
  * Packaging
  - add support for libpcre2; see #740
  - add AM_PROG_CC_C_O to configure.ac (at least for RHEL 7.7); see #765; thanks @bitmagewb
  - include &lt;openssl/bn.h&gt; in jose.c to compile with OpenSSL 1.0.x
  - install taking into account DESTDIR; see #674; thanks @alerque
  + release 2.4.10
  * Features
  - add check for Sec-Fetch-Dest header != "document" value and Sec-Fetch-Mode header != "navigate" to auto-detect requests that are not capable of handling an authentication round trip to the Provider; see #714; thanks @studersi
  - add redirect/text options to OIDCUnAutzAction; see #715; thanks @chrisinmtown
  - log require claims failure on info level
  - backport ap_get_exec_line, supporting the exec: option in OIDCCryptoPassphrase to Apache 2.2
  * Bugfixes
  - return HTTP 200 for OPTIONS requests in auth-openidc mixed mode
  - don't apply claims based authorization for OPTIONS requests so paths protected with Require claim directives will now also return HTTP 200 for OPTIONS requests
  - fix memory leak when parsing JWT access token fails (in RS mode)
  - fix regexp substition crash using OIDCRemoteUserClaim; thanks @nneul; closes #720
  * Packaging
  - complete usage of autoconf/automake; see #674
  - add .deb for Debian Bullseye</changelog>
  <changelog author="michael@stroeder.com" date="1661256000">- update to 2.4.11.3
  * Bugfixes
  - avoid memory leak when using PCRE2 regular expressions with
    array matching; closes #902
  - avoid memory leak when cjose_jws_get_plaintext fails; closes #903
  - fix handling of IPv6 based logout URLs
  * Features
  - Use optionally provided sid and iss request parameters during
    front channel logout; see #855
  - support Forwarded header in addition to X-Forwarded-*; see #853</changelog>
  <changelog author="michael@stroeder.com" date="1666008000">- update to 2.4.12
  * Features
  - allow storing the id_token in a client-cookie based session; see #812 and #888
  - allow setting connection pool parameters for Memcache server connections; see #916
  - add option to set a username for Redis authentication via OIDCRedisCacheUsername
  - register request_object_signing_alg in dynamic client registration when using request_uri
  * Bugfixes
  - increase size of the output buffer when using libpcre2 for substitution; closes #915
  - support OIDCSessionInactivityTimeout values greater than 30 days
    when using Memcache; see #936
  - allow for step-up discovery with an external URL using HTML refresh;
    fixes behaviour on CentOS 7/8 when combined with ProxyPass
  - apply exact length matching for at_hash and c_hash validation
  - store access token obtained from backchannel in session over the one
    returned in the frontchannel for code token and code id_token token flows
  - check ID token signed response algorithm on backchannel logout_token
    and retrieve its configuration value from the client metadata file</changelog>
  <changelog author="michael@stroeder.com" date="1668513600">- update to 2.4.12.1
  * Features
  - add option to use ISO-8859-1 encoding for propagated claim values by
    adding latin1 option to OIDCPassClaimsAs &lt;&gt; latin1; see #957
  - Note that the encoding - including the existing "base64url" - apply to
    both header and environment variables as well now
  * Bugfixes
  - switch to using apr_generate_random_bytes instead of apr_uuid_get to
    generate session identifiers so there's no longer a (rather implicit)
    dependency on a libapr that is compiled against libuuid on Linux
    platforms; see #431, #603 and #694
  - fix cache file backend: delete the correct file upon logout; closes #955
  - fix cleanup of semaphores on graceful restarts; see #522, closes #458
  - fix OIDCProviderMetadataRefreshInterval since it was interpreted in
    microseconds instead of the documented and intended seconds; setting in
    to seconds would effectively turn of caching and pull the configuration
    document on each request
  - define APLOG_TRACE1 if it does not exist
  - correct ap_hook_insert_filter function signature in stub.c, part 3; see #784
  - fixed printout of cache mutex errors in cache/common.c
  - prefer APR_LOCK_POSIXSEM over APR_LOCK_DEFAULT in apr_global_mutex_create
    which is apparently required for (some) ARM based builds
  - fix potential memory leak in proto.c when oidc_util_create_symmetric_key fails
  - fix potential memory leak in proto.c when oidc_proto_validate_access_token
    fails (at_hash validation)</changelog>
  <changelog author="michael@stroeder.com" date="1671537600">- update to 2.4.12.2
  * Security
  - CVE-2022-23527: prevent open redirect in default setup when
    OIDCRedirectURLsAllowed is not configured
    see: GHSA-q6f2-285m-gr53
  * Features
  - allow overriding the type of lock used at compile time with OIDC_LOCK</changelog>
  <changelog author="danilo.spinella@suse.com" date="1701345600">- update to 2.4.14.4:
  * for the complete list of changes, please have a look at ChangeLog</changelog>
  <changelog author="danilo.spinella@suse.com" date="1708084800">- Update to 2.4.15.3:
  * for the complete list of changes, please have a look at ChangeLog
- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911</changelog>
  <changelog author="pgajdos@suse.com" date="1711368000">- version update to 2.4.15.6
  03/14/2024
  - fix userinfo refresh interval parsing; closes #1200; thanks @HolgerHees
    avoid refreshing userinfo on each request until access token expiry
  - store interval as JSON integer in session
  - use SameSite=Lax when OIDCCookieSameSite is On (also by default) instead of
    Strict as overriding from Lax to Strict does not work reliably anymore (Chrome)
  - release 2.4.15.6
  03/13/2024
  - fix compilation without libhiredis; closes #1195 ; thanks @HolgerHees
    conditionally define oidc_set_redis_connect_timeout
  - fix `OIDCPassClaimsAs environment` bug introduced in 2.4.15.4; see #1196; thanks @HolgerHees
  - release 2.4.15.5
  03/12/2024
  - release 2.4.15.4
  - fix setting the default PCKE method to "none" in a multi-provider setup</changelog>
  <changelog author="pgajdos@suse.com" date="1726574400">- version update to 2.4.16.3
  09/06/2024
  - allow overriding globally set OIDCCacheType back to shm in vhosts
  - correct typo in child initialization routines when using multiple vhosts; closes #1208; thanks @studersi
    this fixes possible segmentation faults when using Redis and Metrics settings in vhosts
  09/05/2024
  - fix OIDCCacheShmMax min/max settings; see #1260; thanks @bbartke
  08/29/2024
  - fix setting OIDCPKCEMethod none; closes #1256; thanks @eoliphan
  08/28/2024
  - re-introduce OIDCSessionMaxDuration 0; see #1252
  - add some resilience when both Forwarded and X-Forwarded-* are configured
  - fix disabled OIDCStateCookiePrefix command; closes #1254; thanks @damisanet
  - remove support for OIDCHTMLErrorTemplate, deprecated since 2.4.14
  08/26/2024
  - fix parsing OIDCXForwardedHeaders; closes #1250; thanks @maltesmann
  07/03/2024
  - cfg/provider: use oidc_jwk_list_copy when merging client_keys
  06/18/2024
  - memcache: correct dead server check on APR_NOTFOUND; see #1230; thanks @rpluem-vf
  06/08/2024
  - support DPoP nonces to the userinfo endpoint
  06/06/2024
  - add OIDCDPoPMode [off|optional|required] primitive
  - store the token_type in the session
  06/05/2024
  - add "nbf" claim in the Request Object as per https://openid.net/specs/openid-financial-api-part-2-1_0-final.html#rfc.section.5.2.2
  06/04/2024
  - add (client) support for RFC 9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)
  - replace multi-provider .conf "issuer_specific_redirect_uri" boolean with "response_require_iss" boolean
  - tighten up the "aud" claim validation in ID tokens
  - add support for the FAPI 2.0 Security Profile https://openid.net/specs/fapi-2_0-security-profile-ID2.html
  05/30/2024
  - add support for RFC 9126 OAuth 2.0 Pushed Authorization Requests
  04/23/2024
  - disable support for the RSA PKCS v1.5 JWE encryption algorithm as it is deemed unsafe
    due to the Marvin attack and is removed from libcjose as well
  04/05/2024
  - add debug printout for OIDCUnAuthAction expression evaluation
  04/03/2024
  - when an expression is configured for OIDCUnAuthAction (i.e. in the 2nd argument), also apply
    it to OIDCUnAutzAction so that it can be used to enable step-up authentication for SPAs with
    non-conformant browsers (some versions of Safari) and in (potentially insecure) iframes
    see #1205; thanks @ryanwilliamnicholls
  04/02/2024
  - major rewrite of config primitive handling:
  - split out over different files, use header files consistently
  - encapsulate config record with getters/setters
  - allow overriding defined global configuration primitives to their default value on the individual vhost level
  - apply input/boundary checking on all configuration values, shared with provider metadata parsing
  - various fixes to applying default config values and allowing primitives in vhost/directory scopes
  - return HTTTP 502 when refreshing acces token or userinfo fails (default: "502_on_error")
  - use a singleton token refresh mutex
  - add support for OIDCOAuthIntrospectionEndpointKeyPassword
  - bump to 2.4.16dev
  04/01/2024
  - release 2.4.15.7
  03/29/2024
- fix OIDCUserInfoRefreshInterval, interval seconds would be interpreted as microseconds</changelog>
  <changelog author="pgajdos@suse.com" date="1733918400">- version update to 2.4.16.6
  12/05/2024
  - metadata: fix caching of JWKs from jwks_uri when using the default expiry setting (i.e. not using OIDCJWKSRefreshInterval)
    and avoid fetching JWKs from the jwks_uri for each user login; also addresses Redis cache
    error entries the log [ERR invalid expire time in 'setex' command]
  - avoid segfault and improve error reporting in case apr_temp_dir_get fails when a temp directory cannot be found
    on the system upon initalizing cache mutexes and file cache; see #1288; thanks @ErmakovDmitriy
  11/21/2024
  - add option to set local address for outgoing HTTP requests; see #1283; thanks @studersi
    using e.g. SetEnvIfExpr true OIDC_CURL_INTERFACE=192.168.10.2
  - try and address metris cleanup segmentation fault on shutdown; see #1207
    by not flushing metrics to the shared memory segment upon exit
  11/14/2024
  - allow specific settings Strict|Lax|None|Disabled for OIDCCookieSameSite in addition to On(=Lax)|Off(=None)
  - fix: default behaviour Lax
  - fix: apply OIDCCookieSameSite Off/None properly to state cookies instead of always setting Lax
  - re-introduces the option to configure a Strict SameSite session cookie policy, which will turn the initial
    Lax session cookie - set upon receving the response to the Redirect URI - into a Strict session cookie
    immediately after the first application request
  - allows for a "Disabled" value that does not set any SameSite flag on the cookies, in which case a browser
    falls back to its default browser behaviour (which should be Lax by spec)
  11/07/2024
  - info: fix requests to the info hook with extend_session=false; see #1279; thanks @fnieri-cdp
  - properly reflect the (unmodified) inactivity timeout in the response ("timeout")
  - avoid refreshing an access token (since the session is not saved)
  - avoid refreshing claims from the user info endpoint, and possibly refreshing the access token
  10/23/2024
  - metadata: allow plain HTTP URLs in metadata elements `jwks_uri` and `signed_jwks_uri`
    to ensure backwards compatibility with &lt;=2.4.15.7 and to support private/test deployments
  10/22/2024
  - address warnings from static code analysis tool CodeChecker
  10/04/2024
  - ensure backwards compatibility with versions &lt;2.4.16.x when a JSON array of string values
    is provided in the "aud" claim of the ID token; required by (at least) Oracle IDCS
    see #1272 and #1273; thanks @lufik and @tydalforce
  - add OIDCIDTokenAudValues configuration primitive that allows for explicit (and exhaustive)
    configuration of the list of accepted values in the "aud" claim of the ID token
    e.g. as required for passing FAPI 2 conformance testing
  09/27/2024
  - correct usage of free() for json_dumps return values instead of cjose_get_dealloc()()
  - use compact encoding and preserve order where appropriate for most calls to json_dumps
  - replace json_dumps/free combos with oidc_util_encode_json
  - refactor oidc_jwk_to_json
  09/26/2024
  - fix oidc_jwk_copy wrt. "x5t", which broke private_key_jwt authentication to Azure AD since 2.4.13
    see #1269; thanks @uoe-pjackson
  09/21/2024
  - refactor state and userinfo
  09/11/2024
  - change warnings about not passing unknown claim types into debug messages; see #1263; thanks @nclarkau
  09/09/2024
  - fix accepting custom cookie names in OIDCOAuthAcceptTokenAs cookie:&lt;name&gt;; see #1261; thanks @bbartke
  - improve basic authentication parsing when using OIDCOAuthAcceptTokenAs basic</changelog>
  <changelog author="pgajdos@suse.com" date="1739188800">- version update to 2.4.16.7
  01/29/2025
  - add OIDCProfile to configure OpenID Connect profile behaviours for, so far "FAPI20" only, which configures:
    Authentication Request method, DPoP, PKCE, ID token aud values requirements
    token endpoint JWT authentication "aud" values, "iss" parameter requirement in authentication reponses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1741953600">- update to 2.4.16.8:
  * add support for claim value counters in OIDCMetricsData
  * do not reset Prometheus counters by default, only when
    explicitly specified
  * metrics: reset to 0 in case of an integer overflow
- build with pcre2</changelog>
  <changelog author="pgajdos@suse.com" date="1744113600">- version update to 2.4.16.11 (CVE-2025-31492 [bsc#1240893])
  - fix protected content leakage when using OIDCProviderAuthRequestMethod POST, see:
    https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-59jp-rwph-878r
  - allow for regular Apache processing (e.g. setting response headers) when using OIDCProviderAuthRequestMethod POST
  - core: complete case-insensitive protocol/hostname/domain-name comparisons
  2.4.16.10
  - core: compare hostnames and domains in a case insensitive way in:
    oidc_request_check_cookie_domain
    oidc_util_cookie_domain_valid
    oidc_validate_redirect_url
    oidc_cfg_parse_is_valid_url_scheme
    oidc_discovery_target_link_uri_match
  - cookie: fix oidc_util_cookie_domain_valid so that it checks the incoming request against OIDCCookieDomain
    rather than the OIDCRedirectURI and displays the correct error message if they don't match
  2.4.16.9
  - cookie: use case insensitive hostname/domain comparison in oidc_check_cookie_domain
  - authz: remove the Location header from HTML based step up authentication redirects
    as it may conflict with its HTTP 200 status code and confuse middle boxes
  - metrics: avoid double-free on shutdown by not calling pthread_exit; fixes #1207; thanks @studersi
  - metrics: upon exit, do write cached metrics into shared memory before exiting</changelog>
  <changelog author="pgajdos@suse.com" date="1746014400">- version update to 2.4.17
  * Features
  - proto: pass the scope parameter as returned from the token endpoint in the OIDC_scope
    header/environment variable and make it available for Require claim scope: purposes,
    if not available as a claim returned in the id_token or userinfo endpoint; thanks Amaury Buffet
  * Bugfixes
  - metadata: fix parsing the OPs token_endpoint_auth_methods_supported and avoid the log error:
  - oidc_metadata_provider_parse: oidc_provider_token_endpoint_auth_set: invalid value
    and falling back to client_secret_basic after that; thanks François Kooman
  - fix memory leaks when using provider specific client keys and/or signed_jwks_uri_key in.a
    multi-provider setup; thanks Sami Korvonen
  - allow for regular Apache processing (e.g. setting response/security headers) by deferring HTML/HTTP
    output generation to the content handler (instead of user id check handler) for the following use cases:
    OIDCProviderAuthRequestMethod POST
    OIDCPreservePost On (both internal and template-based)
    POST page for the implicit grant type
    Request URI handler
    internally generated POST logout page
    session management RP iframe
    session management logout HTML top-window redirect page</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- build with hiredis for openSUSE only [bsc#1243922]</changelog>
  <changelog author="pgajdos@suse.com" date="1750766400">- version update to 2.4.17.1
  * fix usage of OIDCSessionType client-cookie:persistent:store_id_token; see #1331; thanks @rgcv
  * fix usage of OIDCPreservePostTemplates, regression in 2.4.17; see #1325; thanks @perry19987
  * javascript: use HTMLFormElement.prototype.submit.call(document.forms[0]) on all Javascript
    auto-submit POST forms to prevent browser Javascript error: "form.submit is not a function"
  * metrics: avoid possible segfault after restart twice; thanks @atzm
  * code: refactor util.c into util/ directory
  * allow adding a prefix to the cache (section) key through environment variable OIDC_CACHE_PREFIX</changelog>
  <changelog author="pgajdos@suse.com" date="1757419200">- version update to 2.4.18
  * add Valgrind target to Makefile and to Github Build action
  * release 2.4.18
  * revise test/check and code coverage functions
  * revise autoconf/automake, split over subdirs now
  * add tests for memcache TTL
  * fix check OIDC_CONFIG_POS_TIMEOUT_UNSET for memcache TTL getter; #1345
  * bump to 2.4.18dev
  * fix parsing the value set via OIDCMemCacheConnectionsTTL and interpret it in
    seconds correctly now (instead of microseconds); see #1345; thanks @rpluem
  * use the server process pool for static variable allocation rather than the pconf pool
    to prevents possible segmentation faults after (graceful) restarting the same process</changelog>
  <changelog author="pgajdos@suse.com" date="1770724800">- version update to 2.4.19.1
  * backwards incompatible session format so existing sessions (created by versions
    &lt;=2.4.18.x) are invalid
  * oauth: fix segfault when using OIDCOAuthVerifySharedKeys, regression since 2.4.16; closes #1373
  * jwk: fix parsing RSA JWKs with only an x5c parameter (i.e. no n and e parameters)
- version update to 2.4.19
  * cookie: support individual SameSite cookie settings on the session cookie, state cookie
    and Discovery CSRF cookie by adding 2 more arguments to OIDCCookieSameSite
  * id_token: add off option to OIDCPassIDTokenAs so no claims from the ID token will be passed on
  * passphrase: generate a crypto key when OIDCCryptoPassphrase is not set
  * note that the OIDCCryptoPassphrase does need to be configured statically if you want sessions
    to survive server restarts, or for a cluster that shares a session storage backend
  * metadata: avoid double-free when validation of provider metadata fails
  * response: avoid proto state memory leaks upon errors in response processing
  * util/key.c: check for unsupported symmetric key hashing algorithms and avoid a memory
    leak in such cases
  * session: remove expired session from cache with oidc_session_kill instead of just clearing it
  * memory: rewrite pconf pool memory allocation handling to avoid increasing memory (pool)
    consumption over graceful restarts
  * drop support for Apache 2.2
  * redis: use SET..EX %d when storing cached data instead of the deprecated SETEX
  * session/cookie: save 20-40 bytes on the session and client-cookie size
  * request: set the OIDC_ERROR variables when PAR is configured but not enabled by the Provider
  * code: avoid compiler warnings on curl_easy_setopt in http.c
  * test: add more unit tests in test/test_*.c and migrate proto tests from test.c</changelog>
  <changelog author="pgajdos@suse.com" date="1771329600">- run the testsuite (make check)</changelog>
  <changelog author="mardnh@gmx.de" date="1780401600">- Update to version 2.4.19.3
  Bugfixes
  * proto: add scope=openid to the authorization request when
    passing a Request Object by reference (request_uri) as
    defined by spec; see #1385;
  * config: fix intermittent core dumps on a large number of
    (first) incoming parallel requests after startup in threaded
    MPM environments.
  * code: fix a memory leak in
    oidc_metadata_jwks_retrieve_and_cache when JSON validation
    fails.
  * http: skip cookies that are only whitespace after the
    leading-space strip and avoid leaving a malformed segment in
    the forwarded Cookie header.
  * metrics: switch _oidc_metrics_thread_exit to a volatile
    apr_uint32_t accessed via apr_atomic_read32/set32 and avoid
    strand the post-join cleanup.
  * util: guard oidc_util_rand_int with a mod==0 short-circuit -
    to avoid division by zero - and rejection-sample before
    reducing modulo so v % mod is uniformly distributed.
  * userinfo: skip the DPoP-nonce retry path for non-DPoP token
    types to avoid dereference NULL inside apr_hash_get and crash
    the worker.
  * config: validate format specifiers (only %% and exactly two/one
    %s) in oidc_util_html_send_in_template so a stray %s in custom
    templates configured with OIDCPreservePostTemplates) can't
    crash or corrupt memory.
  Security
  * code: fix &gt;25 cases of potential string/URL matching attacks,
    XSS attacks, buffer overload etc.
  * config: fix low-risk - insider admin attack based- security
    vulnerabilities.
  * log: do not log refresh tokens at warn/error levels.
  Other
  * code: cast curl timeouts in options to long to avoid compiler
    warnings.
  * test: re-factor the framework and add more unit tests.
  * build: conditionally add --coverage to AM_LDFLAGS in
    Makefile.am
- Update to version 2.4.19.2
  Bugfixes
  * authz: fix claims based authorization in OAuth 2.0 RS mode
    (AuthType oauth20 and AuthType auth-openidc);
    regression introduced in 2.4.19</changelog>
</package>
<package pkgid="26ece7dba315a6d98705e3d1c75665bfa865266f671f4bca323f297ffff35b7e" name="apache2-mod_auth_openidc-debugsource" arch="x86_64">
  <version epoch="0" ver="2.4.19.3" rel="95.1"/>
  <changelog author="michael@stroeder.com" date="1658750400">- removed obsolete BuildRequires autoconf and automake
- update to 2.4.11.2
  + release 2.4.11.2
  * Features
  - add support for Apache expressions in OIDCPathAuthRequestParams and OIDCPathScope; see #594
  * Bugfixes
  - add Cache-Control headers to logout response; see #846; thanks @blackwhiser1
  * Other
  - don't strip the header from encrypted JWTs as future versions of cjose may use compact
  - encoding for JWEs; this slightly increases state cookie size, by-value session cookies
  - and encrypted cache contents again at the benefit of forward cjose compatibility
  + release 2.4.11.1
  * Bugfixes
  - fix OIDCUnAuthAction pass not passing claims for authenticated users, see #790, thanks @cm0s
  - fix race conditions in the file cache backend, see #777, thanks @dbakker and @blackwhiser1
  - fix memory leaks over graceful restarts, see #823 and #824, thanks @smanolache
  - avoid using %llu print formatter and switch to %lu for unsigned long so it works cross platform
  - add a check to make sure URLs do not contain unencoded Unicode characters, see #796, thanks @cnico
  * Features
  - warn about mismatch between incoming X-Forwarded-* headers and OIDCXForwardedHeaders configuration
  - add support for OpenSSL 3.0
  * Other
  - remove test-cmd jwk2cert command
  - correct ap_hook_insert_filter function signature in stub.c, part 2, closes #784, thanks @stroeder
  - add Valgrind Github action
  + release 2.4.11
  * Bugfixes
  - fix use of regular expressions in Require statements
  - no longer defer multi-OP Discovery to the content handler to allow RequireAll and Require not directives in multi-OP setups; closes #775; thanks @rajeevn1
  - improve handling session duration expiry when combined with OIDCUnAuthAction pass or Discovery; see #778
  - terminate on startup when the crypto passphrase generated by exec: is empty; see #767
  - allow authorization on info requests, see #746
  - avoid debug printout of payload as header when the latter is stripped
  - fix race condition in file cache backend reading truncated files under load; see #777; thanks @dbakker
  * Features
  - make interpretation of X-Forwarded-* headers configurable, defaulting to none so mod_auth_openidc running behind a reverse proxy that sets X-Forwarded-* headers needs explicit configuration of OIDCXForwardedHeaders
  - make X-Frame-Options header returned on OIDC front-channel logout requests configurable through OIDCLogoutXFrameOptions; closes #464
  - add x5t to JWT header in private_key_jwt client assertions; for interop with Azure AD; see #762; thanks @juur
  - improve detection of suspicious redirect URLs; add test list
  - add administrative session revocation capability via &lt;redirect_uri&gt;?revoke_session=&lt;sessionid&gt;
  * Packaging
  - add support for libpcre2; see #740
  - add AM_PROG_CC_C_O to configure.ac (at least for RHEL 7.7); see #765; thanks @bitmagewb
  - include &lt;openssl/bn.h&gt; in jose.c to compile with OpenSSL 1.0.x
  - install taking into account DESTDIR; see #674; thanks @alerque
  + release 2.4.10
  * Features
  - add check for Sec-Fetch-Dest header != "document" value and Sec-Fetch-Mode header != "navigate" to auto-detect requests that are not capable of handling an authentication round trip to the Provider; see #714; thanks @studersi
  - add redirect/text options to OIDCUnAutzAction; see #715; thanks @chrisinmtown
  - log require claims failure on info level
  - backport ap_get_exec_line, supporting the exec: option in OIDCCryptoPassphrase to Apache 2.2
  * Bugfixes
  - return HTTP 200 for OPTIONS requests in auth-openidc mixed mode
  - don't apply claims based authorization for OPTIONS requests so paths protected with Require claim directives will now also return HTTP 200 for OPTIONS requests
  - fix memory leak when parsing JWT access token fails (in RS mode)
  - fix regexp substition crash using OIDCRemoteUserClaim; thanks @nneul; closes #720
  * Packaging
  - complete usage of autoconf/automake; see #674
  - add .deb for Debian Bullseye</changelog>
  <changelog author="michael@stroeder.com" date="1661256000">- update to 2.4.11.3
  * Bugfixes
  - avoid memory leak when using PCRE2 regular expressions with
    array matching; closes #902
  - avoid memory leak when cjose_jws_get_plaintext fails; closes #903
  - fix handling of IPv6 based logout URLs
  * Features
  - Use optionally provided sid and iss request parameters during
    front channel logout; see #855
  - support Forwarded header in addition to X-Forwarded-*; see #853</changelog>
  <changelog author="michael@stroeder.com" date="1666008000">- update to 2.4.12
  * Features
  - allow storing the id_token in a client-cookie based session; see #812 and #888
  - allow setting connection pool parameters for Memcache server connections; see #916
  - add option to set a username for Redis authentication via OIDCRedisCacheUsername
  - register request_object_signing_alg in dynamic client registration when using request_uri
  * Bugfixes
  - increase size of the output buffer when using libpcre2 for substitution; closes #915
  - support OIDCSessionInactivityTimeout values greater than 30 days
    when using Memcache; see #936
  - allow for step-up discovery with an external URL using HTML refresh;
    fixes behaviour on CentOS 7/8 when combined with ProxyPass
  - apply exact length matching for at_hash and c_hash validation
  - store access token obtained from backchannel in session over the one
    returned in the frontchannel for code token and code id_token token flows
  - check ID token signed response algorithm on backchannel logout_token
    and retrieve its configuration value from the client metadata file</changelog>
  <changelog author="michael@stroeder.com" date="1668513600">- update to 2.4.12.1
  * Features
  - add option to use ISO-8859-1 encoding for propagated claim values by
    adding latin1 option to OIDCPassClaimsAs &lt;&gt; latin1; see #957
  - Note that the encoding - including the existing "base64url" - apply to
    both header and environment variables as well now
  * Bugfixes
  - switch to using apr_generate_random_bytes instead of apr_uuid_get to
    generate session identifiers so there's no longer a (rather implicit)
    dependency on a libapr that is compiled against libuuid on Linux
    platforms; see #431, #603 and #694
  - fix cache file backend: delete the correct file upon logout; closes #955
  - fix cleanup of semaphores on graceful restarts; see #522, closes #458
  - fix OIDCProviderMetadataRefreshInterval since it was interpreted in
    microseconds instead of the documented and intended seconds; setting in
    to seconds would effectively turn of caching and pull the configuration
    document on each request
  - define APLOG_TRACE1 if it does not exist
  - correct ap_hook_insert_filter function signature in stub.c, part 3; see #784
  - fixed printout of cache mutex errors in cache/common.c
  - prefer APR_LOCK_POSIXSEM over APR_LOCK_DEFAULT in apr_global_mutex_create
    which is apparently required for (some) ARM based builds
  - fix potential memory leak in proto.c when oidc_util_create_symmetric_key fails
  - fix potential memory leak in proto.c when oidc_proto_validate_access_token
    fails (at_hash validation)</changelog>
  <changelog author="michael@stroeder.com" date="1671537600">- update to 2.4.12.2
  * Security
  - CVE-2022-23527: prevent open redirect in default setup when
    OIDCRedirectURLsAllowed is not configured
    see: GHSA-q6f2-285m-gr53
  * Features
  - allow overriding the type of lock used at compile time with OIDC_LOCK</changelog>
  <changelog author="danilo.spinella@suse.com" date="1701345600">- update to 2.4.14.4:
  * for the complete list of changes, please have a look at ChangeLog</changelog>
  <changelog author="danilo.spinella@suse.com" date="1708084800">- Update to 2.4.15.3:
  * for the complete list of changes, please have a look at ChangeLog
- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911</changelog>
  <changelog author="pgajdos@suse.com" date="1711368000">- version update to 2.4.15.6
  03/14/2024
  - fix userinfo refresh interval parsing; closes #1200; thanks @HolgerHees
    avoid refreshing userinfo on each request until access token expiry
  - store interval as JSON integer in session
  - use SameSite=Lax when OIDCCookieSameSite is On (also by default) instead of
    Strict as overriding from Lax to Strict does not work reliably anymore (Chrome)
  - release 2.4.15.6
  03/13/2024
  - fix compilation without libhiredis; closes #1195 ; thanks @HolgerHees
    conditionally define oidc_set_redis_connect_timeout
  - fix `OIDCPassClaimsAs environment` bug introduced in 2.4.15.4; see #1196; thanks @HolgerHees
  - release 2.4.15.5
  03/12/2024
  - release 2.4.15.4
  - fix setting the default PCKE method to "none" in a multi-provider setup</changelog>
  <changelog author="pgajdos@suse.com" date="1726574400">- version update to 2.4.16.3
  09/06/2024
  - allow overriding globally set OIDCCacheType back to shm in vhosts
  - correct typo in child initialization routines when using multiple vhosts; closes #1208; thanks @studersi
    this fixes possible segmentation faults when using Redis and Metrics settings in vhosts
  09/05/2024
  - fix OIDCCacheShmMax min/max settings; see #1260; thanks @bbartke
  08/29/2024
  - fix setting OIDCPKCEMethod none; closes #1256; thanks @eoliphan
  08/28/2024
  - re-introduce OIDCSessionMaxDuration 0; see #1252
  - add some resilience when both Forwarded and X-Forwarded-* are configured
  - fix disabled OIDCStateCookiePrefix command; closes #1254; thanks @damisanet
  - remove support for OIDCHTMLErrorTemplate, deprecated since 2.4.14
  08/26/2024
  - fix parsing OIDCXForwardedHeaders; closes #1250; thanks @maltesmann
  07/03/2024
  - cfg/provider: use oidc_jwk_list_copy when merging client_keys
  06/18/2024
  - memcache: correct dead server check on APR_NOTFOUND; see #1230; thanks @rpluem-vf
  06/08/2024
  - support DPoP nonces to the userinfo endpoint
  06/06/2024
  - add OIDCDPoPMode [off|optional|required] primitive
  - store the token_type in the session
  06/05/2024
  - add "nbf" claim in the Request Object as per https://openid.net/specs/openid-financial-api-part-2-1_0-final.html#rfc.section.5.2.2
  06/04/2024
  - add (client) support for RFC 9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)
  - replace multi-provider .conf "issuer_specific_redirect_uri" boolean with "response_require_iss" boolean
  - tighten up the "aud" claim validation in ID tokens
  - add support for the FAPI 2.0 Security Profile https://openid.net/specs/fapi-2_0-security-profile-ID2.html
  05/30/2024
  - add support for RFC 9126 OAuth 2.0 Pushed Authorization Requests
  04/23/2024
  - disable support for the RSA PKCS v1.5 JWE encryption algorithm as it is deemed unsafe
    due to the Marvin attack and is removed from libcjose as well
  04/05/2024
  - add debug printout for OIDCUnAuthAction expression evaluation
  04/03/2024
  - when an expression is configured for OIDCUnAuthAction (i.e. in the 2nd argument), also apply
    it to OIDCUnAutzAction so that it can be used to enable step-up authentication for SPAs with
    non-conformant browsers (some versions of Safari) and in (potentially insecure) iframes
    see #1205; thanks @ryanwilliamnicholls
  04/02/2024
  - major rewrite of config primitive handling:
  - split out over different files, use header files consistently
  - encapsulate config record with getters/setters
  - allow overriding defined global configuration primitives to their default value on the individual vhost level
  - apply input/boundary checking on all configuration values, shared with provider metadata parsing
  - various fixes to applying default config values and allowing primitives in vhost/directory scopes
  - return HTTTP 502 when refreshing acces token or userinfo fails (default: "502_on_error")
  - use a singleton token refresh mutex
  - add support for OIDCOAuthIntrospectionEndpointKeyPassword
  - bump to 2.4.16dev
  04/01/2024
  - release 2.4.15.7
  03/29/2024
- fix OIDCUserInfoRefreshInterval, interval seconds would be interpreted as microseconds</changelog>
  <changelog author="pgajdos@suse.com" date="1733918400">- version update to 2.4.16.6
  12/05/2024
  - metadata: fix caching of JWKs from jwks_uri when using the default expiry setting (i.e. not using OIDCJWKSRefreshInterval)
    and avoid fetching JWKs from the jwks_uri for each user login; also addresses Redis cache
    error entries the log [ERR invalid expire time in 'setex' command]
  - avoid segfault and improve error reporting in case apr_temp_dir_get fails when a temp directory cannot be found
    on the system upon initalizing cache mutexes and file cache; see #1288; thanks @ErmakovDmitriy
  11/21/2024
  - add option to set local address for outgoing HTTP requests; see #1283; thanks @studersi
    using e.g. SetEnvIfExpr true OIDC_CURL_INTERFACE=192.168.10.2
  - try and address metris cleanup segmentation fault on shutdown; see #1207
    by not flushing metrics to the shared memory segment upon exit
  11/14/2024
  - allow specific settings Strict|Lax|None|Disabled for OIDCCookieSameSite in addition to On(=Lax)|Off(=None)
  - fix: default behaviour Lax
  - fix: apply OIDCCookieSameSite Off/None properly to state cookies instead of always setting Lax
  - re-introduces the option to configure a Strict SameSite session cookie policy, which will turn the initial
    Lax session cookie - set upon receving the response to the Redirect URI - into a Strict session cookie
    immediately after the first application request
  - allows for a "Disabled" value that does not set any SameSite flag on the cookies, in which case a browser
    falls back to its default browser behaviour (which should be Lax by spec)
  11/07/2024
  - info: fix requests to the info hook with extend_session=false; see #1279; thanks @fnieri-cdp
  - properly reflect the (unmodified) inactivity timeout in the response ("timeout")
  - avoid refreshing an access token (since the session is not saved)
  - avoid refreshing claims from the user info endpoint, and possibly refreshing the access token
  10/23/2024
  - metadata: allow plain HTTP URLs in metadata elements `jwks_uri` and `signed_jwks_uri`
    to ensure backwards compatibility with &lt;=2.4.15.7 and to support private/test deployments
  10/22/2024
  - address warnings from static code analysis tool CodeChecker
  10/04/2024
  - ensure backwards compatibility with versions &lt;2.4.16.x when a JSON array of string values
    is provided in the "aud" claim of the ID token; required by (at least) Oracle IDCS
    see #1272 and #1273; thanks @lufik and @tydalforce
  - add OIDCIDTokenAudValues configuration primitive that allows for explicit (and exhaustive)
    configuration of the list of accepted values in the "aud" claim of the ID token
    e.g. as required for passing FAPI 2 conformance testing
  09/27/2024
  - correct usage of free() for json_dumps return values instead of cjose_get_dealloc()()
  - use compact encoding and preserve order where appropriate for most calls to json_dumps
  - replace json_dumps/free combos with oidc_util_encode_json
  - refactor oidc_jwk_to_json
  09/26/2024
  - fix oidc_jwk_copy wrt. "x5t", which broke private_key_jwt authentication to Azure AD since 2.4.13
    see #1269; thanks @uoe-pjackson
  09/21/2024
  - refactor state and userinfo
  09/11/2024
  - change warnings about not passing unknown claim types into debug messages; see #1263; thanks @nclarkau
  09/09/2024
  - fix accepting custom cookie names in OIDCOAuthAcceptTokenAs cookie:&lt;name&gt;; see #1261; thanks @bbartke
  - improve basic authentication parsing when using OIDCOAuthAcceptTokenAs basic</changelog>
  <changelog author="pgajdos@suse.com" date="1739188800">- version update to 2.4.16.7
  01/29/2025
  - add OIDCProfile to configure OpenID Connect profile behaviours for, so far "FAPI20" only, which configures:
    Authentication Request method, DPoP, PKCE, ID token aud values requirements
    token endpoint JWT authentication "aud" values, "iss" parameter requirement in authentication reponses</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1741953600">- update to 2.4.16.8:
  * add support for claim value counters in OIDCMetricsData
  * do not reset Prometheus counters by default, only when
    explicitly specified
  * metrics: reset to 0 in case of an integer overflow
- build with pcre2</changelog>
  <changelog author="pgajdos@suse.com" date="1744113600">- version update to 2.4.16.11 (CVE-2025-31492 [bsc#1240893])
  - fix protected content leakage when using OIDCProviderAuthRequestMethod POST, see:
    https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-59jp-rwph-878r
  - allow for regular Apache processing (e.g. setting response headers) when using OIDCProviderAuthRequestMethod POST
  - core: complete case-insensitive protocol/hostname/domain-name comparisons
  2.4.16.10
  - core: compare hostnames and domains in a case insensitive way in:
    oidc_request_check_cookie_domain
    oidc_util_cookie_domain_valid
    oidc_validate_redirect_url
    oidc_cfg_parse_is_valid_url_scheme
    oidc_discovery_target_link_uri_match
  - cookie: fix oidc_util_cookie_domain_valid so that it checks the incoming request against OIDCCookieDomain
    rather than the OIDCRedirectURI and displays the correct error message if they don't match
  2.4.16.9
  - cookie: use case insensitive hostname/domain comparison in oidc_check_cookie_domain
  - authz: remove the Location header from HTML based step up authentication redirects
    as it may conflict with its HTTP 200 status code and confuse middle boxes
  - metrics: avoid double-free on shutdown by not calling pthread_exit; fixes #1207; thanks @studersi
  - metrics: upon exit, do write cached metrics into shared memory before exiting</changelog>
  <changelog author="pgajdos@suse.com" date="1746014400">- version update to 2.4.17
  * Features
  - proto: pass the scope parameter as returned from the token endpoint in the OIDC_scope
    header/environment variable and make it available for Require claim scope: purposes,
    if not available as a claim returned in the id_token or userinfo endpoint; thanks Amaury Buffet
  * Bugfixes
  - metadata: fix parsing the OPs token_endpoint_auth_methods_supported and avoid the log error:
  - oidc_metadata_provider_parse: oidc_provider_token_endpoint_auth_set: invalid value
    and falling back to client_secret_basic after that; thanks François Kooman
  - fix memory leaks when using provider specific client keys and/or signed_jwks_uri_key in.a
    multi-provider setup; thanks Sami Korvonen
  - allow for regular Apache processing (e.g. setting response/security headers) by deferring HTML/HTTP
    output generation to the content handler (instead of user id check handler) for the following use cases:
    OIDCProviderAuthRequestMethod POST
    OIDCPreservePost On (both internal and template-based)
    POST page for the implicit grant type
    Request URI handler
    internally generated POST logout page
    session management RP iframe
    session management logout HTML top-window redirect page</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- build with hiredis for openSUSE only [bsc#1243922]</changelog>
  <changelog author="pgajdos@suse.com" date="1750766400">- version update to 2.4.17.1
  * fix usage of OIDCSessionType client-cookie:persistent:store_id_token; see #1331; thanks @rgcv
  * fix usage of OIDCPreservePostTemplates, regression in 2.4.17; see #1325; thanks @perry19987
  * javascript: use HTMLFormElement.prototype.submit.call(document.forms[0]) on all Javascript
    auto-submit POST forms to prevent browser Javascript error: "form.submit is not a function"
  * metrics: avoid possible segfault after restart twice; thanks @atzm
  * code: refactor util.c into util/ directory
  * allow adding a prefix to the cache (section) key through environment variable OIDC_CACHE_PREFIX</changelog>
  <changelog author="pgajdos@suse.com" date="1757419200">- version update to 2.4.18
  * add Valgrind target to Makefile and to Github Build action
  * release 2.4.18
  * revise test/check and code coverage functions
  * revise autoconf/automake, split over subdirs now
  * add tests for memcache TTL
  * fix check OIDC_CONFIG_POS_TIMEOUT_UNSET for memcache TTL getter; #1345
  * bump to 2.4.18dev
  * fix parsing the value set via OIDCMemCacheConnectionsTTL and interpret it in
    seconds correctly now (instead of microseconds); see #1345; thanks @rpluem
  * use the server process pool for static variable allocation rather than the pconf pool
    to prevents possible segmentation faults after (graceful) restarting the same process</changelog>
  <changelog author="pgajdos@suse.com" date="1770724800">- version update to 2.4.19.1
  * backwards incompatible session format so existing sessions (created by versions
    &lt;=2.4.18.x) are invalid
  * oauth: fix segfault when using OIDCOAuthVerifySharedKeys, regression since 2.4.16; closes #1373
  * jwk: fix parsing RSA JWKs with only an x5c parameter (i.e. no n and e parameters)
- version update to 2.4.19
  * cookie: support individual SameSite cookie settings on the session cookie, state cookie
    and Discovery CSRF cookie by adding 2 more arguments to OIDCCookieSameSite
  * id_token: add off option to OIDCPassIDTokenAs so no claims from the ID token will be passed on
  * passphrase: generate a crypto key when OIDCCryptoPassphrase is not set
  * note that the OIDCCryptoPassphrase does need to be configured statically if you want sessions
    to survive server restarts, or for a cluster that shares a session storage backend
  * metadata: avoid double-free when validation of provider metadata fails
  * response: avoid proto state memory leaks upon errors in response processing
  * util/key.c: check for unsupported symmetric key hashing algorithms and avoid a memory
    leak in such cases
  * session: remove expired session from cache with oidc_session_kill instead of just clearing it
  * memory: rewrite pconf pool memory allocation handling to avoid increasing memory (pool)
    consumption over graceful restarts
  * drop support for Apache 2.2
  * redis: use SET..EX %d when storing cached data instead of the deprecated SETEX
  * session/cookie: save 20-40 bytes on the session and client-cookie size
  * request: set the OIDC_ERROR variables when PAR is configured but not enabled by the Provider
  * code: avoid compiler warnings on curl_easy_setopt in http.c
  * test: add more unit tests in test/test_*.c and migrate proto tests from test.c</changelog>
  <changelog author="pgajdos@suse.com" date="1771329600">- run the testsuite (make check)</changelog>
  <changelog author="mardnh@gmx.de" date="1780401600">- Update to version 2.4.19.3
  Bugfixes
  * proto: add scope=openid to the authorization request when
    passing a Request Object by reference (request_uri) as
    defined by spec; see #1385;
  * config: fix intermittent core dumps on a large number of
    (first) incoming parallel requests after startup in threaded
    MPM environments.
  * code: fix a memory leak in
    oidc_metadata_jwks_retrieve_and_cache when JSON validation
    fails.
  * http: skip cookies that are only whitespace after the
    leading-space strip and avoid leaving a malformed segment in
    the forwarded Cookie header.
  * metrics: switch _oidc_metrics_thread_exit to a volatile
    apr_uint32_t accessed via apr_atomic_read32/set32 and avoid
    strand the post-join cleanup.
  * util: guard oidc_util_rand_int with a mod==0 short-circuit -
    to avoid division by zero - and rejection-sample before
    reducing modulo so v % mod is uniformly distributed.
  * userinfo: skip the DPoP-nonce retry path for non-DPoP token
    types to avoid dereference NULL inside apr_hash_get and crash
    the worker.
  * config: validate format specifiers (only %% and exactly two/one
    %s) in oidc_util_html_send_in_template so a stray %s in custom
    templates configured with OIDCPreservePostTemplates) can't
    crash or corrupt memory.
  Security
  * code: fix &gt;25 cases of potential string/URL matching attacks,
    XSS attacks, buffer overload etc.
  * config: fix low-risk - insider admin attack based- security
    vulnerabilities.
  * log: do not log refresh tokens at warn/error levels.
  Other
  * code: cast curl timeouts in options to long to avoid compiler
    warnings.
  * test: re-factor the framework and add more unit tests.
  * build: conditionally add --coverage to AM_LDFLAGS in
    Makefile.am
- Update to version 2.4.19.2
  Bugfixes
  * authz: fix claims based authorization in OAuth 2.0 RS mode
    (AuthType oauth20 and AuthType auth-openidc);
    regression introduced in 2.4.19</changelog>
</package>
<package pkgid="dba7956e3f4fb3b19a6c062ced5eb57643baede350e9efc83cadfadc647b1abd" name="apache2-mod_auth_token" arch="src">
  <version epoch="0" ver="1.0.5" rel="13.3"/>
  <changelog author="draht@suse.de" date="1299153600">- mod_auth_token-1.0.2-terminating_NULL.diff adds required
  terminating NULL to apr_pstrcat()</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1299153601">- Update to version 1.0.5</changelog>
  <changelog author="draht@suse.de" date="1299240000">- fix brokenness with _service file that didn't work</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1343822400">- Fix build, missing BUildRequires.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1344340800">- Fix per-module logging in apache 2.4</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443009600">- test with %apache_test_module_curl</changelog>
  <changelog author="pgajdos@suse.com" date="1443700800">- do not %check for Apache 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1443787200">- do %check for Apache 2.2 again</changelog>
  <changelog author="pgajdos@suse.com" date="1561636800">- use apache-rex in %check instead</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743508800">- replace %patchN with autosetup</changelog>
</package>
<package pkgid="6cc86d138c4f8d5083630eb4d601d553b27888c67987e5d9b9a9f984b043264d" name="apache2-mod_auth_token" arch="x86_64">
  <version epoch="0" ver="1.0.5" rel="13.3"/>
  <changelog author="crrodriguez@opensuse.org" date="1343822400">- Fix build, missing BUildRequires.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1344340800">- Fix per-module logging in apache 2.4</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443009600">- test with %apache_test_module_curl</changelog>
  <changelog author="pgajdos@suse.com" date="1443700800">- do not %check for Apache 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1443787200">- do %check for Apache 2.2 again</changelog>
  <changelog author="pgajdos@suse.com" date="1561636800">- use apache-rex in %check instead</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743508800">- replace %patchN with autosetup</changelog>
</package>
<package pkgid="4862c910fd7e078da3a271b3208568785c8d3a1b87156761fe003ba9e98c5a19" name="apache2-mod_auth_token-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.0.5" rel="13.3"/>
  <changelog author="crrodriguez@opensuse.org" date="1343822400">- Fix build, missing BUildRequires.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1344340800">- Fix per-module logging in apache 2.4</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443009600">- test with %apache_test_module_curl</changelog>
  <changelog author="pgajdos@suse.com" date="1443700800">- do not %check for Apache 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1443787200">- do %check for Apache 2.2 again</changelog>
  <changelog author="pgajdos@suse.com" date="1561636800">- use apache-rex in %check instead</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743508800">- replace %patchN with autosetup</changelog>
</package>
<package pkgid="d181fb3f832a11674cfb967026c5bed28ec763450f9ddda8bc9b326022e7419f" name="apache2-mod_auth_token-debugsource" arch="x86_64">
  <version epoch="0" ver="1.0.5" rel="13.3"/>
  <changelog author="crrodriguez@opensuse.org" date="1343822400">- Fix build, missing BUildRequires.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1344340800">- Fix per-module logging in apache 2.4</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443009600">- test with %apache_test_module_curl</changelog>
  <changelog author="pgajdos@suse.com" date="1443700800">- do not %check for Apache 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1443787200">- do %check for Apache 2.2 again</changelog>
  <changelog author="pgajdos@suse.com" date="1561636800">- use apache-rex in %check instead</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743508800">- replace %patchN with autosetup</changelog>
</package>
<package pkgid="4e492c312f20cd946726c7fc8bd46c9f577e712a5d0b1c0765c75df84bc6c1d7" name="apache2-mod_authn_dovecot" arch="src">
  <version epoch="0" ver="0.2.3" rel="4.3"/>
  <changelog author="boris@steki.net" date="1265889600">- Created inital rpm package</changelog>
  <changelog author="boris@steki.net" date="1267444800">- Updated package to version 0.2</changelog>
  <changelog author="boris@steki.net" date="1344340800">- updated to version 0.2.1
  * fixes for apache 2.4 added</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1433419200">- access configuration conditional
  + apache24-configuration.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443009600">- test with %apache_test_module_load</changelog>
  <changelog author="boris@steki.net" date="1453204800">- updated to latest release 0.2.2
  + Updated to include population of r-&gt;user field so
    other modules can see who is authenticated.
  + Cleanup of sensitive data from used memory
  + Enabled use of dovecot master user (impersonation) functionality
- removed patch for apache2 2.4 support as it is now in upstream package</changelog>
  <changelog author="lars@linux-schulserver.de" date="1576497600">- update to 0.2.3:
  + Added autoconf handling of programs and libraries.
  + No changes have been done to module itself
- added patches_to_master.patch, which includes 4 commits to master:
  + Include system error message in logged errors (de0fddf)
  + Prevent sun_path overflow and ensure null-termination (9c6eab3)
  + Handle asynchronous connection via EINPROGRESS (b12df24)
  + Improve connect handling (f0c4ea4)
- ran spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743508800">- replace obsolete %patchN</changelog>
</package>
<package pkgid="77c554a6dac74e8d644c5f61f04399fdf7539fc2ff5b51bb4011356bb65f75c9" name="apache2-mod_authn_dovecot" arch="x86_64">
  <version epoch="0" ver="0.2.3" rel="4.3"/>
  <changelog author="boris@steki.net" date="1267444800">- Updated package to version 0.2</changelog>
  <changelog author="boris@steki.net" date="1344340800">- updated to version 0.2.1
  * fixes for apache 2.4 added</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1433419200">- access configuration conditional
  + apache24-configuration.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443009600">- test with %apache_test_module_load</changelog>
  <changelog author="boris@steki.net" date="1453204800">- updated to latest release 0.2.2
  + Updated to include population of r-&gt;user field so
    other modules can see who is authenticated.
  + Cleanup of sensitive data from used memory
  + Enabled use of dovecot master user (impersonation) functionality
- removed patch for apache2 2.4 support as it is now in upstream package</changelog>
  <changelog author="lars@linux-schulserver.de" date="1576497600">- update to 0.2.3:
  + Added autoconf handling of programs and libraries.
  + No changes have been done to module itself
- added patches_to_master.patch, which includes 4 commits to master:
  + Include system error message in logged errors (de0fddf)
  + Prevent sun_path overflow and ensure null-termination (9c6eab3)
  + Handle asynchronous connection via EINPROGRESS (b12df24)
  + Improve connect handling (f0c4ea4)
- ran spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743508800">- replace obsolete %patchN</changelog>
</package>
<package pkgid="0cc7034b31b4ad5fbc28f8fcfa42e08d9c8c88dd5d915124b25c7c31f0340638" name="apache2-mod_authn_dovecot-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.2.3" rel="4.3"/>
  <changelog author="boris@steki.net" date="1267444800">- Updated package to version 0.2</changelog>
  <changelog author="boris@steki.net" date="1344340800">- updated to version 0.2.1
  * fixes for apache 2.4 added</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1433419200">- access configuration conditional
  + apache24-configuration.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443009600">- test with %apache_test_module_load</changelog>
  <changelog author="boris@steki.net" date="1453204800">- updated to latest release 0.2.2
  + Updated to include population of r-&gt;user field so
    other modules can see who is authenticated.
  + Cleanup of sensitive data from used memory
  + Enabled use of dovecot master user (impersonation) functionality
- removed patch for apache2 2.4 support as it is now in upstream package</changelog>
  <changelog author="lars@linux-schulserver.de" date="1576497600">- update to 0.2.3:
  + Added autoconf handling of programs and libraries.
  + No changes have been done to module itself
- added patches_to_master.patch, which includes 4 commits to master:
  + Include system error message in logged errors (de0fddf)
  + Prevent sun_path overflow and ensure null-termination (9c6eab3)
  + Handle asynchronous connection via EINPROGRESS (b12df24)
  + Improve connect handling (f0c4ea4)
- ran spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743508800">- replace obsolete %patchN</changelog>
</package>
<package pkgid="11cfc4548b3473f14595bb18932d0ba73ce6309ddf9e04b4825725e9fd3a10fd" name="apache2-mod_authn_dovecot-debugsource" arch="x86_64">
  <version epoch="0" ver="0.2.3" rel="4.3"/>
  <changelog author="boris@steki.net" date="1267444800">- Updated package to version 0.2</changelog>
  <changelog author="boris@steki.net" date="1344340800">- updated to version 0.2.1
  * fixes for apache 2.4 added</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1433419200">- access configuration conditional
  + apache24-configuration.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443009600">- test with %apache_test_module_load</changelog>
  <changelog author="boris@steki.net" date="1453204800">- updated to latest release 0.2.2
  + Updated to include population of r-&gt;user field so
    other modules can see who is authenticated.
  + Cleanup of sensitive data from used memory
  + Enabled use of dovecot master user (impersonation) functionality
- removed patch for apache2 2.4 support as it is now in upstream package</changelog>
  <changelog author="lars@linux-schulserver.de" date="1576497600">- update to 0.2.3:
  + Added autoconf handling of programs and libraries.
  + No changes have been done to module itself
- added patches_to_master.patch, which includes 4 commits to master:
  + Include system error message in logged errors (de0fddf)
  + Prevent sun_path overflow and ensure null-termination (9c6eab3)
  + Handle asynchronous connection via EINPROGRESS (b12df24)
  + Improve connect handling (f0c4ea4)
- ran spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743508800">- replace obsolete %patchN</changelog>
</package>
<package pkgid="e5844c7808059da79a6c64d08083c24c5d3777fb6fc26411c472f0237c83f3d1" name="apache2-mod_authn_otp" arch="src">
  <version epoch="0" ver="1.1.12" rel="40.2"/>
  <changelog author="draht@suse.de" date="1299153600">- upgrade to build fix release 1.1.1</changelog>
  <changelog author="archie@dellroad.org" date="1354017600">- Upgrade to version 1.1.4
  + Always allow stale time-based offsets to re-synchronize (issue #14)
  + Added "OTPAuthMaxOTPFailure" to lock accounts after repeated wrong OTP's
  + Fixed bug with "OTPAuthPINAuthProvider" and &lt;AuthnProviderAlias&gt;
  + Added "OTPAuthPINAuthProvider" to allow alternate verification of PINs
  + Added "OTPAuthLogoutOnIPChange" flag to auto-logout on IP address change</changelog>
  <changelog author="archie@dellroad.org" date="1354276800">- Update to version 1.1.5
  + Allow building on systems without strptime(3) (e.g., Windows)
  + Add support for Apache 2.4.x</changelog>
  <changelog author="archie@dellroad.org" date="1364990400">- Update to version 1.1.6
  + Detect errors when writing to the new users.txt file
  + Fix (harmless) bug where new users.txt file was not being closed
- Use correct license string in spec file
- Add copyright notice to spec file</changelog>
  <changelog author="archie@dellroad.org" date="1400328000">- Update to version 1.1.7
  + Fixed bug where users file could get deleted when using Apache worker MPM (issue #22)
  + Added "OTPAuthFallThrough" to allow fall through to other auth providers (issue #23)
  + Allow "logout" by sending empty password (issue #24)
  + Count PINs against OTPAuthMaxOTPFailure even when they have the wrong length</changelog>
  <changelog author="tchvatal@suse.com" date="1401278400">- Fix source download url.</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443182400">- test module with %apache_test_module_curl</changelog>
  <changelog author="pgajdos@suse.com" date="1443700800">- do not %check for apache 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1443960000">- %check for apache 2.2 again</changelog>
  <changelog author="pgajdos@suse.com" date="1449835200">- %{apache_branch} converted to number</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1509364800">- Update to version 1.1.8
  + Added PINFakeBasicAuth configuration option</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1561204800">- Update to version 1.1.9
  + Added genotpurl(1) utility
  + Added "-F" flag to otptool(1).</changelog>
  <changelog author="pgajdos@suse.com" date="1561550400">- testing with apache-rex instead</changelog>
  <changelog author="rpm@fthiessen.de" date="1619179200">- Fixed SPEC file: Replaced broken URL and minor cleanup</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1651665600">- Update to version 1.1.10
  + Fixed bug in genotpurl on platforms with signed "char" (pr #46)
  + Added "-K" flag to genotpurl tool to specify key length (pr #43)
  + Update spec file description to include genotpurl(1)</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1719489600">- Update to version 1.1.11
  + Fixed build issue with libapr on some systems (issue #48)
  + Added otplock(1) utility (issue #38)</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1753531200">- Update to version 1.1.12
  + Added "OTPAuthMaxIdle" as an alternative to "OTPAuthMaxLinger" (issue #51).
  + Refactor to avoid warnings and reduce code duplication (issue #49).
  + Use pkg-config to find openssl and libapr (#50).</changelog>
</package>
<package pkgid="5269abd0722a6968d47b3d0ba7019068d8e0d88218ad19e45d2f9927b60e8c34" name="apache2-mod_authn_otp" arch="x86_64">
  <version epoch="0" ver="1.1.12" rel="40.2"/>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443182400">- test module with %apache_test_module_curl</changelog>
  <changelog author="pgajdos@suse.com" date="1443700800">- do not %check for apache 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1443960000">- %check for apache 2.2 again</changelog>
  <changelog author="pgajdos@suse.com" date="1449835200">- %{apache_branch} converted to number</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1509364800">- Update to version 1.1.8
  + Added PINFakeBasicAuth configuration option</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1561204800">- Update to version 1.1.9
  + Added genotpurl(1) utility
  + Added "-F" flag to otptool(1).</changelog>
  <changelog author="pgajdos@suse.com" date="1561550400">- testing with apache-rex instead</changelog>
  <changelog author="rpm@fthiessen.de" date="1619179200">- Fixed SPEC file: Replaced broken URL and minor cleanup</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1651665600">- Update to version 1.1.10
  + Fixed bug in genotpurl on platforms with signed "char" (pr #46)
  + Added "-K" flag to genotpurl tool to specify key length (pr #43)
  + Update spec file description to include genotpurl(1)</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1719489600">- Update to version 1.1.11
  + Fixed build issue with libapr on some systems (issue #48)
  + Added otplock(1) utility (issue #38)</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1753531200">- Update to version 1.1.12
  + Added "OTPAuthMaxIdle" as an alternative to "OTPAuthMaxLinger" (issue #51).
  + Refactor to avoid warnings and reduce code duplication (issue #49).
  + Use pkg-config to find openssl and libapr (#50).</changelog>
</package>
<package pkgid="acae30e3f6e85eb0ad1a2fba7b6b6a88a9a08e07d37aac12216b74917ceae4d7" name="apache2-mod_authnz_external" arch="src">
  <version epoch="0" ver="3.3.2" rel="8.3"/>
  <changelog author="mrueckert@suse.de" date="1146225600">- Initial package of version 3.1.0</changelog>
  <changelog author="poeml@suse.de" date="1213099200">- build service supports the debuginfo flag in metadata now; remove
  debug_package macro from the specfile therefore.</changelog>
  <changelog author="pieter@hollants.com" date="1361102400">- update to version 3.2.6 (latest version for Apache 2.2):
  - Rewrite of external authenticator launching code to use Apache's
    cross-OS process/thread library
  - Support for AuthExternalContext and GroupExternalError directives
  - Dropped RADIUS code due to licensing issues
  - AuthExternal now supports calling multiple authenticators
  - Correct SQL injection flaw in sample MySQL authenticator
  - Improved documentation and cleanups</changelog>
  <changelog author="asvetter@cip.physik.uni-wuerzburg.de" date="1391428800">- update to v3.3.2 (latest version for Apache 2.4)
  - Replaced reference to remote_ip field of the connection record with
  useragent_ip, due to the elimination of remote_ip in Apache 2.4.1. Thanks
  to davidsansome and cjwatson for pointing out the need for this.
  - Fixed a bug with setting of GROUP environment variable. Thanks to
  ddarbyson for reporting this, and Guoan Hu for posting the fix.
  - Added test/test.pipe.php, a PHP version of test/test.pipe contributed</changelog>
  <changelog author="asvetter@cip.physik.uni-wuerzburg.de" date="1391515200">- added Requires: apache2 &gt; 2.3</changelog>
  <changelog author="asvetter@cip.physik.uni-wuerzburg.de" date="1395230400">- changed source from _service to a real file</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443182400">- test module with %apache_test_module_curl</changelog>
  <changelog author="pgajdos@suse.com" date="1443960000">- module is not compatible with Apache 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1561723200">- test via apache-rex in %check</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
</package>
<package pkgid="b5fb510d4445f40df1360edee545c6b3cf6540f2373c599f9b8de419b67f7c17" name="apache2-mod_authnz_external" arch="x86_64">
  <version epoch="0" ver="3.3.2" rel="8.3"/>
  <changelog author="pieter@hollants.com" date="1361102400">- update to version 3.2.6 (latest version for Apache 2.2):
  - Rewrite of external authenticator launching code to use Apache's
    cross-OS process/thread library
  - Support for AuthExternalContext and GroupExternalError directives
  - Dropped RADIUS code due to licensing issues
  - AuthExternal now supports calling multiple authenticators
  - Correct SQL injection flaw in sample MySQL authenticator
  - Improved documentation and cleanups</changelog>
  <changelog author="asvetter@cip.physik.uni-wuerzburg.de" date="1391428800">- update to v3.3.2 (latest version for Apache 2.4)
  - Replaced reference to remote_ip field of the connection record with
  useragent_ip, due to the elimination of remote_ip in Apache 2.4.1. Thanks
  to davidsansome and cjwatson for pointing out the need for this.
  - Fixed a bug with setting of GROUP environment variable. Thanks to
  ddarbyson for reporting this, and Guoan Hu for posting the fix.
  - Added test/test.pipe.php, a PHP version of test/test.pipe contributed</changelog>
  <changelog author="asvetter@cip.physik.uni-wuerzburg.de" date="1391515200">- added Requires: apache2 &gt; 2.3</changelog>
  <changelog author="asvetter@cip.physik.uni-wuerzburg.de" date="1395230400">- changed source from _service to a real file</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443182400">- test module with %apache_test_module_curl</changelog>
  <changelog author="pgajdos@suse.com" date="1443960000">- module is not compatible with Apache 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1561723200">- test via apache-rex in %check</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
</package>
<package pkgid="25f20193b68adae30f59ec352543e89e600f4f8fac1f47b6c66ac921aa0f535c" name="apache2-mod_authnz_external-debuginfo" arch="x86_64">
  <version epoch="0" ver="3.3.2" rel="8.3"/>
  <changelog author="pieter@hollants.com" date="1361102400">- update to version 3.2.6 (latest version for Apache 2.2):
  - Rewrite of external authenticator launching code to use Apache's
    cross-OS process/thread library
  - Support for AuthExternalContext and GroupExternalError directives
  - Dropped RADIUS code due to licensing issues
  - AuthExternal now supports calling multiple authenticators
  - Correct SQL injection flaw in sample MySQL authenticator
  - Improved documentation and cleanups</changelog>
  <changelog author="asvetter@cip.physik.uni-wuerzburg.de" date="1391428800">- update to v3.3.2 (latest version for Apache 2.4)
  - Replaced reference to remote_ip field of the connection record with
  useragent_ip, due to the elimination of remote_ip in Apache 2.4.1. Thanks
  to davidsansome and cjwatson for pointing out the need for this.
  - Fixed a bug with setting of GROUP environment variable. Thanks to
  ddarbyson for reporting this, and Guoan Hu for posting the fix.
  - Added test/test.pipe.php, a PHP version of test/test.pipe contributed</changelog>
  <changelog author="asvetter@cip.physik.uni-wuerzburg.de" date="1391515200">- added Requires: apache2 &gt; 2.3</changelog>
  <changelog author="asvetter@cip.physik.uni-wuerzburg.de" date="1395230400">- changed source from _service to a real file</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443182400">- test module with %apache_test_module_curl</changelog>
  <changelog author="pgajdos@suse.com" date="1443960000">- module is not compatible with Apache 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1561723200">- test via apache-rex in %check</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
</package>
<package pkgid="2b706b83a24410f5555c81f25fcfb843ca9af97d65a002874c2668ff08eaf923" name="apache2-mod_authnz_external-debugsource" arch="x86_64">
  <version epoch="0" ver="3.3.2" rel="8.3"/>
  <changelog author="pieter@hollants.com" date="1361102400">- update to version 3.2.6 (latest version for Apache 2.2):
  - Rewrite of external authenticator launching code to use Apache's
    cross-OS process/thread library
  - Support for AuthExternalContext and GroupExternalError directives
  - Dropped RADIUS code due to licensing issues
  - AuthExternal now supports calling multiple authenticators
  - Correct SQL injection flaw in sample MySQL authenticator
  - Improved documentation and cleanups</changelog>
  <changelog author="asvetter@cip.physik.uni-wuerzburg.de" date="1391428800">- update to v3.3.2 (latest version for Apache 2.4)
  - Replaced reference to remote_ip field of the connection record with
  useragent_ip, due to the elimination of remote_ip in Apache 2.4.1. Thanks
  to davidsansome and cjwatson for pointing out the need for this.
  - Fixed a bug with setting of GROUP environment variable. Thanks to
  ddarbyson for reporting this, and Guoan Hu for posting the fix.
  - Added test/test.pipe.php, a PHP version of test/test.pipe contributed</changelog>
  <changelog author="asvetter@cip.physik.uni-wuerzburg.de" date="1391515200">- added Requires: apache2 &gt; 2.3</changelog>
  <changelog author="asvetter@cip.physik.uni-wuerzburg.de" date="1395230400">- changed source from _service to a real file</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1443182400">- test module with %apache_test_module_curl</changelog>
  <changelog author="pgajdos@suse.com" date="1443960000">- module is not compatible with Apache 2.2</changelog>
  <changelog author="pgajdos@suse.com" date="1561723200">- test via apache-rex in %check</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
</package>
<package pkgid="7caabd4e4962e7b72724c1a0d20887950cd9151b86f03f7c22f970e4d66b3e47" name="apache2-mod_evasive" arch="src">
  <version epoch="0" ver="1.10.1" rel="48.3"/>
  <changelog author="jengelh@inai.de" date="1345809600">- Initial package (version 1.10.1) for build.opensuse.org</changelog>
  <changelog author="jengelh@inai.de" date="1346673600">- License clarification in specfile comment</changelog>
  <changelog author="dimstar@opensuse.org" date="1359374400">- Introduce compatibility with Apache 2.4 (changed API: remote_ip
  was renamed to client_ip):
  + apxs2 was moved from %{_sbindir} to %{_bindir}: use "which" to
    actually find it.
  + Set apache_branch to $major.$minor, so it can be used for
    evaluation further down.
  + set ap_suffix and rename the .so modules to mod_evasive24.so
    when building for apache 2.4.x API.
- Fix the requires on apache_mmn: this only worked becuase the
  Requires was on one line.. but %apache_mmn was always empty.</changelog>
  <changelog author="pgajdos@suse.com" date="1413288000">- fixed module loading [bnc#865567], [bnc#867984]</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- use apache rpm macros</changelog>
  <changelog author="jengelh@inai.de" date="1415620800">- Add mail-invocation.diff: Use -t parameter with the mail program
  [boo#884877]; add recommends on mailx so that that can work</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441022400">- test module with %apache_test_module</changelog>
  <changelog author="pgajdos@suse.com" date="1449835200">- %{apache_branch} converted to number</changelog>
  <changelog author="jengelh@inai.de" date="1571313600">- Update homepage URL.</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="jengelh@inai.de" date="1650456000">- Trim duplicate LoadModule [boo#1198570]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- remove unneeded pcre build dependency</changelog>
</package>
<package pkgid="3784c7746c80a9e7bc7f8b48480feb3bedf7a8aa69c921f60e3f430704fc3f33" name="apache2-mod_evasive" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="48.3"/>
  <changelog author="pgajdos@suse.com" date="1413288000">- fixed module loading [bnc#865567], [bnc#867984]</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- use apache rpm macros</changelog>
  <changelog author="jengelh@inai.de" date="1415620800">- Add mail-invocation.diff: Use -t parameter with the mail program
  [boo#884877]; add recommends on mailx so that that can work</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441022400">- test module with %apache_test_module</changelog>
  <changelog author="pgajdos@suse.com" date="1449835200">- %{apache_branch} converted to number</changelog>
  <changelog author="jengelh@inai.de" date="1571313600">- Update homepage URL.</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="jengelh@inai.de" date="1650456000">- Trim duplicate LoadModule [boo#1198570]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- remove unneeded pcre build dependency</changelog>
</package>
<package pkgid="36ebe0e91f930da3b9b22a3b0bd897bc11985425e86407965c0d8ebc647a4a2d" name="apache2-mod_evasive-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="48.3"/>
  <changelog author="pgajdos@suse.com" date="1413288000">- fixed module loading [bnc#865567], [bnc#867984]</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- use apache rpm macros</changelog>
  <changelog author="jengelh@inai.de" date="1415620800">- Add mail-invocation.diff: Use -t parameter with the mail program
  [boo#884877]; add recommends on mailx so that that can work</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441022400">- test module with %apache_test_module</changelog>
  <changelog author="pgajdos@suse.com" date="1449835200">- %{apache_branch} converted to number</changelog>
  <changelog author="jengelh@inai.de" date="1571313600">- Update homepage URL.</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="jengelh@inai.de" date="1650456000">- Trim duplicate LoadModule [boo#1198570]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- remove unneeded pcre build dependency</changelog>
</package>
<package pkgid="22a46151c5ab1ee317d06a09ddde5536b52ebecc1b61033a29f48c68b8adb6f9" name="apache2-mod_evasive-debugsource" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="48.3"/>
  <changelog author="pgajdos@suse.com" date="1413288000">- fixed module loading [bnc#865567], [bnc#867984]</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- use apache rpm macros</changelog>
  <changelog author="jengelh@inai.de" date="1415620800">- Add mail-invocation.diff: Use -t parameter with the mail program
  [boo#884877]; add recommends on mailx so that that can work</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441022400">- test module with %apache_test_module</changelog>
  <changelog author="pgajdos@suse.com" date="1449835200">- %{apache_branch} converted to number</changelog>
  <changelog author="jengelh@inai.de" date="1571313600">- Update homepage URL.</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="jengelh@inai.de" date="1650456000">- Trim duplicate LoadModule [boo#1198570]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- remove unneeded pcre build dependency</changelog>
</package>
<package pkgid="677ef4de6a2165a80ac873e4ce62f9c33738a766a4624e2d294656293cd0dead" name="apache2-mod_fcgid" arch="src">
  <version epoch="0" ver="2.3.9" rel="65.4"/>
  <changelog author="mrueckert@suse.de" date="1193745600">- update to version 2.2
  - Support configuration "PassHeader". Thank Hans Christian
    Saustrup for the suggestion.
  - Support apr_shm_remove() in httpd.2.0.X. Thank Hans Christian
    Saustrup for bug report.
  - Support configuration "TimeScore". Thank Tim Jensen for the
    patch.
  - Support new configurations "MaxRequestInMem" and
    "MaxRequestLen"
  - If the length of http request longer than "MaxRequestInMem",
    it will store in tmp file.
  - It the length of http request longer than "MaxRequestLen", it
    will return internal server error.
    Thank Gabriel Barazer(gabriel at oxeva.fr) for the bug report.
    Thank Steffen(info at apachelounge.com) for the help on this
    issue.
  - Fix miner Sanity check bug. Thank Yuya Tanaka for bug report
- added SharememPath to the config (#337566)</changelog>
  <changelog author="mrueckert@suse.de" date="1204891200">- added directory for the sharedmemory path and the sockets
  (bnc#365113)</changelog>
  <changelog author="mrueckert@suse.de" date="1281009600">- update to version 2.3.5
  mod_fcgid is now an official apache project. During the migration
  the name of the configuration directives has changed. Please see
  /usr/share/doc/packages/apache2-mod_fcgid/CHANGES-FCGID
  to update your config to the new version.
- adapted config to the new directives</changelog>
  <changelog author="poeml@cmdline.net" date="1291464000">- update to 2.3.6
  * ) SECURITY: CVE-2010-3872 (cve.mitre.org)
    Fix possible stack buffer overwrite.
  * ) Change the default for FcgidMaxRequestLen from 1GB to 128K.
    Administrators should change this to an appropriate value based on
    site requirements.
  * ) Allow FastCGI apps more time to exit at shutdown before being
    forcefully killed.
  ...and more fixes, see
  http://svn.apache.org/viewvc/httpd/mod_fcgid/tags/2.3.6/CHANGES-FCGID?view=markup
- adjust the somewhat outdated example config file</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1329134400">- patch license to follow spdx.org standard</changelog>
  <changelog author="dimstar@opensuse.org" date="1359374400">- Fix build with apache 2.4: apxs2 moved from %{_sbindir} to
  %{_bindir}.</changelog>
  <changelog author="dimstar@opensuse.org" date="1363089600">- Update to version 2.3.7:
  + Introduce FcgidWin32PreventOrphans directive on Windows to use
    OS Job Control Objects to terminate all running fcgi's when the
    worker process has been abruptly terminated.
  + Periodically clean out the brigades which are pulling in the
    request body for handoff to the fcgid child.
  + Resolve crash during graceful restarts.
  + Solve latency/cogestion of resolving effective user file access
    rights when no such info is desired, for config related
    filename stats.
  + Fix regression in 2.3.6 which broke process controls when using
    vhost-specific configuration.
  + Account for first process in class in the spawn score.
- Really fix build with apache 2.4: redefining apxs to %{_sbindir}
  after the branch-check is just wrong.</changelog>
  <changelog author="draht@suse.de" date="1382356800">- Intermediate fix for openSUSE:Factory eg. openSUSE:13.1:
  apache2-mod_fcgid-CVE-2013-4365-bnc844935.diff fixes a heap
  overflow identified by CVE-2013-4365 [bnc#844935].
  This patch will be obsoleted by the next version update (to
  2.3.9 or higher).</changelog>
  <changelog author="draht@suse.de" date="1383739200">- update to 2.3.9:
  + obsoletes apache2-mod_fcgid-CVE-2013-4365-bnc844935.diff
    and fixes CVE-2013-4365 [bnc#844935] (heap overflow).
    The heap overflow discovery and fix was done by
    Robert Matthews &lt;rob tigertech.com&gt;.
  + quoting and spaces parsing correction for FcgidWrapper directive
    and commandline options.
  + logging improvements for access controls
  + remove redundant processing of Location headers when running in
    FCGI_AUTHORIZER mode</changelog>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441281600">- test module with %apache_test_module_load</changelog>
  <changelog author="kstreitova@suse.com" date="1469620800">- add mod_fcgid-2.3.9-CVE-2016-1000104.patch - don't allow setting
  the HTTP_PROXY environment variable from a http header
  [CVE-2016-1000104], [bsc#988492]
- run spec-cleaner to clean specfile</changelog>
  <changelog author="pgajdos@suse.com" date="1489406400">- add a true example to %check</changelog>
  <changelog author="pgajdos@suse.com" date="1494590400">- amend example in %check to see how output to stderr get
  logged in error_log</changelog>
  <changelog author="pgajdos@suse.com" date="1561464000">- test via apache-rex instead</changelog>
  <changelog author="pgajdos@suse.com" date="1606305600">- use /usr/sbin/apxs for build, not -prefork</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
</package>
<package pkgid="ede34bfb9774caca1aea74e256847a5ca65af678737f5e629d2a7fcf36eaaa7d" name="apache2-mod_fcgid" arch="x86_64">
  <version epoch="0" ver="2.3.9" rel="65.4"/>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441281600">- test module with %apache_test_module_load</changelog>
  <changelog author="kstreitova@suse.com" date="1469620800">- add mod_fcgid-2.3.9-CVE-2016-1000104.patch - don't allow setting
  the HTTP_PROXY environment variable from a http header
  [CVE-2016-1000104], [bsc#988492]
- run spec-cleaner to clean specfile</changelog>
  <changelog author="pgajdos@suse.com" date="1489406400">- add a true example to %check</changelog>
  <changelog author="pgajdos@suse.com" date="1494590400">- amend example in %check to see how output to stderr get
  logged in error_log</changelog>
  <changelog author="pgajdos@suse.com" date="1561464000">- test via apache-rex instead</changelog>
  <changelog author="pgajdos@suse.com" date="1606305600">- use /usr/sbin/apxs for build, not -prefork</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
</package>
<package pkgid="ada3e76b03ff65bec516ec77610d5073c32fb876781e4aadc92de5c4534818c2" name="apache2-mod_fcgid-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.3.9" rel="65.4"/>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441281600">- test module with %apache_test_module_load</changelog>
  <changelog author="kstreitova@suse.com" date="1469620800">- add mod_fcgid-2.3.9-CVE-2016-1000104.patch - don't allow setting
  the HTTP_PROXY environment variable from a http header
  [CVE-2016-1000104], [bsc#988492]
- run spec-cleaner to clean specfile</changelog>
  <changelog author="pgajdos@suse.com" date="1489406400">- add a true example to %check</changelog>
  <changelog author="pgajdos@suse.com" date="1494590400">- amend example in %check to see how output to stderr get
  logged in error_log</changelog>
  <changelog author="pgajdos@suse.com" date="1561464000">- test via apache-rex instead</changelog>
  <changelog author="pgajdos@suse.com" date="1606305600">- use /usr/sbin/apxs for build, not -prefork</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
</package>
<package pkgid="345fa55422ae1752004887edba59a5b05e336ffb5c617d419c228aa0e6ba9a41" name="apache2-mod_fcgid-debugsource" arch="x86_64">
  <version epoch="0" ver="2.3.9" rel="65.4"/>
  <changelog author="pgajdos@suse.com" date="1414756800">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441281600">- test module with %apache_test_module_load</changelog>
  <changelog author="kstreitova@suse.com" date="1469620800">- add mod_fcgid-2.3.9-CVE-2016-1000104.patch - don't allow setting
  the HTTP_PROXY environment variable from a http header
  [CVE-2016-1000104], [bsc#988492]
- run spec-cleaner to clean specfile</changelog>
  <changelog author="pgajdos@suse.com" date="1489406400">- add a true example to %check</changelog>
  <changelog author="pgajdos@suse.com" date="1494590400">- amend example in %check to see how output to stderr get
  logged in error_log</changelog>
  <changelog author="pgajdos@suse.com" date="1561464000">- test via apache-rex instead</changelog>
  <changelog author="pgajdos@suse.com" date="1606305600">- use /usr/sbin/apxs for build, not -prefork</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1718884800">- drop unmaintained apache-rex usage</changelog>
</package>
<package pkgid="7d95c481c0fdb9ae41f041bf3d28507061abd79f0bc5f5ef54265450734a1415" name="apache2-mod_jk" arch="src">
  <version epoch="0" ver="1.2.50" rel="98.2"/>
  <changelog author="pgajdos@suse.com" date="1433419200">- access configuration conditional in jk.conf example</changelog>
  <changelog author="tchvatal@suse.com" date="1433419201">- Apply patch to fix bnc#927845 CVE-2014-8111 VUL-1: apache2-mod_jk: Tomcat
  mod_jk information leak due to incorrect JkMount/JkUnmount directives
  processing:
  * apache2-mod_jk-CVE-2014-8111.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441800000">- test package with %apache_test_module_load</changelog>
  <changelog author="tchvatal@suse.com" date="1453291200">- Version update to 1.2.41:
  * remove merged patch apache2-mod_jk-CVE-2014-8111.patch
  * many small bugfixes all around:
    + http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html</changelog>
  <changelog author="tchvatal@suse.com" date="1495281600">- Just depend on java-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1517486400">- Version update to 1.2.42:
  * Many small fixes
  * Optimalization for new gccs
  * Minor code cleanups</changelog>
  <changelog author="tchvatal@suse.com" date="1518523200">- Disable tests for now as the default profile is not working
  properly to load up and upstream should update the sample</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Update to version 1.2.43 [bsc#1085220, CVE-2018-1323]
  * LB: Propagate load factor changes applied by the status worker
    to a load balancer sub worker correctly to all processes.
  * ISAPI: Align the make files for 32-bit and 64-bit builds.
  * Update config.guess and config.sub
  * Update PCRE bundled with the ISAPI redirector to 8.41.
  * Update the ISAPI redirector installation documentation to
    reflect the currently supported versions of Windows.
  * Align the normalization performed by the ISAPI redirector with
    that implemented by Tomcat.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1537358400">- Update to version 1.2.44
  Updates:
  * Remove the Novell Netware make files and Netware specific source
    code since there has not been a supported version of Netware
    available for over five years. (markt)
  * Apache: Update the documentation to use httpd 2.4.x style access
    control directives. (markt)
  * Update PCRE bundled with the ISAPI redirector to 8.42. (rjung)
  * Update config.guess and config.sub from
    https://git.savannah.gnu.org/git/config.git. (rjung)
  Fixes:
  * Common: Use Local, rather than Global, mutexs on Windows to
    better support multi-user environments. (markt)
  * Apache: Use poll rather than select to avoid the limitations of
    select triggering an httpd crash. Patch provided by Koen Wilde. (markt)
  * ISAPI: Remove the check that rejects requests that contain path
    segments that match WEB-INF or META-INF as it duplicates a check
    that Tomcat performs and, because ISAPI does not have visibility of
    the current context path, it is impossible to implement this check
    without valid requests being rejected. (markt)
  * Refactor normalisation of request URIs to a common location and align
    the normalisation implementation for mod_jk with that implemented by
    Tomcat. (markt)
  Add:
  * Clarify the behvaiour of lb workers when all ajp13 workers fail with
    particular reference to the role of the retries attribute. (markt)
  * Add the new load-balancer worker property lb_retries to improve the
    control over the number of retries. Based on a patch provided by
    Frederik Nosi. (markt)
  * Add a note to the documentation that the CollapseSlashes options are
    now effectively hard-coded to CollpaseSlashesAll due to the changes
    made to align normalization with that implemented in Tomcat. (markt)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1541419200">- Update to version 1.2.46
  Fixes:
  * Apache: Fix regression in 1.2.44 which resulted in
    socket_connect_timeout to be interpreted in units of seconds
    instead of milliseconds on platforms that provide poll(). (rjung)
  * Security: CVE-2018-11759 Connector path traversal [bsc#1114612]
- Update to version 1.2.45
  Fixes:
  * Correct regression in 1.2.44 that broke request handling for
    OPTIONS * requests. (rjung)
  * Improve path parameter parsing so that the session ID specified
    by the session_path worker property for load-balanced workers
    can be extracted from a path parameter in any segment of the
    URI, rather than only from the final segment. (markt)
  * Apache: Improve path parameter handling so that JkStripSession
    can remove session IDs that are specified on path parameters in any
    segment of the URI rather than only the final segment. (markt)
  * IIS: Improve path parameter handling so that strip_session can
    remove session IDs that are specified on path parameters in any
    segment of the URI rather than only the final segment. (markt)
  Updates:
  * Apache: Update the documentation to note additional
    limitations of the JkAutoAlias directive. (markt)
  Code:
  * Common: Optimize path parameter handling. (rjung)
- Cleaned with spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- remove useless %check section</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589198400">- Changes for 1.2.47 and 1.2.48 updates:
  * Add: Apache: Extend trace level logging of method entry/exit to
    aid debugging of request mapping issues.
  * Fix: Apache: Fix a bug in the normalization checks that prevented
    file based requests, such as SSI file includes, from being processed.
  * Fix: Apache: When using JkAutoAlias, ensure that files that include
    spaces in their name are accessible.
  * Update: Common: Update the documentation to reflect that the source
    code for the Apache Tomcat Connectors has moved from Subversion to Git.
  * Fix: Common: When using set_session_cookie, ensure that an updated session
    cookie is issued if the load-balancer has to failover to a different worker.
  * Update: Common: Update config.guess and config.sub from
    https://git.savannah.gnu.org/git/config.git.
  * Update: Common: Update release script for migration to git.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589198401">- Fix Aliases to be compatible with the tomcat example URLs [bsc#1167896]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589803200">- Update jk.conf: [bsc#1167896]
  * Specify the location of JkShmFile.
  * Update tomcat-webapps paths.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to version 1.2.49:
  Apache
  * Retrieve default request id from mod_unique_id. It can also be
    taken from an arbitrary environment variable by configuring
    "JkRequestIdIndicator".
  * Don't delegate the generation of the response body to httpd
    when the status code represents an error if the request used
    the HEAD method.
  * Only export the main module symbol. Visibility of module
    internal symbols led to crashes when conflicting with library
    symbols. Based on a patch provided by Josef Čejka. (wrong fix
    was applied for bsc#1206261)
  * Remove support for implicit mapping of requests to workers.
    All mappings must now be explicit.
  IIS
  * Set default request id as a GUID. It can also be taken from an
    arbitrary request header by configuring "request_id_header".
  * Fix non-empty check for the Translate header.
  Common
  * Fix compiler warning when initializing and copying fixed
    length strings.
  * Add a request id to mod_jk log lines.
  * Enable configure to find the correct sizes for pid_t and
    pthread_t when building on MacOS.
  * Fix Clang 15/16 compatibility. Pull request #6 provided by
    Sam James.
  * Improve XSS hardening in status worker.
  * Add additional bounds and error checking when reading AJP
    messages.
  Docs
  * Remove support for the Netscape / Sun ONE / Oracle iPlanet Web
    Server as the product has been retired.
  * Remove links to the old JK2 documentation. The JK2
    documentation is still available, it is just no longer linked
    from the current JK documentation.
  * Restructure subsections in changelog starting with version
    1.2.45.</changelog>
  <changelog author="david.anes@suse.com" date="1703160000">- Add apache2-fix-symbol-export-typo.patch to fix a typo to restrict
  the symbols to export by the module. Fixes bsc#1206261.</changelog>
  <changelog author="gus.kenion@suse.com" date="1729512000">- Update to version 1.2.50:
  * Apache
    + Fix: 68117: Fix typo in new libtool flag introduced in
    1.2.49 to reduce symbol visibility. Also improve escaping
    of it in the Makefile.
    +  Fix: Improve shared memory handling on non-Windows.
  * IIS
    + Update: Update PCRE bundled with the ISAPI redirector to
    8.45.
  * Common
    + Fix: #8: Fix compilation on musl.
    + Update: Update config.guess and config.sub
- Remove apache2-fix-symbol-export-typo.patch - this upstream fix
  is included in 1.2.50</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- drop unneeded pcre build requirement</changelog>
  <changelog author="dimstar@opensuse.org" date="1756296000">- Minor tweak to the shipped jk.conf (boo#1239178):
  + Set JkLogFile to /var/log/apache/jk.conf: as this is written by
    apache, the previous location /var/log/tomcat is not permitted
  + Set JkShmFile to /var/lib/apache2/jk-runtime-status: again,
    /var/log/tomcat is no suitable location, as mod_jk is running
    as apache's user. Moving it to /var/log does not make sense, as
    SHM is not a log file.</changelog>
</package>
<package pkgid="9ee0bd52efa6d1f40e044dcb63357ef8de345c2a58e64bb0ae85b3fb1257be23" name="apache2-mod_jk" arch="x86_64">
  <version epoch="0" ver="1.2.50" rel="98.2"/>
  <changelog author="pgajdos@suse.com" date="1433419200">- access configuration conditional in jk.conf example</changelog>
  <changelog author="tchvatal@suse.com" date="1433419201">- Apply patch to fix bnc#927845 CVE-2014-8111 VUL-1: apache2-mod_jk: Tomcat
  mod_jk information leak due to incorrect JkMount/JkUnmount directives
  processing:
  * apache2-mod_jk-CVE-2014-8111.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441800000">- test package with %apache_test_module_load</changelog>
  <changelog author="tchvatal@suse.com" date="1453291200">- Version update to 1.2.41:
  * remove merged patch apache2-mod_jk-CVE-2014-8111.patch
  * many small bugfixes all around:
    + http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html</changelog>
  <changelog author="tchvatal@suse.com" date="1495281600">- Just depend on java-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1517486400">- Version update to 1.2.42:
  * Many small fixes
  * Optimalization for new gccs
  * Minor code cleanups</changelog>
  <changelog author="tchvatal@suse.com" date="1518523200">- Disable tests for now as the default profile is not working
  properly to load up and upstream should update the sample</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Update to version 1.2.43 [bsc#1085220, CVE-2018-1323]
  * LB: Propagate load factor changes applied by the status worker
    to a load balancer sub worker correctly to all processes.
  * ISAPI: Align the make files for 32-bit and 64-bit builds.
  * Update config.guess and config.sub
  * Update PCRE bundled with the ISAPI redirector to 8.41.
  * Update the ISAPI redirector installation documentation to
    reflect the currently supported versions of Windows.
  * Align the normalization performed by the ISAPI redirector with
    that implemented by Tomcat.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1537358400">- Update to version 1.2.44
  Updates:
  * Remove the Novell Netware make files and Netware specific source
    code since there has not been a supported version of Netware
    available for over five years. (markt)
  * Apache: Update the documentation to use httpd 2.4.x style access
    control directives. (markt)
  * Update PCRE bundled with the ISAPI redirector to 8.42. (rjung)
  * Update config.guess and config.sub from
    https://git.savannah.gnu.org/git/config.git. (rjung)
  Fixes:
  * Common: Use Local, rather than Global, mutexs on Windows to
    better support multi-user environments. (markt)
  * Apache: Use poll rather than select to avoid the limitations of
    select triggering an httpd crash. Patch provided by Koen Wilde. (markt)
  * ISAPI: Remove the check that rejects requests that contain path
    segments that match WEB-INF or META-INF as it duplicates a check
    that Tomcat performs and, because ISAPI does not have visibility of
    the current context path, it is impossible to implement this check
    without valid requests being rejected. (markt)
  * Refactor normalisation of request URIs to a common location and align
    the normalisation implementation for mod_jk with that implemented by
    Tomcat. (markt)
  Add:
  * Clarify the behvaiour of lb workers when all ajp13 workers fail with
    particular reference to the role of the retries attribute. (markt)
  * Add the new load-balancer worker property lb_retries to improve the
    control over the number of retries. Based on a patch provided by
    Frederik Nosi. (markt)
  * Add a note to the documentation that the CollapseSlashes options are
    now effectively hard-coded to CollpaseSlashesAll due to the changes
    made to align normalization with that implemented in Tomcat. (markt)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1541419200">- Update to version 1.2.46
  Fixes:
  * Apache: Fix regression in 1.2.44 which resulted in
    socket_connect_timeout to be interpreted in units of seconds
    instead of milliseconds on platforms that provide poll(). (rjung)
  * Security: CVE-2018-11759 Connector path traversal [bsc#1114612]
- Update to version 1.2.45
  Fixes:
  * Correct regression in 1.2.44 that broke request handling for
    OPTIONS * requests. (rjung)
  * Improve path parameter parsing so that the session ID specified
    by the session_path worker property for load-balanced workers
    can be extracted from a path parameter in any segment of the
    URI, rather than only from the final segment. (markt)
  * Apache: Improve path parameter handling so that JkStripSession
    can remove session IDs that are specified on path parameters in any
    segment of the URI rather than only the final segment. (markt)
  * IIS: Improve path parameter handling so that strip_session can
    remove session IDs that are specified on path parameters in any
    segment of the URI rather than only the final segment. (markt)
  Updates:
  * Apache: Update the documentation to note additional
    limitations of the JkAutoAlias directive. (markt)
  Code:
  * Common: Optimize path parameter handling. (rjung)
- Cleaned with spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- remove useless %check section</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589198400">- Changes for 1.2.47 and 1.2.48 updates:
  * Add: Apache: Extend trace level logging of method entry/exit to
    aid debugging of request mapping issues.
  * Fix: Apache: Fix a bug in the normalization checks that prevented
    file based requests, such as SSI file includes, from being processed.
  * Fix: Apache: When using JkAutoAlias, ensure that files that include
    spaces in their name are accessible.
  * Update: Common: Update the documentation to reflect that the source
    code for the Apache Tomcat Connectors has moved from Subversion to Git.
  * Fix: Common: When using set_session_cookie, ensure that an updated session
    cookie is issued if the load-balancer has to failover to a different worker.
  * Update: Common: Update config.guess and config.sub from
    https://git.savannah.gnu.org/git/config.git.
  * Update: Common: Update release script for migration to git.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589198401">- Fix Aliases to be compatible with the tomcat example URLs [bsc#1167896]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589803200">- Update jk.conf: [bsc#1167896]
  * Specify the location of JkShmFile.
  * Update tomcat-webapps paths.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to version 1.2.49:
  Apache
  * Retrieve default request id from mod_unique_id. It can also be
    taken from an arbitrary environment variable by configuring
    "JkRequestIdIndicator".
  * Don't delegate the generation of the response body to httpd
    when the status code represents an error if the request used
    the HEAD method.
  * Only export the main module symbol. Visibility of module
    internal symbols led to crashes when conflicting with library
    symbols. Based on a patch provided by Josef Čejka. (wrong fix
    was applied for bsc#1206261)
  * Remove support for implicit mapping of requests to workers.
    All mappings must now be explicit.
  IIS
  * Set default request id as a GUID. It can also be taken from an
    arbitrary request header by configuring "request_id_header".
  * Fix non-empty check for the Translate header.
  Common
  * Fix compiler warning when initializing and copying fixed
    length strings.
  * Add a request id to mod_jk log lines.
  * Enable configure to find the correct sizes for pid_t and
    pthread_t when building on MacOS.
  * Fix Clang 15/16 compatibility. Pull request #6 provided by
    Sam James.
  * Improve XSS hardening in status worker.
  * Add additional bounds and error checking when reading AJP
    messages.
  Docs
  * Remove support for the Netscape / Sun ONE / Oracle iPlanet Web
    Server as the product has been retired.
  * Remove links to the old JK2 documentation. The JK2
    documentation is still available, it is just no longer linked
    from the current JK documentation.
  * Restructure subsections in changelog starting with version
    1.2.45.</changelog>
  <changelog author="david.anes@suse.com" date="1703160000">- Add apache2-fix-symbol-export-typo.patch to fix a typo to restrict
  the symbols to export by the module. Fixes bsc#1206261.</changelog>
  <changelog author="gus.kenion@suse.com" date="1729512000">- Update to version 1.2.50:
  * Apache
    + Fix: 68117: Fix typo in new libtool flag introduced in
    1.2.49 to reduce symbol visibility. Also improve escaping
    of it in the Makefile.
    +  Fix: Improve shared memory handling on non-Windows.
  * IIS
    + Update: Update PCRE bundled with the ISAPI redirector to
    8.45.
  * Common
    + Fix: #8: Fix compilation on musl.
    + Update: Update config.guess and config.sub
- Remove apache2-fix-symbol-export-typo.patch - this upstream fix
  is included in 1.2.50</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- drop unneeded pcre build requirement</changelog>
  <changelog author="dimstar@opensuse.org" date="1756296000">- Minor tweak to the shipped jk.conf (boo#1239178):
  + Set JkLogFile to /var/log/apache/jk.conf: as this is written by
    apache, the previous location /var/log/tomcat is not permitted
  + Set JkShmFile to /var/lib/apache2/jk-runtime-status: again,
    /var/log/tomcat is no suitable location, as mod_jk is running
    as apache's user. Moving it to /var/log does not make sense, as
    SHM is not a log file.</changelog>
</package>
<package pkgid="9af288a2d2f8d82b0d7b9ca32e455e5870812133c85b4d0a8ac98fa69f611f1b" name="apache2-mod_jk-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.2.50" rel="98.2"/>
  <changelog author="pgajdos@suse.com" date="1433419200">- access configuration conditional in jk.conf example</changelog>
  <changelog author="tchvatal@suse.com" date="1433419201">- Apply patch to fix bnc#927845 CVE-2014-8111 VUL-1: apache2-mod_jk: Tomcat
  mod_jk information leak due to incorrect JkMount/JkUnmount directives
  processing:
  * apache2-mod_jk-CVE-2014-8111.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441800000">- test package with %apache_test_module_load</changelog>
  <changelog author="tchvatal@suse.com" date="1453291200">- Version update to 1.2.41:
  * remove merged patch apache2-mod_jk-CVE-2014-8111.patch
  * many small bugfixes all around:
    + http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html</changelog>
  <changelog author="tchvatal@suse.com" date="1495281600">- Just depend on java-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1517486400">- Version update to 1.2.42:
  * Many small fixes
  * Optimalization for new gccs
  * Minor code cleanups</changelog>
  <changelog author="tchvatal@suse.com" date="1518523200">- Disable tests for now as the default profile is not working
  properly to load up and upstream should update the sample</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Update to version 1.2.43 [bsc#1085220, CVE-2018-1323]
  * LB: Propagate load factor changes applied by the status worker
    to a load balancer sub worker correctly to all processes.
  * ISAPI: Align the make files for 32-bit and 64-bit builds.
  * Update config.guess and config.sub
  * Update PCRE bundled with the ISAPI redirector to 8.41.
  * Update the ISAPI redirector installation documentation to
    reflect the currently supported versions of Windows.
  * Align the normalization performed by the ISAPI redirector with
    that implemented by Tomcat.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1537358400">- Update to version 1.2.44
  Updates:
  * Remove the Novell Netware make files and Netware specific source
    code since there has not been a supported version of Netware
    available for over five years. (markt)
  * Apache: Update the documentation to use httpd 2.4.x style access
    control directives. (markt)
  * Update PCRE bundled with the ISAPI redirector to 8.42. (rjung)
  * Update config.guess and config.sub from
    https://git.savannah.gnu.org/git/config.git. (rjung)
  Fixes:
  * Common: Use Local, rather than Global, mutexs on Windows to
    better support multi-user environments. (markt)
  * Apache: Use poll rather than select to avoid the limitations of
    select triggering an httpd crash. Patch provided by Koen Wilde. (markt)
  * ISAPI: Remove the check that rejects requests that contain path
    segments that match WEB-INF or META-INF as it duplicates a check
    that Tomcat performs and, because ISAPI does not have visibility of
    the current context path, it is impossible to implement this check
    without valid requests being rejected. (markt)
  * Refactor normalisation of request URIs to a common location and align
    the normalisation implementation for mod_jk with that implemented by
    Tomcat. (markt)
  Add:
  * Clarify the behvaiour of lb workers when all ajp13 workers fail with
    particular reference to the role of the retries attribute. (markt)
  * Add the new load-balancer worker property lb_retries to improve the
    control over the number of retries. Based on a patch provided by
    Frederik Nosi. (markt)
  * Add a note to the documentation that the CollapseSlashes options are
    now effectively hard-coded to CollpaseSlashesAll due to the changes
    made to align normalization with that implemented in Tomcat. (markt)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1541419200">- Update to version 1.2.46
  Fixes:
  * Apache: Fix regression in 1.2.44 which resulted in
    socket_connect_timeout to be interpreted in units of seconds
    instead of milliseconds on platforms that provide poll(). (rjung)
  * Security: CVE-2018-11759 Connector path traversal [bsc#1114612]
- Update to version 1.2.45
  Fixes:
  * Correct regression in 1.2.44 that broke request handling for
    OPTIONS * requests. (rjung)
  * Improve path parameter parsing so that the session ID specified
    by the session_path worker property for load-balanced workers
    can be extracted from a path parameter in any segment of the
    URI, rather than only from the final segment. (markt)
  * Apache: Improve path parameter handling so that JkStripSession
    can remove session IDs that are specified on path parameters in any
    segment of the URI rather than only the final segment. (markt)
  * IIS: Improve path parameter handling so that strip_session can
    remove session IDs that are specified on path parameters in any
    segment of the URI rather than only the final segment. (markt)
  Updates:
  * Apache: Update the documentation to note additional
    limitations of the JkAutoAlias directive. (markt)
  Code:
  * Common: Optimize path parameter handling. (rjung)
- Cleaned with spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- remove useless %check section</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589198400">- Changes for 1.2.47 and 1.2.48 updates:
  * Add: Apache: Extend trace level logging of method entry/exit to
    aid debugging of request mapping issues.
  * Fix: Apache: Fix a bug in the normalization checks that prevented
    file based requests, such as SSI file includes, from being processed.
  * Fix: Apache: When using JkAutoAlias, ensure that files that include
    spaces in their name are accessible.
  * Update: Common: Update the documentation to reflect that the source
    code for the Apache Tomcat Connectors has moved from Subversion to Git.
  * Fix: Common: When using set_session_cookie, ensure that an updated session
    cookie is issued if the load-balancer has to failover to a different worker.
  * Update: Common: Update config.guess and config.sub from
    https://git.savannah.gnu.org/git/config.git.
  * Update: Common: Update release script for migration to git.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589198401">- Fix Aliases to be compatible with the tomcat example URLs [bsc#1167896]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589803200">- Update jk.conf: [bsc#1167896]
  * Specify the location of JkShmFile.
  * Update tomcat-webapps paths.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to version 1.2.49:
  Apache
  * Retrieve default request id from mod_unique_id. It can also be
    taken from an arbitrary environment variable by configuring
    "JkRequestIdIndicator".
  * Don't delegate the generation of the response body to httpd
    when the status code represents an error if the request used
    the HEAD method.
  * Only export the main module symbol. Visibility of module
    internal symbols led to crashes when conflicting with library
    symbols. Based on a patch provided by Josef Čejka. (wrong fix
    was applied for bsc#1206261)
  * Remove support for implicit mapping of requests to workers.
    All mappings must now be explicit.
  IIS
  * Set default request id as a GUID. It can also be taken from an
    arbitrary request header by configuring "request_id_header".
  * Fix non-empty check for the Translate header.
  Common
  * Fix compiler warning when initializing and copying fixed
    length strings.
  * Add a request id to mod_jk log lines.
  * Enable configure to find the correct sizes for pid_t and
    pthread_t when building on MacOS.
  * Fix Clang 15/16 compatibility. Pull request #6 provided by
    Sam James.
  * Improve XSS hardening in status worker.
  * Add additional bounds and error checking when reading AJP
    messages.
  Docs
  * Remove support for the Netscape / Sun ONE / Oracle iPlanet Web
    Server as the product has been retired.
  * Remove links to the old JK2 documentation. The JK2
    documentation is still available, it is just no longer linked
    from the current JK documentation.
  * Restructure subsections in changelog starting with version
    1.2.45.</changelog>
  <changelog author="david.anes@suse.com" date="1703160000">- Add apache2-fix-symbol-export-typo.patch to fix a typo to restrict
  the symbols to export by the module. Fixes bsc#1206261.</changelog>
  <changelog author="gus.kenion@suse.com" date="1729512000">- Update to version 1.2.50:
  * Apache
    + Fix: 68117: Fix typo in new libtool flag introduced in
    1.2.49 to reduce symbol visibility. Also improve escaping
    of it in the Makefile.
    +  Fix: Improve shared memory handling on non-Windows.
  * IIS
    + Update: Update PCRE bundled with the ISAPI redirector to
    8.45.
  * Common
    + Fix: #8: Fix compilation on musl.
    + Update: Update config.guess and config.sub
- Remove apache2-fix-symbol-export-typo.patch - this upstream fix
  is included in 1.2.50</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- drop unneeded pcre build requirement</changelog>
  <changelog author="dimstar@opensuse.org" date="1756296000">- Minor tweak to the shipped jk.conf (boo#1239178):
  + Set JkLogFile to /var/log/apache/jk.conf: as this is written by
    apache, the previous location /var/log/tomcat is not permitted
  + Set JkShmFile to /var/lib/apache2/jk-runtime-status: again,
    /var/log/tomcat is no suitable location, as mod_jk is running
    as apache's user. Moving it to /var/log does not make sense, as
    SHM is not a log file.</changelog>
</package>
<package pkgid="1b4ca1c3eba363482fa690510e369e6c7fb4167a0fe9f1cb4db827cbbad5fb85" name="apache2-mod_jk-debugsource" arch="x86_64">
  <version epoch="0" ver="1.2.50" rel="98.2"/>
  <changelog author="pgajdos@suse.com" date="1433419200">- access configuration conditional in jk.conf example</changelog>
  <changelog author="tchvatal@suse.com" date="1433419201">- Apply patch to fix bnc#927845 CVE-2014-8111 VUL-1: apache2-mod_jk: Tomcat
  mod_jk information leak due to incorrect JkMount/JkUnmount directives
  processing:
  * apache2-mod_jk-CVE-2014-8111.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441800000">- test package with %apache_test_module_load</changelog>
  <changelog author="tchvatal@suse.com" date="1453291200">- Version update to 1.2.41:
  * remove merged patch apache2-mod_jk-CVE-2014-8111.patch
  * many small bugfixes all around:
    + http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html</changelog>
  <changelog author="tchvatal@suse.com" date="1495281600">- Just depend on java-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1517486400">- Version update to 1.2.42:
  * Many small fixes
  * Optimalization for new gccs
  * Minor code cleanups</changelog>
  <changelog author="tchvatal@suse.com" date="1518523200">- Disable tests for now as the default profile is not working
  properly to load up and upstream should update the sample</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Update to version 1.2.43 [bsc#1085220, CVE-2018-1323]
  * LB: Propagate load factor changes applied by the status worker
    to a load balancer sub worker correctly to all processes.
  * ISAPI: Align the make files for 32-bit and 64-bit builds.
  * Update config.guess and config.sub
  * Update PCRE bundled with the ISAPI redirector to 8.41.
  * Update the ISAPI redirector installation documentation to
    reflect the currently supported versions of Windows.
  * Align the normalization performed by the ISAPI redirector with
    that implemented by Tomcat.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1537358400">- Update to version 1.2.44
  Updates:
  * Remove the Novell Netware make files and Netware specific source
    code since there has not been a supported version of Netware
    available for over five years. (markt)
  * Apache: Update the documentation to use httpd 2.4.x style access
    control directives. (markt)
  * Update PCRE bundled with the ISAPI redirector to 8.42. (rjung)
  * Update config.guess and config.sub from
    https://git.savannah.gnu.org/git/config.git. (rjung)
  Fixes:
  * Common: Use Local, rather than Global, mutexs on Windows to
    better support multi-user environments. (markt)
  * Apache: Use poll rather than select to avoid the limitations of
    select triggering an httpd crash. Patch provided by Koen Wilde. (markt)
  * ISAPI: Remove the check that rejects requests that contain path
    segments that match WEB-INF or META-INF as it duplicates a check
    that Tomcat performs and, because ISAPI does not have visibility of
    the current context path, it is impossible to implement this check
    without valid requests being rejected. (markt)
  * Refactor normalisation of request URIs to a common location and align
    the normalisation implementation for mod_jk with that implemented by
    Tomcat. (markt)
  Add:
  * Clarify the behvaiour of lb workers when all ajp13 workers fail with
    particular reference to the role of the retries attribute. (markt)
  * Add the new load-balancer worker property lb_retries to improve the
    control over the number of retries. Based on a patch provided by
    Frederik Nosi. (markt)
  * Add a note to the documentation that the CollapseSlashes options are
    now effectively hard-coded to CollpaseSlashesAll due to the changes
    made to align normalization with that implemented in Tomcat. (markt)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1541419200">- Update to version 1.2.46
  Fixes:
  * Apache: Fix regression in 1.2.44 which resulted in
    socket_connect_timeout to be interpreted in units of seconds
    instead of milliseconds on platforms that provide poll(). (rjung)
  * Security: CVE-2018-11759 Connector path traversal [bsc#1114612]
- Update to version 1.2.45
  Fixes:
  * Correct regression in 1.2.44 that broke request handling for
    OPTIONS * requests. (rjung)
  * Improve path parameter parsing so that the session ID specified
    by the session_path worker property for load-balanced workers
    can be extracted from a path parameter in any segment of the
    URI, rather than only from the final segment. (markt)
  * Apache: Improve path parameter handling so that JkStripSession
    can remove session IDs that are specified on path parameters in any
    segment of the URI rather than only the final segment. (markt)
  * IIS: Improve path parameter handling so that strip_session can
    remove session IDs that are specified on path parameters in any
    segment of the URI rather than only the final segment. (markt)
  Updates:
  * Apache: Update the documentation to note additional
    limitations of the JkAutoAlias directive. (markt)
  Code:
  * Common: Optimize path parameter handling. (rjung)
- Cleaned with spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- remove useless %check section</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589198400">- Changes for 1.2.47 and 1.2.48 updates:
  * Add: Apache: Extend trace level logging of method entry/exit to
    aid debugging of request mapping issues.
  * Fix: Apache: Fix a bug in the normalization checks that prevented
    file based requests, such as SSI file includes, from being processed.
  * Fix: Apache: When using JkAutoAlias, ensure that files that include
    spaces in their name are accessible.
  * Update: Common: Update the documentation to reflect that the source
    code for the Apache Tomcat Connectors has moved from Subversion to Git.
  * Fix: Common: When using set_session_cookie, ensure that an updated session
    cookie is issued if the load-balancer has to failover to a different worker.
  * Update: Common: Update config.guess and config.sub from
    https://git.savannah.gnu.org/git/config.git.
  * Update: Common: Update release script for migration to git.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589198401">- Fix Aliases to be compatible with the tomcat example URLs [bsc#1167896]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589803200">- Update jk.conf: [bsc#1167896]
  * Specify the location of JkShmFile.
  * Update tomcat-webapps paths.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to version 1.2.49:
  Apache
  * Retrieve default request id from mod_unique_id. It can also be
    taken from an arbitrary environment variable by configuring
    "JkRequestIdIndicator".
  * Don't delegate the generation of the response body to httpd
    when the status code represents an error if the request used
    the HEAD method.
  * Only export the main module symbol. Visibility of module
    internal symbols led to crashes when conflicting with library
    symbols. Based on a patch provided by Josef Čejka. (wrong fix
    was applied for bsc#1206261)
  * Remove support for implicit mapping of requests to workers.
    All mappings must now be explicit.
  IIS
  * Set default request id as a GUID. It can also be taken from an
    arbitrary request header by configuring "request_id_header".
  * Fix non-empty check for the Translate header.
  Common
  * Fix compiler warning when initializing and copying fixed
    length strings.
  * Add a request id to mod_jk log lines.
  * Enable configure to find the correct sizes for pid_t and
    pthread_t when building on MacOS.
  * Fix Clang 15/16 compatibility. Pull request #6 provided by
    Sam James.
  * Improve XSS hardening in status worker.
  * Add additional bounds and error checking when reading AJP
    messages.
  Docs
  * Remove support for the Netscape / Sun ONE / Oracle iPlanet Web
    Server as the product has been retired.
  * Remove links to the old JK2 documentation. The JK2
    documentation is still available, it is just no longer linked
    from the current JK documentation.
  * Restructure subsections in changelog starting with version
    1.2.45.</changelog>
  <changelog author="david.anes@suse.com" date="1703160000">- Add apache2-fix-symbol-export-typo.patch to fix a typo to restrict
  the symbols to export by the module. Fixes bsc#1206261.</changelog>
  <changelog author="gus.kenion@suse.com" date="1729512000">- Update to version 1.2.50:
  * Apache
    + Fix: 68117: Fix typo in new libtool flag introduced in
    1.2.49 to reduce symbol visibility. Also improve escaping
    of it in the Makefile.
    +  Fix: Improve shared memory handling on non-Windows.
  * IIS
    + Update: Update PCRE bundled with the ISAPI redirector to
    8.45.
  * Common
    + Fix: #8: Fix compilation on musl.
    + Update: Update config.guess and config.sub
- Remove apache2-fix-symbol-export-typo.patch - this upstream fix
  is included in 1.2.50</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- drop unneeded pcre build requirement</changelog>
  <changelog author="dimstar@opensuse.org" date="1756296000">- Minor tweak to the shipped jk.conf (boo#1239178):
  + Set JkLogFile to /var/log/apache/jk.conf: as this is written by
    apache, the previous location /var/log/tomcat is not permitted
  + Set JkShmFile to /var/lib/apache2/jk-runtime-status: again,
    /var/log/tomcat is no suitable location, as mod_jk is running
    as apache's user. Moving it to /var/log does not make sense, as
    SHM is not a log file.</changelog>
</package>
<package pkgid="b5aa7d40114fced18fca76426106b2033aeb61d1bd3dd07a5b10480325bec297" name="apache2-mod_limitipconn" arch="src">
  <version epoch="0" ver="0.24" rel="11.19"/>
  <changelog author="poeml@suse.de" date="1212408000">- initial add (0.22)</changelog>
  <changelog author="poeml@suse.de" date="1213099200">- build service supports the debuginfo flag in metadata now; remove
  debug_package macro from the specfile therefore.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1344254400">- Version 0.24, fixes apache 2.4 support</changelog>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1442318400">- test module with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
</package>
<package pkgid="3925d29282768aaeb4e68cb0149261d2e691e6b43cd2c1f8473e1e89b8a99503" name="apache2-mod_limitipconn" arch="x86_64">
  <version epoch="0" ver="0.24" rel="11.19"/>
  <changelog author="poeml@suse.de" date="1212408000">- initial add (0.22)</changelog>
  <changelog author="poeml@suse.de" date="1213099200">- build service supports the debuginfo flag in metadata now; remove
  debug_package macro from the specfile therefore.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1344254400">- Version 0.24, fixes apache 2.4 support</changelog>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1442318400">- test module with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
</package>
<package pkgid="3bf98f2cbc59536cd48d46411b3a8d82ac946f973647c00c6ab2e52765e4e076" name="apache2-mod_limitipconn-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.24" rel="11.19"/>
  <changelog author="poeml@suse.de" date="1212408000">- initial add (0.22)</changelog>
  <changelog author="poeml@suse.de" date="1213099200">- build service supports the debuginfo flag in metadata now; remove
  debug_package macro from the specfile therefore.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1344254400">- Version 0.24, fixes apache 2.4 support</changelog>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1442318400">- test module with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
</package>
<package pkgid="9af087744f9958511e0a0916aa1de7bb5933d1ca8ae6a4bca8fe34d791075032" name="apache2-mod_limitipconn-debugsource" arch="x86_64">
  <version epoch="0" ver="0.24" rel="11.19"/>
  <changelog author="poeml@suse.de" date="1212408000">- initial add (0.22)</changelog>
  <changelog author="poeml@suse.de" date="1213099200">- build service supports the debuginfo flag in metadata now; remove
  debug_package macro from the specfile therefore.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1344254400">- Version 0.24, fixes apache 2.4 support</changelog>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1442318400">- test module with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
</package>
<package pkgid="600a181f7b85d35ec90b29d04ca1f0b6aeed5a826798e8d90b46318f8a839990" name="apache2-mod_maxminddb" arch="src">
  <version epoch="0" ver="1.3.0" rel="15.3"/>
  <changelog author="jweberhofer@weberhofer.at" date="1526558400">- Initial release 1.1.0</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1570449600">- Added autoreconf to allow building on factory version
- Added apache2-mod_maxminddb-build.patch to make it buildable on opensuse fatory again.
  Does not build with LDFLAGS="-flto=8"</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="mrueckert@suse.de" date="1585051200">- update to 1.2.0
  https://github.com/maxmind/mod_maxminddb/releases/tag/1.2.0</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="simmphonie@opensuse.org" date="1751457600">- update to 1.3.0
  * Portability fixes
  * Documentation improvements</changelog>
</package>
<package pkgid="e3dcddc60eb8eb7383f59a01d88d9444dc90b945afa1021d149546d673bdbf8c" name="apache2-mod_maxminddb" arch="x86_64">
  <version epoch="0" ver="1.3.0" rel="15.3"/>
  <changelog author="jweberhofer@weberhofer.at" date="1526558400">- Initial release 1.1.0</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1570449600">- Added autoreconf to allow building on factory version
- Added apache2-mod_maxminddb-build.patch to make it buildable on opensuse fatory again.
  Does not build with LDFLAGS="-flto=8"</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="mrueckert@suse.de" date="1585051200">- update to 1.2.0
  https://github.com/maxmind/mod_maxminddb/releases/tag/1.2.0</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="simmphonie@opensuse.org" date="1751457600">- update to 1.3.0
  * Portability fixes
  * Documentation improvements</changelog>
</package>
<package pkgid="f12adf238ef79c6d847a4a36f600f90922f560f29a85553e884d4811327b9953" name="apache2-mod_maxminddb-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.3.0" rel="15.3"/>
  <changelog author="jweberhofer@weberhofer.at" date="1526558400">- Initial release 1.1.0</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1570449600">- Added autoreconf to allow building on factory version
- Added apache2-mod_maxminddb-build.patch to make it buildable on opensuse fatory again.
  Does not build with LDFLAGS="-flto=8"</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="mrueckert@suse.de" date="1585051200">- update to 1.2.0
  https://github.com/maxmind/mod_maxminddb/releases/tag/1.2.0</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="simmphonie@opensuse.org" date="1751457600">- update to 1.3.0
  * Portability fixes
  * Documentation improvements</changelog>
</package>
<package pkgid="96771e5e05b57e01efa36717424e6bffc91baecfc1cfe3de99666c5ce32c4c8f" name="apache2-mod_maxminddb-debugsource" arch="x86_64">
  <version epoch="0" ver="1.3.0" rel="15.3"/>
  <changelog author="jweberhofer@weberhofer.at" date="1526558400">- Initial release 1.1.0</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1570449600">- Added autoreconf to allow building on factory version
- Added apache2-mod_maxminddb-build.patch to make it buildable on opensuse fatory again.
  Does not build with LDFLAGS="-flto=8"</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="mrueckert@suse.de" date="1585051200">- update to 1.2.0
  https://github.com/maxmind/mod_maxminddb/releases/tag/1.2.0</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="simmphonie@opensuse.org" date="1751457600">- update to 1.3.0
  * Portability fixes
  * Documentation improvements</changelog>
</package>
<package pkgid="1dcc8be2854e7f58a12055b3df18e7a350b7f354b2164794154e3a92fe5413a0" name="apache2-mod_mono" arch="src">
  <version epoch="0" ver="3.12" rel="6.10"/>
  <changelog author="wberrier@suse.de" date="1200312000">- Update to 1.2.6
  - New directives for controlling the life span of mod-mono-server
  - Startup of mod_mono backends synchronized across all the child
  apache processes (via a shared memory dashboard).</changelog>
  <changelog author="wberrier@suse.de" date="1206446400">- Update to 1.9
  - New support for controlling the number of requests that are
  passed to the mod-mono-server process</changelog>
  <changelog author="wberrier@suse.de" date="1209470400">- Fix .conf and apxs file location for redhat/fedora</changelog>
  <changelog author="ajorgensen@novell.com" date="1219752000">- Update to 2.0 (preview 2)
  * Fixes bnc#374272, bnc#392235,</changelog>
  <changelog author="ajorgensen@novell.com" date="1238500800">- Update to 2.4
  * http://www.mono-project.com/Release_Notes_Mono_2.4</changelog>
  <changelog author="ajorgensen@novell.com" date="1249992000">- Update to 2.4.2
  * http://www.mono-project.com/Release_Notes_Mono_2.4.2</changelog>
  <changelog author="ajorgensen@novell.com" date="1264507200">- Update to 2.6
  * http://www.mono-project.com/Release_Notes_Mono_2.6</changelog>
  <changelog author="ajorgensen@novell.com" date="1268740800">- Update to 2.6.3
  * http://www.mono-project.com/Release_Notes_Mono_2.6.3</changelog>
  <changelog author="ajorgensen@novell.com" date="1288785600">- Update to 2.8
  * http://www.go-mono.com/archive/2.8</changelog>
  <changelog author="ajorgensen@novell.com" date="1294401600">- Update to 2.8.2
  * Fix for CVE-2010-4225, bnc#660070
  * http://www.go-mono.com/archive/2.8</changelog>
  <changelog author="ajorgensen@novell.com" date="1298376000">- Update to 2.10
  * http://www.go-mono.com/archive/2.10</changelog>
  <changelog author="ajorgensen@novell.com" date="1298376001">- Disable quiet build</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="dimstar@opensuse.org" date="1359547200">- Add apache2-mod_mono-apache24.patch: Fix build with Apache 2.4
- Add libtool BuildRequires and call to autoreconf, as above patch
  touches the build system.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421409600">- Update to version 3.12
  + ChangeLog/News files have not been updated
- Remove pache2-mod_mono-apache24.patch; merged on upstream release
- Use download Url as source
- Cleanup specfile</changelog>
  <changelog author="mailaender@opensuse.org" date="1421496000">- fix rpmlint warnings
- use the official tarball</changelog>
  <changelog author="dgutu@suse.com" date="1432641600">- Changed xsp dependency version because it was bogus</changelog>
  <changelog author="pgajdos@suse.com" date="1442577600">- use rpm macros (apache-rpm-macros needed)
- test package with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1513684800">- buildrequire apr-util-devel instead of libapr-util1-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
</package>
<package pkgid="11f225d89bce57af08333ab26ce8e77c416ab9110592d7e0d10d28f40ca6edc6" name="apache2-mod_mono" arch="x86_64">
  <version epoch="0" ver="3.12" rel="6.10"/>
  <changelog author="ajorgensen@novell.com" date="1298376000">- Update to 2.10
  * http://www.go-mono.com/archive/2.10</changelog>
  <changelog author="ajorgensen@novell.com" date="1298376001">- Disable quiet build</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="dimstar@opensuse.org" date="1359547200">- Add apache2-mod_mono-apache24.patch: Fix build with Apache 2.4
- Add libtool BuildRequires and call to autoreconf, as above patch
  touches the build system.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421409600">- Update to version 3.12
  + ChangeLog/News files have not been updated
- Remove pache2-mod_mono-apache24.patch; merged on upstream release
- Use download Url as source
- Cleanup specfile</changelog>
  <changelog author="mailaender@opensuse.org" date="1421496000">- fix rpmlint warnings
- use the official tarball</changelog>
  <changelog author="dgutu@suse.com" date="1432641600">- Changed xsp dependency version because it was bogus</changelog>
  <changelog author="pgajdos@suse.com" date="1442577600">- use rpm macros (apache-rpm-macros needed)
- test package with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1513684800">- buildrequire apr-util-devel instead of libapr-util1-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
</package>
<package pkgid="1830a0b051e198bae3431e8da09facca389b908bdcfbbaddee9bea455dad2df3" name="apache2-mod_mono-debuginfo" arch="x86_64">
  <version epoch="0" ver="3.12" rel="6.10"/>
  <changelog author="ajorgensen@novell.com" date="1298376000">- Update to 2.10
  * http://www.go-mono.com/archive/2.10</changelog>
  <changelog author="ajorgensen@novell.com" date="1298376001">- Disable quiet build</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="dimstar@opensuse.org" date="1359547200">- Add apache2-mod_mono-apache24.patch: Fix build with Apache 2.4
- Add libtool BuildRequires and call to autoreconf, as above patch
  touches the build system.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421409600">- Update to version 3.12
  + ChangeLog/News files have not been updated
- Remove pache2-mod_mono-apache24.patch; merged on upstream release
- Use download Url as source
- Cleanup specfile</changelog>
  <changelog author="mailaender@opensuse.org" date="1421496000">- fix rpmlint warnings
- use the official tarball</changelog>
  <changelog author="dgutu@suse.com" date="1432641600">- Changed xsp dependency version because it was bogus</changelog>
  <changelog author="pgajdos@suse.com" date="1442577600">- use rpm macros (apache-rpm-macros needed)
- test package with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1513684800">- buildrequire apr-util-devel instead of libapr-util1-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
</package>
<package pkgid="215200167658e5e8af73623860445d6c4cf87f4b2024e24e51042c5c72601243" name="apache2-mod_mono-debugsource" arch="x86_64">
  <version epoch="0" ver="3.12" rel="6.10"/>
  <changelog author="ajorgensen@novell.com" date="1298376000">- Update to 2.10
  * http://www.go-mono.com/archive/2.10</changelog>
  <changelog author="ajorgensen@novell.com" date="1298376001">- Disable quiet build</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="dimstar@opensuse.org" date="1359547200">- Add apache2-mod_mono-apache24.patch: Fix build with Apache 2.4
- Add libtool BuildRequires and call to autoreconf, as above patch
  touches the build system.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421409600">- Update to version 3.12
  + ChangeLog/News files have not been updated
- Remove pache2-mod_mono-apache24.patch; merged on upstream release
- Use download Url as source
- Cleanup specfile</changelog>
  <changelog author="mailaender@opensuse.org" date="1421496000">- fix rpmlint warnings
- use the official tarball</changelog>
  <changelog author="dgutu@suse.com" date="1432641600">- Changed xsp dependency version because it was bogus</changelog>
  <changelog author="pgajdos@suse.com" date="1442577600">- use rpm macros (apache-rpm-macros needed)
- test package with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1513684800">- buildrequire apr-util-devel instead of libapr-util1-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
</package>
<package pkgid="4ad4e764ddb51ae511992579602bf25ff400e91bd972212e1f54481c8674fdbb" name="apache2-mod_perl" arch="src">
  <version epoch="0" ver="2.0.13" rel="91.5"/>
  <changelog author="jsegitz@suse.com" date="1410955200">- Changed access control statements in config file to use
  mod_authz_host (bnc#897005)</changelog>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="tjcw@physics.org" date="1435320000">- turn off inlining for functions which need to be real symbols because they
  are called in a DSO
  * added inline.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1438084800">- updated to 2.0.9: see Changes for details
  * dropped patches:
  - lfs-perl-5.14.patch
  - apache2-mod_perl-2.0.4-tests.diff
  - apache24-mod_authz_host.patch</changelog>
  <changelog author="schwab@suse.de" date="1438689600">- Force gnu89 inline semantics
- Disable tests only in QEMU user-space builds
- inline.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1439467200">- Remove apache2 packaging bug workaround</changelog>
  <changelog author="vcizek@suse.com" date="1450267200">- fix mod_perl with perl 5.22 (boo#945195)
  * add mod_perl-add_support_for_perl_5.22.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1475496000">- Remove unused icon and shorten the description a bit 1-2 migration
  is quite irelevant in these days
- Move tests to %check  phase
- Use proper group for devel subpackage</changelog>
  <changelog author="astieger@suse.com" date="1483099200">- update to 2.0.10:
  * Automatically select the appropriate c89 option when modperl is
    being built with either gcc 5 or clang
  * Fix non-threaded Perl 5.22.x build and tests
  * Add support for Perl 5.22.x
    drop upstreamed mod_perl-add_support_for_perl_5.22.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1531828800">- restore process name after sv_setpv_mg() call [bsc#1091625]
  + apache2-mod_perl-prctl-short-name.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573905600">- Apache mod_perl 2.0.11:
  * CVE-2011-2767: Arbitrary Perl code execution in the context of
    the user account via a user-owned .htaccess (boo#1156944)</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- define %license for older codestreams</changelog>
  <changelog author="opensuse@dstoecker.de" date="1632744000">- fix build error with fix_perl_5.34_build.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650542400">- update to 2.0.12:
  * Add bug tracker information to README, and add CONTRIBUTING.md.
  * Fix detection of APR's threading support on RHEL 8.
  * Fix build for perl &gt;= 5.33.7.
  * Fix SIGSEGV crash due to wrong use of perl_parse().
  * Improve installation instructions for AIX.
- remove patch:
  * fix_perl_5.34_build.patch (there is a fix already upstreamed)
- refreshed patches:
  * avoid-broken-provides.diff
  * apache2-mod_perl-prctl-short-name.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1691496000">- Add apache2-mod_perl-perl-5.38.patch: Fix build with Perl 5.38.
  Usptream rev 1910623.</changelog>
  <changelog author="david.anes@suse.com" date="1699876800">- Update to 2.0.13:
  * Use get_server_banner() instead of deprecated get_server_version() in
    Apache2::Status.
  * Avoid generating APR precompiled headers.
  * Fix build for perl &gt;= 5.37.1.
- Removed apache2-mod_perl-perl-5.38.patch (fix already upstream)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1720440000">- fix build on Tumbleweed (boo#1227485)</changelog>
  <changelog author="kukuk@suse.com" date="1727438400">- Add /srv/www to filelist [bsc#1231027]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- removed unneeded pcre build dependency</changelog>
</package>
<package pkgid="1e0d81f810546d8346611d44335d5064daa77fa7a545aeefe9ac469f011454ab" name="apache2-mod_perl" arch="x86_64">
  <version epoch="0" ver="2.0.13" rel="91.5"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="tjcw@physics.org" date="1435320000">- turn off inlining for functions which need to be real symbols because they
  are called in a DSO
  * added inline.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1438084800">- updated to 2.0.9: see Changes for details
  * dropped patches:
  - lfs-perl-5.14.patch
  - apache2-mod_perl-2.0.4-tests.diff
  - apache24-mod_authz_host.patch</changelog>
  <changelog author="schwab@suse.de" date="1438689600">- Force gnu89 inline semantics
- Disable tests only in QEMU user-space builds
- inline.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1439467200">- Remove apache2 packaging bug workaround</changelog>
  <changelog author="vcizek@suse.com" date="1450267200">- fix mod_perl with perl 5.22 (boo#945195)
  * add mod_perl-add_support_for_perl_5.22.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1475496000">- Remove unused icon and shorten the description a bit 1-2 migration
  is quite irelevant in these days
- Move tests to %check  phase
- Use proper group for devel subpackage</changelog>
  <changelog author="astieger@suse.com" date="1483099200">- update to 2.0.10:
  * Automatically select the appropriate c89 option when modperl is
    being built with either gcc 5 or clang
  * Fix non-threaded Perl 5.22.x build and tests
  * Add support for Perl 5.22.x
    drop upstreamed mod_perl-add_support_for_perl_5.22.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1531828800">- restore process name after sv_setpv_mg() call [bsc#1091625]
  + apache2-mod_perl-prctl-short-name.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573905600">- Apache mod_perl 2.0.11:
  * CVE-2011-2767: Arbitrary Perl code execution in the context of
    the user account via a user-owned .htaccess (boo#1156944)</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- define %license for older codestreams</changelog>
  <changelog author="opensuse@dstoecker.de" date="1632744000">- fix build error with fix_perl_5.34_build.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650542400">- update to 2.0.12:
  * Add bug tracker information to README, and add CONTRIBUTING.md.
  * Fix detection of APR's threading support on RHEL 8.
  * Fix build for perl &gt;= 5.33.7.
  * Fix SIGSEGV crash due to wrong use of perl_parse().
  * Improve installation instructions for AIX.
- remove patch:
  * fix_perl_5.34_build.patch (there is a fix already upstreamed)
- refreshed patches:
  * avoid-broken-provides.diff
  * apache2-mod_perl-prctl-short-name.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1691496000">- Add apache2-mod_perl-perl-5.38.patch: Fix build with Perl 5.38.
  Usptream rev 1910623.</changelog>
  <changelog author="david.anes@suse.com" date="1699876800">- Update to 2.0.13:
  * Use get_server_banner() instead of deprecated get_server_version() in
    Apache2::Status.
  * Avoid generating APR precompiled headers.
  * Fix build for perl &gt;= 5.37.1.
- Removed apache2-mod_perl-perl-5.38.patch (fix already upstream)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1720440000">- fix build on Tumbleweed (boo#1227485)</changelog>
  <changelog author="kukuk@suse.com" date="1727438400">- Add /srv/www to filelist [bsc#1231027]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- removed unneeded pcre build dependency</changelog>
</package>
<package pkgid="a272811c813bea8d11d3645644d3fcbf57d8791b9b0d2f7815c33154948e3fd1" name="apache2-mod_perl-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.0.13" rel="91.5"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="tjcw@physics.org" date="1435320000">- turn off inlining for functions which need to be real symbols because they
  are called in a DSO
  * added inline.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1438084800">- updated to 2.0.9: see Changes for details
  * dropped patches:
  - lfs-perl-5.14.patch
  - apache2-mod_perl-2.0.4-tests.diff
  - apache24-mod_authz_host.patch</changelog>
  <changelog author="schwab@suse.de" date="1438689600">- Force gnu89 inline semantics
- Disable tests only in QEMU user-space builds
- inline.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1439467200">- Remove apache2 packaging bug workaround</changelog>
  <changelog author="vcizek@suse.com" date="1450267200">- fix mod_perl with perl 5.22 (boo#945195)
  * add mod_perl-add_support_for_perl_5.22.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1475496000">- Remove unused icon and shorten the description a bit 1-2 migration
  is quite irelevant in these days
- Move tests to %check  phase
- Use proper group for devel subpackage</changelog>
  <changelog author="astieger@suse.com" date="1483099200">- update to 2.0.10:
  * Automatically select the appropriate c89 option when modperl is
    being built with either gcc 5 or clang
  * Fix non-threaded Perl 5.22.x build and tests
  * Add support for Perl 5.22.x
    drop upstreamed mod_perl-add_support_for_perl_5.22.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1531828800">- restore process name after sv_setpv_mg() call [bsc#1091625]
  + apache2-mod_perl-prctl-short-name.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573905600">- Apache mod_perl 2.0.11:
  * CVE-2011-2767: Arbitrary Perl code execution in the context of
    the user account via a user-owned .htaccess (boo#1156944)</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- define %license for older codestreams</changelog>
  <changelog author="opensuse@dstoecker.de" date="1632744000">- fix build error with fix_perl_5.34_build.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650542400">- update to 2.0.12:
  * Add bug tracker information to README, and add CONTRIBUTING.md.
  * Fix detection of APR's threading support on RHEL 8.
  * Fix build for perl &gt;= 5.33.7.
  * Fix SIGSEGV crash due to wrong use of perl_parse().
  * Improve installation instructions for AIX.
- remove patch:
  * fix_perl_5.34_build.patch (there is a fix already upstreamed)
- refreshed patches:
  * avoid-broken-provides.diff
  * apache2-mod_perl-prctl-short-name.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1691496000">- Add apache2-mod_perl-perl-5.38.patch: Fix build with Perl 5.38.
  Usptream rev 1910623.</changelog>
  <changelog author="david.anes@suse.com" date="1699876800">- Update to 2.0.13:
  * Use get_server_banner() instead of deprecated get_server_version() in
    Apache2::Status.
  * Avoid generating APR precompiled headers.
  * Fix build for perl &gt;= 5.37.1.
- Removed apache2-mod_perl-perl-5.38.patch (fix already upstream)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1720440000">- fix build on Tumbleweed (boo#1227485)</changelog>
  <changelog author="kukuk@suse.com" date="1727438400">- Add /srv/www to filelist [bsc#1231027]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- removed unneeded pcre build dependency</changelog>
</package>
<package pkgid="790170ec2f9bc88451a67655f5f5518ed04355b3a1a6c1df30560e228a5c2977" name="apache2-mod_perl-debugsource" arch="x86_64">
  <version epoch="0" ver="2.0.13" rel="91.5"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="tjcw@physics.org" date="1435320000">- turn off inlining for functions which need to be real symbols because they
  are called in a DSO
  * added inline.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1438084800">- updated to 2.0.9: see Changes for details
  * dropped patches:
  - lfs-perl-5.14.patch
  - apache2-mod_perl-2.0.4-tests.diff
  - apache24-mod_authz_host.patch</changelog>
  <changelog author="schwab@suse.de" date="1438689600">- Force gnu89 inline semantics
- Disable tests only in QEMU user-space builds
- inline.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1439467200">- Remove apache2 packaging bug workaround</changelog>
  <changelog author="vcizek@suse.com" date="1450267200">- fix mod_perl with perl 5.22 (boo#945195)
  * add mod_perl-add_support_for_perl_5.22.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1475496000">- Remove unused icon and shorten the description a bit 1-2 migration
  is quite irelevant in these days
- Move tests to %check  phase
- Use proper group for devel subpackage</changelog>
  <changelog author="astieger@suse.com" date="1483099200">- update to 2.0.10:
  * Automatically select the appropriate c89 option when modperl is
    being built with either gcc 5 or clang
  * Fix non-threaded Perl 5.22.x build and tests
  * Add support for Perl 5.22.x
    drop upstreamed mod_perl-add_support_for_perl_5.22.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1531828800">- restore process name after sv_setpv_mg() call [bsc#1091625]
  + apache2-mod_perl-prctl-short-name.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573905600">- Apache mod_perl 2.0.11:
  * CVE-2011-2767: Arbitrary Perl code execution in the context of
    the user account via a user-owned .htaccess (boo#1156944)</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- define %license for older codestreams</changelog>
  <changelog author="opensuse@dstoecker.de" date="1632744000">- fix build error with fix_perl_5.34_build.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650542400">- update to 2.0.12:
  * Add bug tracker information to README, and add CONTRIBUTING.md.
  * Fix detection of APR's threading support on RHEL 8.
  * Fix build for perl &gt;= 5.33.7.
  * Fix SIGSEGV crash due to wrong use of perl_parse().
  * Improve installation instructions for AIX.
- remove patch:
  * fix_perl_5.34_build.patch (there is a fix already upstreamed)
- refreshed patches:
  * avoid-broken-provides.diff
  * apache2-mod_perl-prctl-short-name.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1691496000">- Add apache2-mod_perl-perl-5.38.patch: Fix build with Perl 5.38.
  Usptream rev 1910623.</changelog>
  <changelog author="david.anes@suse.com" date="1699876800">- Update to 2.0.13:
  * Use get_server_banner() instead of deprecated get_server_version() in
    Apache2::Status.
  * Avoid generating APR precompiled headers.
  * Fix build for perl &gt;= 5.37.1.
- Removed apache2-mod_perl-perl-5.38.patch (fix already upstream)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1720440000">- fix build on Tumbleweed (boo#1227485)</changelog>
  <changelog author="kukuk@suse.com" date="1727438400">- Add /srv/www to filelist [bsc#1231027]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- removed unneeded pcre build dependency</changelog>
</package>
<package pkgid="5612dfa69f40e21d032d6c49a4ee00948c09e51450bba2743b8e06e059397714" name="apache2-mod_perl-devel" arch="x86_64">
  <version epoch="0" ver="2.0.13" rel="91.5"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="tjcw@physics.org" date="1435320000">- turn off inlining for functions which need to be real symbols because they
  are called in a DSO
  * added inline.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1438084800">- updated to 2.0.9: see Changes for details
  * dropped patches:
  - lfs-perl-5.14.patch
  - apache2-mod_perl-2.0.4-tests.diff
  - apache24-mod_authz_host.patch</changelog>
  <changelog author="schwab@suse.de" date="1438689600">- Force gnu89 inline semantics
- Disable tests only in QEMU user-space builds
- inline.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1439467200">- Remove apache2 packaging bug workaround</changelog>
  <changelog author="vcizek@suse.com" date="1450267200">- fix mod_perl with perl 5.22 (boo#945195)
  * add mod_perl-add_support_for_perl_5.22.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1475496000">- Remove unused icon and shorten the description a bit 1-2 migration
  is quite irelevant in these days
- Move tests to %check  phase
- Use proper group for devel subpackage</changelog>
  <changelog author="astieger@suse.com" date="1483099200">- update to 2.0.10:
  * Automatically select the appropriate c89 option when modperl is
    being built with either gcc 5 or clang
  * Fix non-threaded Perl 5.22.x build and tests
  * Add support for Perl 5.22.x
    drop upstreamed mod_perl-add_support_for_perl_5.22.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1531828800">- restore process name after sv_setpv_mg() call [bsc#1091625]
  + apache2-mod_perl-prctl-short-name.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573905600">- Apache mod_perl 2.0.11:
  * CVE-2011-2767: Arbitrary Perl code execution in the context of
    the user account via a user-owned .htaccess (boo#1156944)</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- define %license for older codestreams</changelog>
  <changelog author="opensuse@dstoecker.de" date="1632744000">- fix build error with fix_perl_5.34_build.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650542400">- update to 2.0.12:
  * Add bug tracker information to README, and add CONTRIBUTING.md.
  * Fix detection of APR's threading support on RHEL 8.
  * Fix build for perl &gt;= 5.33.7.
  * Fix SIGSEGV crash due to wrong use of perl_parse().
  * Improve installation instructions for AIX.
- remove patch:
  * fix_perl_5.34_build.patch (there is a fix already upstreamed)
- refreshed patches:
  * avoid-broken-provides.diff
  * apache2-mod_perl-prctl-short-name.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1691496000">- Add apache2-mod_perl-perl-5.38.patch: Fix build with Perl 5.38.
  Usptream rev 1910623.</changelog>
  <changelog author="david.anes@suse.com" date="1699876800">- Update to 2.0.13:
  * Use get_server_banner() instead of deprecated get_server_version() in
    Apache2::Status.
  * Avoid generating APR precompiled headers.
  * Fix build for perl &gt;= 5.37.1.
- Removed apache2-mod_perl-perl-5.38.patch (fix already upstream)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1720440000">- fix build on Tumbleweed (boo#1227485)</changelog>
  <changelog author="kukuk@suse.com" date="1727438400">- Add /srv/www to filelist [bsc#1231027]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1742385600">- removed unneeded pcre build dependency</changelog>
</package>
<package pkgid="978b34c51d6141848515ae04f2a8bffee36bf7f587619588aaaa2e3ea532a05e" name="apache2-mod_qos" arch="src">
  <version epoch="0" ver="11.76" rel="2.2"/>
  <changelog author="crrodriguez@suse.de" date="1253880000">- Requires: apache2 %{apache_mmn}</changelog>
  <changelog author="draht@suse.de" date="1299326400">- openssl-1.* changes struct STACK to _STACK; spec file adopted
  for 11.3+.</changelog>
  <changelog author="draht@suse.de" date="1299326401">- mod_qos-loggerThread.patch:
  incorrect use of pthread_create(), use usleep() instead of sleep()</changelog>
  <changelog author="pgajdos@suse.com" date="1415102400">- call spec-cleaner
- use apache rpm macros
- update to 11.5
  * fixes build
  * see CHANGES.TXT for upstream change log</changelog>
  <changelog author="pgajdos@suse.com" date="1433246400">- configuration uses old syntax only when access_compat is loaded</changelog>
  <changelog author="pgajdos@suse.com" date="1433419200">- drop mod_qos.conf as it seems to be outdated (see documentation
  for use case examples)</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441627200">- test module with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1443614400">- update to 11.17
- build only for worker mpm</changelog>
  <changelog author="pgajdos@suse.com" date="1443614401">- test module again</changelog>
  <changelog author="pgajdos@suse.com" date="1513684800">- buildrequire apr-util-devel instead of libapr-util1-devel
- buildrequire apr-devel instead of libapr1-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1513771200">- update to 11.45</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1581249601">- version update to 11.65</changelog>
  <changelog author="pgajdos@suse.com" date="1606305600">- version update to 11.66
  - QS_ClientIpFromHeader supports pseudo IP by creating a hash
  of a HTTP request header's value if the header name is prefixed
  by '#', e.g. #Authorization to use the HTTP basic auth header.
  It's also possible to use the client's SSL client certificate's
  subject and issuer DN if you specify #SSL_CLIENT_S_DN instead
  of a real HTTP header name.
  Note: Does not work for IP geolocation.
-</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743768000">- update to 11.76</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Remove deprecated dependency: pcre-devel
  pcre2-devel is now used instead, and both had already been added</changelog>
</package>
<package pkgid="ff305fc52de7eef0ae5df23e5c26ceb0e64c6facc634cf62b743b5b8095e1626" name="apache2-mod_qos" arch="x86_64">
  <version epoch="0" ver="11.76" rel="2.2"/>
  <changelog author="pgajdos@suse.com" date="1415102400">- call spec-cleaner
- use apache rpm macros
- update to 11.5
  * fixes build
  * see CHANGES.TXT for upstream change log</changelog>
  <changelog author="pgajdos@suse.com" date="1433246400">- configuration uses old syntax only when access_compat is loaded</changelog>
  <changelog author="pgajdos@suse.com" date="1433419200">- drop mod_qos.conf as it seems to be outdated (see documentation
  for use case examples)</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441627200">- test module with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1443614400">- update to 11.17
- build only for worker mpm</changelog>
  <changelog author="pgajdos@suse.com" date="1443614401">- test module again</changelog>
  <changelog author="pgajdos@suse.com" date="1513684800">- buildrequire apr-util-devel instead of libapr-util1-devel
- buildrequire apr-devel instead of libapr1-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1513771200">- update to 11.45</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1581249601">- version update to 11.65</changelog>
  <changelog author="pgajdos@suse.com" date="1606305600">- version update to 11.66
  - QS_ClientIpFromHeader supports pseudo IP by creating a hash
  of a HTTP request header's value if the header name is prefixed
  by '#', e.g. #Authorization to use the HTTP basic auth header.
  It's also possible to use the client's SSL client certificate's
  subject and issuer DN if you specify #SSL_CLIENT_S_DN instead
  of a real HTTP header name.
  Note: Does not work for IP geolocation.
-</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743768000">- update to 11.76</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Remove deprecated dependency: pcre-devel
  pcre2-devel is now used instead, and both had already been added</changelog>
</package>
<package pkgid="7383c75cacb193e09b9d939218835e58ccf5170a0917387735c807f8209dc773" name="apache2-mod_qos-debuginfo" arch="x86_64">
  <version epoch="0" ver="11.76" rel="2.2"/>
  <changelog author="pgajdos@suse.com" date="1415102400">- call spec-cleaner
- use apache rpm macros
- update to 11.5
  * fixes build
  * see CHANGES.TXT for upstream change log</changelog>
  <changelog author="pgajdos@suse.com" date="1433246400">- configuration uses old syntax only when access_compat is loaded</changelog>
  <changelog author="pgajdos@suse.com" date="1433419200">- drop mod_qos.conf as it seems to be outdated (see documentation
  for use case examples)</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441627200">- test module with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1443614400">- update to 11.17
- build only for worker mpm</changelog>
  <changelog author="pgajdos@suse.com" date="1443614401">- test module again</changelog>
  <changelog author="pgajdos@suse.com" date="1513684800">- buildrequire apr-util-devel instead of libapr-util1-devel
- buildrequire apr-devel instead of libapr1-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1513771200">- update to 11.45</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1581249601">- version update to 11.65</changelog>
  <changelog author="pgajdos@suse.com" date="1606305600">- version update to 11.66
  - QS_ClientIpFromHeader supports pseudo IP by creating a hash
  of a HTTP request header's value if the header name is prefixed
  by '#', e.g. #Authorization to use the HTTP basic auth header.
  It's also possible to use the client's SSL client certificate's
  subject and issuer DN if you specify #SSL_CLIENT_S_DN instead
  of a real HTTP header name.
  Note: Does not work for IP geolocation.
-</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743768000">- update to 11.76</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Remove deprecated dependency: pcre-devel
  pcre2-devel is now used instead, and both had already been added</changelog>
</package>
<package pkgid="ad0c06687176f4ee18ec98c09066491a9b52932375b5cb4b2d37c48733936c02" name="apache2-mod_qos-debugsource" arch="x86_64">
  <version epoch="0" ver="11.76" rel="2.2"/>
  <changelog author="pgajdos@suse.com" date="1415102400">- call spec-cleaner
- use apache rpm macros
- update to 11.5
  * fixes build
  * see CHANGES.TXT for upstream change log</changelog>
  <changelog author="pgajdos@suse.com" date="1433246400">- configuration uses old syntax only when access_compat is loaded</changelog>
  <changelog author="pgajdos@suse.com" date="1433419200">- drop mod_qos.conf as it seems to be outdated (see documentation
  for use case examples)</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1441627200">- test module with %apache_test_module_load</changelog>
  <changelog author="pgajdos@suse.com" date="1443614400">- update to 11.17
- build only for worker mpm</changelog>
  <changelog author="pgajdos@suse.com" date="1443614401">- test module again</changelog>
  <changelog author="pgajdos@suse.com" date="1513684800">- buildrequire apr-util-devel instead of libapr-util1-devel
- buildrequire apr-devel instead of libapr1-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1513771200">- update to 11.45</changelog>
  <changelog author="pgajdos@suse.com" date="1581249600">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1581249601">- version update to 11.65</changelog>
  <changelog author="pgajdos@suse.com" date="1606305600">- version update to 11.66
  - QS_ClientIpFromHeader supports pseudo IP by creating a hash
  of a HTTP request header's value if the header name is prefixed
  by '#', e.g. #Authorization to use the HTTP basic auth header.
  It's also possible to use the client's SSL client certificate's
  subject and issuer DN if you specify #SSL_CLIENT_S_DN instead
  of a real HTTP header name.
  Note: Does not work for IP geolocation.
-</changelog>
  <changelog author="felix.stegmeier@suse.com" date="1743768000">- update to 11.76</changelog>
  <changelog author="martin.schreiner@suse.com" date="1761048000">- Remove deprecated dependency: pcre-devel
  pcre2-devel is now used instead, and both had already been added</changelog>
</package>
<package pkgid="5e0c6359ee2f82009c0072155becc1cca87bb5148232c646b83c14c348a72825" name="apache2-mod_rivet" arch="src">
  <version epoch="0" ver="3.2.0" rel="2.5"/>
  <changelog author="oehhar@users.sourceforge.net" date="1372680000">- Update to Rivet release 2.1.2</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1373889600">- Added make install-packages to also install packages</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1380715200">- Update to Rivet release 2.1.3 
- Removed make install-packages</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1395144000">- Update to Rivet release 2.1.4</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1403784000">- Update to Rivet release 2.2.0</changelog>
  <changelog author="pgajdos@suse.cz" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.cz" date="1415707200">- no parallel install, it fails randomly</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1436961600">- Update to Rivet release 2.2.3</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: suse_maintenance_mmn_0
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1442318400">- test module with %apache_test_module_curl</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1442404800">- Added support for RHEL 7 and friends by switching apxs path</changelog>
  <changelog author="pgajdos@suse.com" date="1443182400">- apache-rpm-macros now know basic macros also for other
  rpm based distros</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1449489600">- Update to Rivet release 2.2.4</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1459339200">- Update to Rivet release 2.3.0</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1474545600">- Update to Rivet release 2.3.2</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1504785600">- Update to Rivet release 2.3.4</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1518177600">- Update to Rivet release 3.0.1</changelog>
  <changelog author="pgajdos@suse.cz" date="1561636800">- Update to Rivet release 3.1.1</changelog>
  <changelog author="pgajdos@suse.cz" date="1561636801">- Update to Rivet release 3.2.0</changelog>
  <changelog author="pgajdos@suse.cz" date="1718884800">- drop unmaintained apache-rex usage</changelog>
</package>
<package pkgid="6062782e7a5491c61c5ac1681508b0e0809569045b802ed32dd611232414a3b3" name="apache2-mod_rivet" arch="x86_64">
  <version epoch="0" ver="3.2.0" rel="2.5"/>
  <changelog author="pgajdos@suse.cz" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.cz" date="1415707200">- no parallel install, it fails randomly</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1436961600">- Update to Rivet release 2.2.3</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: suse_maintenance_mmn_0
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1442318400">- test module with %apache_test_module_curl</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1442404800">- Added support for RHEL 7 and friends by switching apxs path</changelog>
  <changelog author="pgajdos@suse.com" date="1443182400">- apache-rpm-macros now know basic macros also for other
  rpm based distros</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1449489600">- Update to Rivet release 2.2.4</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1459339200">- Update to Rivet release 2.3.0</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1474545600">- Update to Rivet release 2.3.2</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1504785600">- Update to Rivet release 2.3.4</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1518177600">- Update to Rivet release 3.0.1</changelog>
  <changelog author="pgajdos@suse.cz" date="1561636800">- Update to Rivet release 3.1.1</changelog>
  <changelog author="pgajdos@suse.cz" date="1561636801">- Update to Rivet release 3.2.0</changelog>
  <changelog author="pgajdos@suse.cz" date="1718884800">- drop unmaintained apache-rex usage</changelog>
</package>
<package pkgid="e44cebee97c074da31ed00d768cc099812b5bc3bd3157013a9bce44542f56d45" name="apache2-mod_rivet-debuginfo" arch="x86_64">
  <version epoch="0" ver="3.2.0" rel="2.5"/>
  <changelog author="pgajdos@suse.cz" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.cz" date="1415707200">- no parallel install, it fails randomly</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1436961600">- Update to Rivet release 2.2.3</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: suse_maintenance_mmn_0
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1442318400">- test module with %apache_test_module_curl</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1442404800">- Added support for RHEL 7 and friends by switching apxs path</changelog>
  <changelog author="pgajdos@suse.com" date="1443182400">- apache-rpm-macros now know basic macros also for other
  rpm based distros</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1449489600">- Update to Rivet release 2.2.4</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1459339200">- Update to Rivet release 2.3.0</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1474545600">- Update to Rivet release 2.3.2</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1504785600">- Update to Rivet release 2.3.4</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1518177600">- Update to Rivet release 3.0.1</changelog>
  <changelog author="pgajdos@suse.cz" date="1561636800">- Update to Rivet release 3.1.1</changelog>
  <changelog author="pgajdos@suse.cz" date="1561636801">- Update to Rivet release 3.2.0</changelog>
  <changelog author="pgajdos@suse.cz" date="1718884800">- drop unmaintained apache-rex usage</changelog>
</package>
<package pkgid="5f5aed80f4cae8f88948777a1ef1baa827ade3126dba860fb0d06757435aa416" name="apache2-mod_rivet-debugsource" arch="x86_64">
  <version epoch="0" ver="3.2.0" rel="2.5"/>
  <changelog author="pgajdos@suse.cz" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="pgajdos@suse.cz" date="1415707200">- no parallel install, it fails randomly</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1436961600">- Update to Rivet release 2.2.3</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: suse_maintenance_mmn_0
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1442318400">- test module with %apache_test_module_curl</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1442404800">- Added support for RHEL 7 and friends by switching apxs path</changelog>
  <changelog author="pgajdos@suse.com" date="1443182400">- apache-rpm-macros now know basic macros also for other
  rpm based distros</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1449489600">- Update to Rivet release 2.2.4</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1459339200">- Update to Rivet release 2.3.0</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1474545600">- Update to Rivet release 2.3.2</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1504785600">- Update to Rivet release 2.3.4</changelog>
  <changelog author="oehhar@users.sourceforge.net" date="1518177600">- Update to Rivet release 3.0.1</changelog>
  <changelog author="pgajdos@suse.cz" date="1561636800">- Update to Rivet release 3.1.1</changelog>
  <changelog author="pgajdos@suse.cz" date="1561636801">- Update to Rivet release 3.2.0</changelog>
  <changelog author="pgajdos@suse.cz" date="1718884800">- drop unmaintained apache-rex usage</changelog>
</package>
<package pkgid="38679a545f6c6a7e6cac7c72089ef5d54c894735fb7bb58658f25b05e1202df7" name="apache2-mod_security2" arch="src">
  <version epoch="0" ver="2.9.12" rel="94.2"/>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1438171200">- fix build for lua 5.3
  + apache2-mod_security2-lua-5.3.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1498046400">- Update modsecurity-fixes.patch: additionally include netdb.h in
  order to have gethostbyname defined.</changelog>
  <changelog author="kstreitova@suse.com" date="1506945600">- update to 2.9.2
  * release notes
    https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.2
  * refresh apache2-mod_security2-no_rpath.diff
  * remove apache2-mod_security2-lua-5.3.patch that was applied
    upstream
- remove outdated html pages and diagram (they can be accessed
  online at https://github.com/SpiderLabs/ModSecurity/wiki)
  * Reference-Manual.html.bz2
  * ModSecurity-Frequently-Asked-Questions-FAQ.html.bz2
  * modsecurity_diagram_apache_request_cycle.jpg
- don't pack the whole doc directory as it contains also Makefiles
  or doxygen configuration files
- disable mlogc as we don't pack it and it also can't be built for
  curl &lt;=7.34
- add basic and regression test suite (but disabled for now)
  * add apache2-mod_security2_tests_conf.patch for apache2
    configuration file used for tests that was trying to load
    mpm_worker_module (it's static for our apache2 package)
  * add "BuildRequires: perl-libwww-perl" needed for the test suite</changelog>
  <changelog author="pgajdos@suse.com" date="1513771200">- fix build for SLE_11_SP4: BuildRoot and %deffattr have to be
  present</changelog>
  <changelog author="jengelh@inai.de" date="1514548800">- Trim advertisement and filler wording from descriptions.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- version update to 2.9.3
  * Enable optimization for large stream input by default on IIS
  [Issue #1299 - @victorhora, @zimmerle]
  * Allow 0 length JSON requests.
  [Issue #1822 - @allanbomsft, @zimmerle, @victorhora, @marcstern]
  * Include unanmed JSON values in unnamed ARGS
  [Issue #1577, #1576 - @marcstern, @victorhora, @zimmerle]
  * Fix buffer size for utf8toUnicode transformation
  [Issue #1208 - @katef, @victorhora]
  * Fix sanitizing JSON request bodies in native audit log format
  [p0pr0ck5, @victorhora]
  * IIS: Update Wix installer to bundle a supported CRS version (3.0)
  [@victorhora, @zimmerle]
  * IIS: Update dependencies for Windows build
  [Issue #1848 - @victorhora, @hsluoyz]
  * IIS: Set SecStreamInBodyInspection by default on IIS builds (#1299)
  [Issue #1299 - @victorhora]
  * IIS: Update modsecurity.conf
  [Issue #788 - @victorhora, @brianclark]
  * Add sanity check for a couple malloc() and make code more resilient
  [Issue #979 - @dogbert2, @victorhora, @zimmerl]
  * Fix NetBSD build by renaming the hmac function to avoid conflicts
  [Issue #1241 - @victorhora, @joerg, @sevan]
  * IIS: Windows build, fix duplicate YAJL dir in script
  [Issue #1612 - @allanbomsft, @victorhora]
  * IIS: Remove body prebuffering due to no locking in modsecProcessRequest
  [Issue #1917 - @allanbomsft, @victorhora]
  * Fix mpm-itk / mod_ruid2 compatibility
  [Issue #712 - @ju5t , @derhansen, @meatlayer, @victorhora]
  * Code cosmetics: checks if actionset is not null before use it
  [Issue #1556 - @marcstern, @zimmerle, @victorhora]
  * Only generate SecHashKey when SecHashEngine is On
  [Issue #1671 - @dmuey, @monkburger, @zimmerle]
  * Docs: Reformat README to Markdown and update dependencies
  [Issue #1857 - @hsluoyz, @victorhora]
  * IIS: no lock on ProcessRequest. No reload of config.
  [Issue #1826 - @allanbomsft]
  * IIS: buffer request body before taking lock
  [Issue #1651 - @allanbomsft]
  * good practices: Initialize variables before use it
  [Issue #1889 - Marc Stern]
  * Let body parsers observe SecRequestBodyNoFilesLimit
  [Issue #1613 - @allanbomsft]
  * potential off by one in parse_arguments
  [Issue #1799 - @tinselcity, @zimmerle]
  * Fix utf-8 character encoding conversion
  [Issue #1794 - @tinselcity, @zimmerle]
  * Fix ip tree lookup on netmask content
  [Issue #1793 - @tinselcity, @zimmerle]
  * IIS: set overrideModeDefault to Allow so that individual websites can
  add &lt;ModSecurity ...&gt; to their web.config file
  [Issue #1781 - @default-kramer]
  * modsecurity.conf-recommended: Fix spelling
  [Issue #1721 - @padraigdoran]
  * build: fix when multiple lines for curl version
  [Issue #1771 - @Artistan]
  * Fix arabic charset in unicode_mapping file
  [Issue #1619 - @alaa-ahmed-a]
  * Optionally preallocates memory when SecStreamInBodyInspection is on
  [Issue #1366 - @allanbomsft, @zimmerle]
  * Fixed typo in build_yajl.bat
  [Issue #1366 - @allanbomsft]
  * Fixes SecConnWriteStateLimit
  [Issue #1545 - @nicjansma]
  * Added "empy chunk" check
  [Issue #1347, #1446 - @gravagli, @bostrt, @zimmerle]
  * Add capture action to @detectXSS operator
  [Issue #1488, #1482 - @victorhora]
  * Fix for wildcard operator when loading conf files on Nginx / IIS
  [Issue #1486, #1285 - @victorhora and @thierry-f-78]
  * Set of fixies to make windows build workable with the buildbots
  [Commit 94fe3 - @zimmerle]
  * Uses LOG_NO_STOPWATCH instead of DLOG_NO_STOPWATCH
  [Issue #1510 - @marcstern]
  * Adds missing headers
  [Issue #1454 - @devnexen]
- modified patches
  % modsecurity-fixes.patch (fix crash caused by our patch)
    [bsc#1180830]
- added patches
  + modsecurity-2.9.3-input_filtering_errors.patch
    [bsc#1180830]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626696000">- Update to 2.9.4:
  * Add microsec timestamp resolution to the formatted log timestamp
  * Added missing Geo Countries
  * Store temporaries in the request pool for regexes compiled per-request.
  * Fix other usage of the global pool for request temporaries in re_operators.c
  * Adds a sanity check before use ctl:ruleRemoveTargetById and ctl:ruleRemoveTargetByMsg.
  * Fix the order of error_msg validation
  * When the input filter finishes, check whether we returned data
  * fix: care non-null terminated chunk data
  * Fix for apr_global_mutex_create() crashes with mod_security
  * Fix inet addr handling on 64 bit big endian systems
- Run spec-cleaner
- Remove if/else for older version of SUSE distribution</changelog>
  <changelog author="dmueller@suse.com" date="1689422400">- update to 2.9.7:
  * Fix: FILES_TMP_CONTENT may sometimes lack complete content
  * Support configurable limit on number of arguments processed
  * Silence compiler warning about discarded const
  * Support for JIT option for PCRE2
  * Use uid for user if apr_uid_name_get() fails
  * Fix: handle error with SecConnReadStateLimit configuration
  * Only check for pcre2 install if required
  * Adjustment of previous fix for log messages
  * Mark apache error log messages as from mod_security2
  * Use pkg-config to find libxml2 first
  * Support for PCRE2 in mlogc
  * Support for PCRE2
  * Adjust parser activation rules in modsecurity.conf-
    recommended
  * Multipart parsing fixes and new MULTIPART_PART_HEADERS
    collection
  * Limit rsub null termination to where necessary
  * IIS: Update dependencies for next planned release
  * XML parser cleanup: NULL duplicate pointer
  * Properly cleanup XML parser contexts upon completion
  * Fix memory leak in streams
  * Fix: negative usec on log line when data type long is 32b
  * mlogc log-line parsing fails due to enhanced timestamp
  * Allow no-key, single-value JSON body
  * Set SecStatusEngine Off in modsecurity.conf-recommended
  * Fix memory leak that occurs on JSON parsing error
  * Multipart names/filenames may include single quote if double-
    quote enclosed
  * Add SecRequestBodyJsonDepthLimit to modsecurity.conf-
    recommended
  * IIS: Update dependencies for Windows build as of v2.9.5
  * Support configurable limit on depth of JSON parsing
- fixes CVE-2022-48279 [bsc#1207378], CVE-2023-24021 [bsc#1207379]</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1715083200">- added patches
  fix fix build with gcc14
  + apache2-mod_security2-gcc14.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1717502400">- Fix patch application syntax: Use %patch -P N instead of
  deprecated %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1717502401">- %autopatch instead of %patchN
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1737460800">- package cleanup, coordinated with owasp-modsecurity-crs cleanup
- version update to 2.9.8 (changed upstream: Trustwave -&gt; OWASP)
  * Fixed ap_log_perror() usage
  * Memory leaks + enhanced logging
  * CI improvement: First check syntax &amp; always display error/audit logs
  * Fixed assert() usage
  * Removed useless code
  * feat: Check if the MP header contains invalid character
  * Use standard httpd logging format in error log
  * fix msc_regexec() != PCRE_ERROR_NOMATCH strict check
  * Move xmlFree() call to the right place
  * Add collection size in log in case of writing error
  * Passing address of lock instead of lock in acquire_global_lock()
  * Invalid pointer access in case rule id == NOT_SET_P
  * Show error.log after httpd start in CI
  * chore: add pull request template
  * chore: add gitignore file
  * Possible double free
  * Set 'jit' variable's initial value
  * Missing null byte + optimization
  * fix: remove usage of insecure tmpname
  * docs: update copyright
  * Enhanced logging [Issue #3107]
  * Check for null pointer dereference (almost) everywhere
  * Fix possible segfault in collection_unpack
  * fix: Replace obsolete macros
  * chore: update bug-report-for-version-2-x.md
  * feat: Add more steps: install built module and restart the server
  * Add new flag: --without-lua
  * Initial release of CI worklow
  * V2/fixbuildissue
  * ; incorrectly replaced by space in cmdline
  * Detailed error message when writing collections
  * docs: Fix organization name in references and security e-mail (v2)
  * ctl:ruleRemoveByTag isn't executed if no rule id is present in the rule
  * Suppress useless loop on tag matching
  * Optimization: Avoid last loop and storing an empty value in case nothing
    after last %{..} macro
  * Ignore (consistently) empty actions
  * Add context info to error message
  * Implement msre_action_phase_validate()
  * Avoid some useless code and memory allocation in case no macro is present
  * 'jit' variable not initialized when WITH_PCRE2 is defined
  * Configure: do not check for pcre1 if pcre2 requested
  * Double memory allocation
  * Fix for DEBUG_CONF compile flag
  * Enhance logging
  * Fix possible segfault in collection_unpack
  * Set the minimum security protocol version for SecRemoteRules
  * Allow lua version 5.4
  * Configure: do not check for pcre1 if pcre2 requested
  * Check return code of apr_procattr_io_set()
  * Do not escape special chars in rx pattern with macro
  * Substitute two equals-equals operators in build
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)
  % modsecurity-2.9.3-input_filtering_errors.patch (refreshed)
  % modsecurity-fixes.patch (refreshed)
- added sources
  + apache2-mod_security2.keyring</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1741953600">- build with pcre2 (test suite disabled temporarily)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1748865600">- update to 2.9.10:
  * CVE-2025-48866: excessive number of arguments in sanitiseArg
    can lead to a denial of service due to high memory consumption
    (boo#1243976)
- includes changes from 2.9.9:
  * CVE-2025-47947: DoS through sanitiseMatchedBytes (boo#1243978)
  * log error codes for global mutex failure modes
  * Fix error logging for standalone module
  * improved XMLArgs processing
  * Incorrect utf8toUnicode transformation for 00xx
  * PCRE2 compatibility fixes
  * gcc14 fixes, developer visible fixes
- drop apache2-mod_security2-gcc14.patch
- run tests again as they are now fixed with pcre2</changelog>
  <changelog author="pgajdos@suse.com" date="1751544000">- version update to 2.9.11 [bsc#1245620] (CVE-2025-52891)
  * fix: prevent segmentation fault if the XML node is empty
  * Plug memory leak when msre_op_validateSchema_execute() exits normally (validateSchema)
  * chore: bump version in MSI installer.wxs
  * Fix resource leaks in `msc_status_engine_mac_address`
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)
  % modsecurity-fixes.patch (refreshed)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1754481600">- update to 2.9.12:
  * CVE-2025-54571: Improper error handling (boo#1247674)
  * remove unused condition from msc_status_engine.c
  * remove unwanted '\0' string terminator from argument's valu
- drop modsecurity-2.9.3-input_filtering_errors.patch different
  change included upstream</changelog>
</package>
<package pkgid="e5180d268aee03961b83693ae4ca5edbd81260178b6c318fda4cba9258d0990c" name="apache2-mod_security2" arch="x86_64">
  <version epoch="0" ver="2.9.12" rel="94.2"/>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1438171200">- fix build for lua 5.3
  + apache2-mod_security2-lua-5.3.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1498046400">- Update modsecurity-fixes.patch: additionally include netdb.h in
  order to have gethostbyname defined.</changelog>
  <changelog author="kstreitova@suse.com" date="1506945600">- update to 2.9.2
  * release notes
    https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.2
  * refresh apache2-mod_security2-no_rpath.diff
  * remove apache2-mod_security2-lua-5.3.patch that was applied
    upstream
- remove outdated html pages and diagram (they can be accessed
  online at https://github.com/SpiderLabs/ModSecurity/wiki)
  * Reference-Manual.html.bz2
  * ModSecurity-Frequently-Asked-Questions-FAQ.html.bz2
  * modsecurity_diagram_apache_request_cycle.jpg
- don't pack the whole doc directory as it contains also Makefiles
  or doxygen configuration files
- disable mlogc as we don't pack it and it also can't be built for
  curl &lt;=7.34
- add basic and regression test suite (but disabled for now)
  * add apache2-mod_security2_tests_conf.patch for apache2
    configuration file used for tests that was trying to load
    mpm_worker_module (it's static for our apache2 package)
  * add "BuildRequires: perl-libwww-perl" needed for the test suite</changelog>
  <changelog author="pgajdos@suse.com" date="1513771200">- fix build for SLE_11_SP4: BuildRoot and %deffattr have to be
  present</changelog>
  <changelog author="jengelh@inai.de" date="1514548800">- Trim advertisement and filler wording from descriptions.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- version update to 2.9.3
  * Enable optimization for large stream input by default on IIS
  [Issue #1299 - @victorhora, @zimmerle]
  * Allow 0 length JSON requests.
  [Issue #1822 - @allanbomsft, @zimmerle, @victorhora, @marcstern]
  * Include unanmed JSON values in unnamed ARGS
  [Issue #1577, #1576 - @marcstern, @victorhora, @zimmerle]
  * Fix buffer size for utf8toUnicode transformation
  [Issue #1208 - @katef, @victorhora]
  * Fix sanitizing JSON request bodies in native audit log format
  [p0pr0ck5, @victorhora]
  * IIS: Update Wix installer to bundle a supported CRS version (3.0)
  [@victorhora, @zimmerle]
  * IIS: Update dependencies for Windows build
  [Issue #1848 - @victorhora, @hsluoyz]
  * IIS: Set SecStreamInBodyInspection by default on IIS builds (#1299)
  [Issue #1299 - @victorhora]
  * IIS: Update modsecurity.conf
  [Issue #788 - @victorhora, @brianclark]
  * Add sanity check for a couple malloc() and make code more resilient
  [Issue #979 - @dogbert2, @victorhora, @zimmerl]
  * Fix NetBSD build by renaming the hmac function to avoid conflicts
  [Issue #1241 - @victorhora, @joerg, @sevan]
  * IIS: Windows build, fix duplicate YAJL dir in script
  [Issue #1612 - @allanbomsft, @victorhora]
  * IIS: Remove body prebuffering due to no locking in modsecProcessRequest
  [Issue #1917 - @allanbomsft, @victorhora]
  * Fix mpm-itk / mod_ruid2 compatibility
  [Issue #712 - @ju5t , @derhansen, @meatlayer, @victorhora]
  * Code cosmetics: checks if actionset is not null before use it
  [Issue #1556 - @marcstern, @zimmerle, @victorhora]
  * Only generate SecHashKey when SecHashEngine is On
  [Issue #1671 - @dmuey, @monkburger, @zimmerle]
  * Docs: Reformat README to Markdown and update dependencies
  [Issue #1857 - @hsluoyz, @victorhora]
  * IIS: no lock on ProcessRequest. No reload of config.
  [Issue #1826 - @allanbomsft]
  * IIS: buffer request body before taking lock
  [Issue #1651 - @allanbomsft]
  * good practices: Initialize variables before use it
  [Issue #1889 - Marc Stern]
  * Let body parsers observe SecRequestBodyNoFilesLimit
  [Issue #1613 - @allanbomsft]
  * potential off by one in parse_arguments
  [Issue #1799 - @tinselcity, @zimmerle]
  * Fix utf-8 character encoding conversion
  [Issue #1794 - @tinselcity, @zimmerle]
  * Fix ip tree lookup on netmask content
  [Issue #1793 - @tinselcity, @zimmerle]
  * IIS: set overrideModeDefault to Allow so that individual websites can
  add &lt;ModSecurity ...&gt; to their web.config file
  [Issue #1781 - @default-kramer]
  * modsecurity.conf-recommended: Fix spelling
  [Issue #1721 - @padraigdoran]
  * build: fix when multiple lines for curl version
  [Issue #1771 - @Artistan]
  * Fix arabic charset in unicode_mapping file
  [Issue #1619 - @alaa-ahmed-a]
  * Optionally preallocates memory when SecStreamInBodyInspection is on
  [Issue #1366 - @allanbomsft, @zimmerle]
  * Fixed typo in build_yajl.bat
  [Issue #1366 - @allanbomsft]
  * Fixes SecConnWriteStateLimit
  [Issue #1545 - @nicjansma]
  * Added "empy chunk" check
  [Issue #1347, #1446 - @gravagli, @bostrt, @zimmerle]
  * Add capture action to @detectXSS operator
  [Issue #1488, #1482 - @victorhora]
  * Fix for wildcard operator when loading conf files on Nginx / IIS
  [Issue #1486, #1285 - @victorhora and @thierry-f-78]
  * Set of fixies to make windows build workable with the buildbots
  [Commit 94fe3 - @zimmerle]
  * Uses LOG_NO_STOPWATCH instead of DLOG_NO_STOPWATCH
  [Issue #1510 - @marcstern]
  * Adds missing headers
  [Issue #1454 - @devnexen]
- modified patches
  % modsecurity-fixes.patch (fix crash caused by our patch)
    [bsc#1180830]
- added patches
  + modsecurity-2.9.3-input_filtering_errors.patch
    [bsc#1180830]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626696000">- Update to 2.9.4:
  * Add microsec timestamp resolution to the formatted log timestamp
  * Added missing Geo Countries
  * Store temporaries in the request pool for regexes compiled per-request.
  * Fix other usage of the global pool for request temporaries in re_operators.c
  * Adds a sanity check before use ctl:ruleRemoveTargetById and ctl:ruleRemoveTargetByMsg.
  * Fix the order of error_msg validation
  * When the input filter finishes, check whether we returned data
  * fix: care non-null terminated chunk data
  * Fix for apr_global_mutex_create() crashes with mod_security
  * Fix inet addr handling on 64 bit big endian systems
- Run spec-cleaner
- Remove if/else for older version of SUSE distribution</changelog>
  <changelog author="dmueller@suse.com" date="1689422400">- update to 2.9.7:
  * Fix: FILES_TMP_CONTENT may sometimes lack complete content
  * Support configurable limit on number of arguments processed
  * Silence compiler warning about discarded const
  * Support for JIT option for PCRE2
  * Use uid for user if apr_uid_name_get() fails
  * Fix: handle error with SecConnReadStateLimit configuration
  * Only check for pcre2 install if required
  * Adjustment of previous fix for log messages
  * Mark apache error log messages as from mod_security2
  * Use pkg-config to find libxml2 first
  * Support for PCRE2 in mlogc
  * Support for PCRE2
  * Adjust parser activation rules in modsecurity.conf-
    recommended
  * Multipart parsing fixes and new MULTIPART_PART_HEADERS
    collection
  * Limit rsub null termination to where necessary
  * IIS: Update dependencies for next planned release
  * XML parser cleanup: NULL duplicate pointer
  * Properly cleanup XML parser contexts upon completion
  * Fix memory leak in streams
  * Fix: negative usec on log line when data type long is 32b
  * mlogc log-line parsing fails due to enhanced timestamp
  * Allow no-key, single-value JSON body
  * Set SecStatusEngine Off in modsecurity.conf-recommended
  * Fix memory leak that occurs on JSON parsing error
  * Multipart names/filenames may include single quote if double-
    quote enclosed
  * Add SecRequestBodyJsonDepthLimit to modsecurity.conf-
    recommended
  * IIS: Update dependencies for Windows build as of v2.9.5
  * Support configurable limit on depth of JSON parsing
- fixes CVE-2022-48279 [bsc#1207378], CVE-2023-24021 [bsc#1207379]</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1715083200">- added patches
  fix fix build with gcc14
  + apache2-mod_security2-gcc14.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1717502400">- Fix patch application syntax: Use %patch -P N instead of
  deprecated %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1717502401">- %autopatch instead of %patchN
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1737460800">- package cleanup, coordinated with owasp-modsecurity-crs cleanup
- version update to 2.9.8 (changed upstream: Trustwave -&gt; OWASP)
  * Fixed ap_log_perror() usage
  * Memory leaks + enhanced logging
  * CI improvement: First check syntax &amp; always display error/audit logs
  * Fixed assert() usage
  * Removed useless code
  * feat: Check if the MP header contains invalid character
  * Use standard httpd logging format in error log
  * fix msc_regexec() != PCRE_ERROR_NOMATCH strict check
  * Move xmlFree() call to the right place
  * Add collection size in log in case of writing error
  * Passing address of lock instead of lock in acquire_global_lock()
  * Invalid pointer access in case rule id == NOT_SET_P
  * Show error.log after httpd start in CI
  * chore: add pull request template
  * chore: add gitignore file
  * Possible double free
  * Set 'jit' variable's initial value
  * Missing null byte + optimization
  * fix: remove usage of insecure tmpname
  * docs: update copyright
  * Enhanced logging [Issue #3107]
  * Check for null pointer dereference (almost) everywhere
  * Fix possible segfault in collection_unpack
  * fix: Replace obsolete macros
  * chore: update bug-report-for-version-2-x.md
  * feat: Add more steps: install built module and restart the server
  * Add new flag: --without-lua
  * Initial release of CI worklow
  * V2/fixbuildissue
  * ; incorrectly replaced by space in cmdline
  * Detailed error message when writing collections
  * docs: Fix organization name in references and security e-mail (v2)
  * ctl:ruleRemoveByTag isn't executed if no rule id is present in the rule
  * Suppress useless loop on tag matching
  * Optimization: Avoid last loop and storing an empty value in case nothing
    after last %{..} macro
  * Ignore (consistently) empty actions
  * Add context info to error message
  * Implement msre_action_phase_validate()
  * Avoid some useless code and memory allocation in case no macro is present
  * 'jit' variable not initialized when WITH_PCRE2 is defined
  * Configure: do not check for pcre1 if pcre2 requested
  * Double memory allocation
  * Fix for DEBUG_CONF compile flag
  * Enhance logging
  * Fix possible segfault in collection_unpack
  * Set the minimum security protocol version for SecRemoteRules
  * Allow lua version 5.4
  * Configure: do not check for pcre1 if pcre2 requested
  * Check return code of apr_procattr_io_set()
  * Do not escape special chars in rx pattern with macro
  * Substitute two equals-equals operators in build
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)
  % modsecurity-2.9.3-input_filtering_errors.patch (refreshed)
  % modsecurity-fixes.patch (refreshed)
- added sources
  + apache2-mod_security2.keyring</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1741953600">- build with pcre2 (test suite disabled temporarily)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1748865600">- update to 2.9.10:
  * CVE-2025-48866: excessive number of arguments in sanitiseArg
    can lead to a denial of service due to high memory consumption
    (boo#1243976)
- includes changes from 2.9.9:
  * CVE-2025-47947: DoS through sanitiseMatchedBytes (boo#1243978)
  * log error codes for global mutex failure modes
  * Fix error logging for standalone module
  * improved XMLArgs processing
  * Incorrect utf8toUnicode transformation for 00xx
  * PCRE2 compatibility fixes
  * gcc14 fixes, developer visible fixes
- drop apache2-mod_security2-gcc14.patch
- run tests again as they are now fixed with pcre2</changelog>
  <changelog author="pgajdos@suse.com" date="1751544000">- version update to 2.9.11 [bsc#1245620] (CVE-2025-52891)
  * fix: prevent segmentation fault if the XML node is empty
  * Plug memory leak when msre_op_validateSchema_execute() exits normally (validateSchema)
  * chore: bump version in MSI installer.wxs
  * Fix resource leaks in `msc_status_engine_mac_address`
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)
  % modsecurity-fixes.patch (refreshed)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1754481600">- update to 2.9.12:
  * CVE-2025-54571: Improper error handling (boo#1247674)
  * remove unused condition from msc_status_engine.c
  * remove unwanted '\0' string terminator from argument's valu
- drop modsecurity-2.9.3-input_filtering_errors.patch different
  change included upstream</changelog>
</package>
<package pkgid="bc4d5a2aa3e39b78171dbbc197aa0ead2b43b786e3d1030c694544b8a3bd6c14" name="apache2-mod_security2-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.9.12" rel="94.2"/>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1438171200">- fix build for lua 5.3
  + apache2-mod_security2-lua-5.3.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1498046400">- Update modsecurity-fixes.patch: additionally include netdb.h in
  order to have gethostbyname defined.</changelog>
  <changelog author="kstreitova@suse.com" date="1506945600">- update to 2.9.2
  * release notes
    https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.2
  * refresh apache2-mod_security2-no_rpath.diff
  * remove apache2-mod_security2-lua-5.3.patch that was applied
    upstream
- remove outdated html pages and diagram (they can be accessed
  online at https://github.com/SpiderLabs/ModSecurity/wiki)
  * Reference-Manual.html.bz2
  * ModSecurity-Frequently-Asked-Questions-FAQ.html.bz2
  * modsecurity_diagram_apache_request_cycle.jpg
- don't pack the whole doc directory as it contains also Makefiles
  or doxygen configuration files
- disable mlogc as we don't pack it and it also can't be built for
  curl &lt;=7.34
- add basic and regression test suite (but disabled for now)
  * add apache2-mod_security2_tests_conf.patch for apache2
    configuration file used for tests that was trying to load
    mpm_worker_module (it's static for our apache2 package)
  * add "BuildRequires: perl-libwww-perl" needed for the test suite</changelog>
  <changelog author="pgajdos@suse.com" date="1513771200">- fix build for SLE_11_SP4: BuildRoot and %deffattr have to be
  present</changelog>
  <changelog author="jengelh@inai.de" date="1514548800">- Trim advertisement and filler wording from descriptions.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- version update to 2.9.3
  * Enable optimization for large stream input by default on IIS
  [Issue #1299 - @victorhora, @zimmerle]
  * Allow 0 length JSON requests.
  [Issue #1822 - @allanbomsft, @zimmerle, @victorhora, @marcstern]
  * Include unanmed JSON values in unnamed ARGS
  [Issue #1577, #1576 - @marcstern, @victorhora, @zimmerle]
  * Fix buffer size for utf8toUnicode transformation
  [Issue #1208 - @katef, @victorhora]
  * Fix sanitizing JSON request bodies in native audit log format
  [p0pr0ck5, @victorhora]
  * IIS: Update Wix installer to bundle a supported CRS version (3.0)
  [@victorhora, @zimmerle]
  * IIS: Update dependencies for Windows build
  [Issue #1848 - @victorhora, @hsluoyz]
  * IIS: Set SecStreamInBodyInspection by default on IIS builds (#1299)
  [Issue #1299 - @victorhora]
  * IIS: Update modsecurity.conf
  [Issue #788 - @victorhora, @brianclark]
  * Add sanity check for a couple malloc() and make code more resilient
  [Issue #979 - @dogbert2, @victorhora, @zimmerl]
  * Fix NetBSD build by renaming the hmac function to avoid conflicts
  [Issue #1241 - @victorhora, @joerg, @sevan]
  * IIS: Windows build, fix duplicate YAJL dir in script
  [Issue #1612 - @allanbomsft, @victorhora]
  * IIS: Remove body prebuffering due to no locking in modsecProcessRequest
  [Issue #1917 - @allanbomsft, @victorhora]
  * Fix mpm-itk / mod_ruid2 compatibility
  [Issue #712 - @ju5t , @derhansen, @meatlayer, @victorhora]
  * Code cosmetics: checks if actionset is not null before use it
  [Issue #1556 - @marcstern, @zimmerle, @victorhora]
  * Only generate SecHashKey when SecHashEngine is On
  [Issue #1671 - @dmuey, @monkburger, @zimmerle]
  * Docs: Reformat README to Markdown and update dependencies
  [Issue #1857 - @hsluoyz, @victorhora]
  * IIS: no lock on ProcessRequest. No reload of config.
  [Issue #1826 - @allanbomsft]
  * IIS: buffer request body before taking lock
  [Issue #1651 - @allanbomsft]
  * good practices: Initialize variables before use it
  [Issue #1889 - Marc Stern]
  * Let body parsers observe SecRequestBodyNoFilesLimit
  [Issue #1613 - @allanbomsft]
  * potential off by one in parse_arguments
  [Issue #1799 - @tinselcity, @zimmerle]
  * Fix utf-8 character encoding conversion
  [Issue #1794 - @tinselcity, @zimmerle]
  * Fix ip tree lookup on netmask content
  [Issue #1793 - @tinselcity, @zimmerle]
  * IIS: set overrideModeDefault to Allow so that individual websites can
  add &lt;ModSecurity ...&gt; to their web.config file
  [Issue #1781 - @default-kramer]
  * modsecurity.conf-recommended: Fix spelling
  [Issue #1721 - @padraigdoran]
  * build: fix when multiple lines for curl version
  [Issue #1771 - @Artistan]
  * Fix arabic charset in unicode_mapping file
  [Issue #1619 - @alaa-ahmed-a]
  * Optionally preallocates memory when SecStreamInBodyInspection is on
  [Issue #1366 - @allanbomsft, @zimmerle]
  * Fixed typo in build_yajl.bat
  [Issue #1366 - @allanbomsft]
  * Fixes SecConnWriteStateLimit
  [Issue #1545 - @nicjansma]
  * Added "empy chunk" check
  [Issue #1347, #1446 - @gravagli, @bostrt, @zimmerle]
  * Add capture action to @detectXSS operator
  [Issue #1488, #1482 - @victorhora]
  * Fix for wildcard operator when loading conf files on Nginx / IIS
  [Issue #1486, #1285 - @victorhora and @thierry-f-78]
  * Set of fixies to make windows build workable with the buildbots
  [Commit 94fe3 - @zimmerle]
  * Uses LOG_NO_STOPWATCH instead of DLOG_NO_STOPWATCH
  [Issue #1510 - @marcstern]
  * Adds missing headers
  [Issue #1454 - @devnexen]
- modified patches
  % modsecurity-fixes.patch (fix crash caused by our patch)
    [bsc#1180830]
- added patches
  + modsecurity-2.9.3-input_filtering_errors.patch
    [bsc#1180830]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626696000">- Update to 2.9.4:
  * Add microsec timestamp resolution to the formatted log timestamp
  * Added missing Geo Countries
  * Store temporaries in the request pool for regexes compiled per-request.
  * Fix other usage of the global pool for request temporaries in re_operators.c
  * Adds a sanity check before use ctl:ruleRemoveTargetById and ctl:ruleRemoveTargetByMsg.
  * Fix the order of error_msg validation
  * When the input filter finishes, check whether we returned data
  * fix: care non-null terminated chunk data
  * Fix for apr_global_mutex_create() crashes with mod_security
  * Fix inet addr handling on 64 bit big endian systems
- Run spec-cleaner
- Remove if/else for older version of SUSE distribution</changelog>
  <changelog author="dmueller@suse.com" date="1689422400">- update to 2.9.7:
  * Fix: FILES_TMP_CONTENT may sometimes lack complete content
  * Support configurable limit on number of arguments processed
  * Silence compiler warning about discarded const
  * Support for JIT option for PCRE2
  * Use uid for user if apr_uid_name_get() fails
  * Fix: handle error with SecConnReadStateLimit configuration
  * Only check for pcre2 install if required
  * Adjustment of previous fix for log messages
  * Mark apache error log messages as from mod_security2
  * Use pkg-config to find libxml2 first
  * Support for PCRE2 in mlogc
  * Support for PCRE2
  * Adjust parser activation rules in modsecurity.conf-
    recommended
  * Multipart parsing fixes and new MULTIPART_PART_HEADERS
    collection
  * Limit rsub null termination to where necessary
  * IIS: Update dependencies for next planned release
  * XML parser cleanup: NULL duplicate pointer
  * Properly cleanup XML parser contexts upon completion
  * Fix memory leak in streams
  * Fix: negative usec on log line when data type long is 32b
  * mlogc log-line parsing fails due to enhanced timestamp
  * Allow no-key, single-value JSON body
  * Set SecStatusEngine Off in modsecurity.conf-recommended
  * Fix memory leak that occurs on JSON parsing error
  * Multipart names/filenames may include single quote if double-
    quote enclosed
  * Add SecRequestBodyJsonDepthLimit to modsecurity.conf-
    recommended
  * IIS: Update dependencies for Windows build as of v2.9.5
  * Support configurable limit on depth of JSON parsing
- fixes CVE-2022-48279 [bsc#1207378], CVE-2023-24021 [bsc#1207379]</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1715083200">- added patches
  fix fix build with gcc14
  + apache2-mod_security2-gcc14.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1717502400">- Fix patch application syntax: Use %patch -P N instead of
  deprecated %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1717502401">- %autopatch instead of %patchN
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1737460800">- package cleanup, coordinated with owasp-modsecurity-crs cleanup
- version update to 2.9.8 (changed upstream: Trustwave -&gt; OWASP)
  * Fixed ap_log_perror() usage
  * Memory leaks + enhanced logging
  * CI improvement: First check syntax &amp; always display error/audit logs
  * Fixed assert() usage
  * Removed useless code
  * feat: Check if the MP header contains invalid character
  * Use standard httpd logging format in error log
  * fix msc_regexec() != PCRE_ERROR_NOMATCH strict check
  * Move xmlFree() call to the right place
  * Add collection size in log in case of writing error
  * Passing address of lock instead of lock in acquire_global_lock()
  * Invalid pointer access in case rule id == NOT_SET_P
  * Show error.log after httpd start in CI
  * chore: add pull request template
  * chore: add gitignore file
  * Possible double free
  * Set 'jit' variable's initial value
  * Missing null byte + optimization
  * fix: remove usage of insecure tmpname
  * docs: update copyright
  * Enhanced logging [Issue #3107]
  * Check for null pointer dereference (almost) everywhere
  * Fix possible segfault in collection_unpack
  * fix: Replace obsolete macros
  * chore: update bug-report-for-version-2-x.md
  * feat: Add more steps: install built module and restart the server
  * Add new flag: --without-lua
  * Initial release of CI worklow
  * V2/fixbuildissue
  * ; incorrectly replaced by space in cmdline
  * Detailed error message when writing collections
  * docs: Fix organization name in references and security e-mail (v2)
  * ctl:ruleRemoveByTag isn't executed if no rule id is present in the rule
  * Suppress useless loop on tag matching
  * Optimization: Avoid last loop and storing an empty value in case nothing
    after last %{..} macro
  * Ignore (consistently) empty actions
  * Add context info to error message
  * Implement msre_action_phase_validate()
  * Avoid some useless code and memory allocation in case no macro is present
  * 'jit' variable not initialized when WITH_PCRE2 is defined
  * Configure: do not check for pcre1 if pcre2 requested
  * Double memory allocation
  * Fix for DEBUG_CONF compile flag
  * Enhance logging
  * Fix possible segfault in collection_unpack
  * Set the minimum security protocol version for SecRemoteRules
  * Allow lua version 5.4
  * Configure: do not check for pcre1 if pcre2 requested
  * Check return code of apr_procattr_io_set()
  * Do not escape special chars in rx pattern with macro
  * Substitute two equals-equals operators in build
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)
  % modsecurity-2.9.3-input_filtering_errors.patch (refreshed)
  % modsecurity-fixes.patch (refreshed)
- added sources
  + apache2-mod_security2.keyring</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1741953600">- build with pcre2 (test suite disabled temporarily)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1748865600">- update to 2.9.10:
  * CVE-2025-48866: excessive number of arguments in sanitiseArg
    can lead to a denial of service due to high memory consumption
    (boo#1243976)
- includes changes from 2.9.9:
  * CVE-2025-47947: DoS through sanitiseMatchedBytes (boo#1243978)
  * log error codes for global mutex failure modes
  * Fix error logging for standalone module
  * improved XMLArgs processing
  * Incorrect utf8toUnicode transformation for 00xx
  * PCRE2 compatibility fixes
  * gcc14 fixes, developer visible fixes
- drop apache2-mod_security2-gcc14.patch
- run tests again as they are now fixed with pcre2</changelog>
  <changelog author="pgajdos@suse.com" date="1751544000">- version update to 2.9.11 [bsc#1245620] (CVE-2025-52891)
  * fix: prevent segmentation fault if the XML node is empty
  * Plug memory leak when msre_op_validateSchema_execute() exits normally (validateSchema)
  * chore: bump version in MSI installer.wxs
  * Fix resource leaks in `msc_status_engine_mac_address`
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)
  % modsecurity-fixes.patch (refreshed)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1754481600">- update to 2.9.12:
  * CVE-2025-54571: Improper error handling (boo#1247674)
  * remove unused condition from msc_status_engine.c
  * remove unwanted '\0' string terminator from argument's valu
- drop modsecurity-2.9.3-input_filtering_errors.patch different
  change included upstream</changelog>
</package>
<package pkgid="d946256d9aa607b3734a85d4bdcfde63e950d9f554b1c67b8de1b48ea08b1d6d" name="apache2-mod_security2-debugsource" arch="x86_64">
  <version epoch="0" ver="2.9.12" rel="94.2"/>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="pgajdos@suse.com" date="1438171200">- fix build for lua 5.3
  + apache2-mod_security2-lua-5.3.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1498046400">- Update modsecurity-fixes.patch: additionally include netdb.h in
  order to have gethostbyname defined.</changelog>
  <changelog author="kstreitova@suse.com" date="1506945600">- update to 2.9.2
  * release notes
    https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.2
  * refresh apache2-mod_security2-no_rpath.diff
  * remove apache2-mod_security2-lua-5.3.patch that was applied
    upstream
- remove outdated html pages and diagram (they can be accessed
  online at https://github.com/SpiderLabs/ModSecurity/wiki)
  * Reference-Manual.html.bz2
  * ModSecurity-Frequently-Asked-Questions-FAQ.html.bz2
  * modsecurity_diagram_apache_request_cycle.jpg
- don't pack the whole doc directory as it contains also Makefiles
  or doxygen configuration files
- disable mlogc as we don't pack it and it also can't be built for
  curl &lt;=7.34
- add basic and regression test suite (but disabled for now)
  * add apache2-mod_security2_tests_conf.patch for apache2
    configuration file used for tests that was trying to load
    mpm_worker_module (it's static for our apache2 package)
  * add "BuildRequires: perl-libwww-perl" needed for the test suite</changelog>
  <changelog author="pgajdos@suse.com" date="1513771200">- fix build for SLE_11_SP4: BuildRoot and %deffattr have to be
  present</changelog>
  <changelog author="jengelh@inai.de" date="1514548800">- Trim advertisement and filler wording from descriptions.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- removing %apache_test_* macros, do not test module just by
  loading the module</changelog>
  <changelog author="pgajdos@suse.com" date="1614081600">- version update to 2.9.3
  * Enable optimization for large stream input by default on IIS
  [Issue #1299 - @victorhora, @zimmerle]
  * Allow 0 length JSON requests.
  [Issue #1822 - @allanbomsft, @zimmerle, @victorhora, @marcstern]
  * Include unanmed JSON values in unnamed ARGS
  [Issue #1577, #1576 - @marcstern, @victorhora, @zimmerle]
  * Fix buffer size for utf8toUnicode transformation
  [Issue #1208 - @katef, @victorhora]
  * Fix sanitizing JSON request bodies in native audit log format
  [p0pr0ck5, @victorhora]
  * IIS: Update Wix installer to bundle a supported CRS version (3.0)
  [@victorhora, @zimmerle]
  * IIS: Update dependencies for Windows build
  [Issue #1848 - @victorhora, @hsluoyz]
  * IIS: Set SecStreamInBodyInspection by default on IIS builds (#1299)
  [Issue #1299 - @victorhora]
  * IIS: Update modsecurity.conf
  [Issue #788 - @victorhora, @brianclark]
  * Add sanity check for a couple malloc() and make code more resilient
  [Issue #979 - @dogbert2, @victorhora, @zimmerl]
  * Fix NetBSD build by renaming the hmac function to avoid conflicts
  [Issue #1241 - @victorhora, @joerg, @sevan]
  * IIS: Windows build, fix duplicate YAJL dir in script
  [Issue #1612 - @allanbomsft, @victorhora]
  * IIS: Remove body prebuffering due to no locking in modsecProcessRequest
  [Issue #1917 - @allanbomsft, @victorhora]
  * Fix mpm-itk / mod_ruid2 compatibility
  [Issue #712 - @ju5t , @derhansen, @meatlayer, @victorhora]
  * Code cosmetics: checks if actionset is not null before use it
  [Issue #1556 - @marcstern, @zimmerle, @victorhora]
  * Only generate SecHashKey when SecHashEngine is On
  [Issue #1671 - @dmuey, @monkburger, @zimmerle]
  * Docs: Reformat README to Markdown and update dependencies
  [Issue #1857 - @hsluoyz, @victorhora]
  * IIS: no lock on ProcessRequest. No reload of config.
  [Issue #1826 - @allanbomsft]
  * IIS: buffer request body before taking lock
  [Issue #1651 - @allanbomsft]
  * good practices: Initialize variables before use it
  [Issue #1889 - Marc Stern]
  * Let body parsers observe SecRequestBodyNoFilesLimit
  [Issue #1613 - @allanbomsft]
  * potential off by one in parse_arguments
  [Issue #1799 - @tinselcity, @zimmerle]
  * Fix utf-8 character encoding conversion
  [Issue #1794 - @tinselcity, @zimmerle]
  * Fix ip tree lookup on netmask content
  [Issue #1793 - @tinselcity, @zimmerle]
  * IIS: set overrideModeDefault to Allow so that individual websites can
  add &lt;ModSecurity ...&gt; to their web.config file
  [Issue #1781 - @default-kramer]
  * modsecurity.conf-recommended: Fix spelling
  [Issue #1721 - @padraigdoran]
  * build: fix when multiple lines for curl version
  [Issue #1771 - @Artistan]
  * Fix arabic charset in unicode_mapping file
  [Issue #1619 - @alaa-ahmed-a]
  * Optionally preallocates memory when SecStreamInBodyInspection is on
  [Issue #1366 - @allanbomsft, @zimmerle]
  * Fixed typo in build_yajl.bat
  [Issue #1366 - @allanbomsft]
  * Fixes SecConnWriteStateLimit
  [Issue #1545 - @nicjansma]
  * Added "empy chunk" check
  [Issue #1347, #1446 - @gravagli, @bostrt, @zimmerle]
  * Add capture action to @detectXSS operator
  [Issue #1488, #1482 - @victorhora]
  * Fix for wildcard operator when loading conf files on Nginx / IIS
  [Issue #1486, #1285 - @victorhora and @thierry-f-78]
  * Set of fixies to make windows build workable with the buildbots
  [Commit 94fe3 - @zimmerle]
  * Uses LOG_NO_STOPWATCH instead of DLOG_NO_STOPWATCH
  [Issue #1510 - @marcstern]
  * Adds missing headers
  [Issue #1454 - @devnexen]
- modified patches
  % modsecurity-fixes.patch (fix crash caused by our patch)
    [bsc#1180830]
- added patches
  + modsecurity-2.9.3-input_filtering_errors.patch
    [bsc#1180830]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1626696000">- Update to 2.9.4:
  * Add microsec timestamp resolution to the formatted log timestamp
  * Added missing Geo Countries
  * Store temporaries in the request pool for regexes compiled per-request.
  * Fix other usage of the global pool for request temporaries in re_operators.c
  * Adds a sanity check before use ctl:ruleRemoveTargetById and ctl:ruleRemoveTargetByMsg.
  * Fix the order of error_msg validation
  * When the input filter finishes, check whether we returned data
  * fix: care non-null terminated chunk data
  * Fix for apr_global_mutex_create() crashes with mod_security
  * Fix inet addr handling on 64 bit big endian systems
- Run spec-cleaner
- Remove if/else for older version of SUSE distribution</changelog>
  <changelog author="dmueller@suse.com" date="1689422400">- update to 2.9.7:
  * Fix: FILES_TMP_CONTENT may sometimes lack complete content
  * Support configurable limit on number of arguments processed
  * Silence compiler warning about discarded const
  * Support for JIT option for PCRE2
  * Use uid for user if apr_uid_name_get() fails
  * Fix: handle error with SecConnReadStateLimit configuration
  * Only check for pcre2 install if required
  * Adjustment of previous fix for log messages
  * Mark apache error log messages as from mod_security2
  * Use pkg-config to find libxml2 first
  * Support for PCRE2 in mlogc
  * Support for PCRE2
  * Adjust parser activation rules in modsecurity.conf-
    recommended
  * Multipart parsing fixes and new MULTIPART_PART_HEADERS
    collection
  * Limit rsub null termination to where necessary
  * IIS: Update dependencies for next planned release
  * XML parser cleanup: NULL duplicate pointer
  * Properly cleanup XML parser contexts upon completion
  * Fix memory leak in streams
  * Fix: negative usec on log line when data type long is 32b
  * mlogc log-line parsing fails due to enhanced timestamp
  * Allow no-key, single-value JSON body
  * Set SecStatusEngine Off in modsecurity.conf-recommended
  * Fix memory leak that occurs on JSON parsing error
  * Multipart names/filenames may include single quote if double-
    quote enclosed
  * Add SecRequestBodyJsonDepthLimit to modsecurity.conf-
    recommended
  * IIS: Update dependencies for Windows build as of v2.9.5
  * Support configurable limit on depth of JSON parsing
- fixes CVE-2022-48279 [bsc#1207378], CVE-2023-24021 [bsc#1207379]</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1715083200">- added patches
  fix fix build with gcc14
  + apache2-mod_security2-gcc14.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1717502400">- Fix patch application syntax: Use %patch -P N instead of
  deprecated %patchN.</changelog>
  <changelog author="pgajdos@suse.com" date="1717502401">- %autopatch instead of %patchN
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1737460800">- package cleanup, coordinated with owasp-modsecurity-crs cleanup
- version update to 2.9.8 (changed upstream: Trustwave -&gt; OWASP)
  * Fixed ap_log_perror() usage
  * Memory leaks + enhanced logging
  * CI improvement: First check syntax &amp; always display error/audit logs
  * Fixed assert() usage
  * Removed useless code
  * feat: Check if the MP header contains invalid character
  * Use standard httpd logging format in error log
  * fix msc_regexec() != PCRE_ERROR_NOMATCH strict check
  * Move xmlFree() call to the right place
  * Add collection size in log in case of writing error
  * Passing address of lock instead of lock in acquire_global_lock()
  * Invalid pointer access in case rule id == NOT_SET_P
  * Show error.log after httpd start in CI
  * chore: add pull request template
  * chore: add gitignore file
  * Possible double free
  * Set 'jit' variable's initial value
  * Missing null byte + optimization
  * fix: remove usage of insecure tmpname
  * docs: update copyright
  * Enhanced logging [Issue #3107]
  * Check for null pointer dereference (almost) everywhere
  * Fix possible segfault in collection_unpack
  * fix: Replace obsolete macros
  * chore: update bug-report-for-version-2-x.md
  * feat: Add more steps: install built module and restart the server
  * Add new flag: --without-lua
  * Initial release of CI worklow
  * V2/fixbuildissue
  * ; incorrectly replaced by space in cmdline
  * Detailed error message when writing collections
  * docs: Fix organization name in references and security e-mail (v2)
  * ctl:ruleRemoveByTag isn't executed if no rule id is present in the rule
  * Suppress useless loop on tag matching
  * Optimization: Avoid last loop and storing an empty value in case nothing
    after last %{..} macro
  * Ignore (consistently) empty actions
  * Add context info to error message
  * Implement msre_action_phase_validate()
  * Avoid some useless code and memory allocation in case no macro is present
  * 'jit' variable not initialized when WITH_PCRE2 is defined
  * Configure: do not check for pcre1 if pcre2 requested
  * Double memory allocation
  * Fix for DEBUG_CONF compile flag
  * Enhance logging
  * Fix possible segfault in collection_unpack
  * Set the minimum security protocol version for SecRemoteRules
  * Allow lua version 5.4
  * Configure: do not check for pcre1 if pcre2 requested
  * Check return code of apr_procattr_io_set()
  * Do not escape special chars in rx pattern with macro
  * Substitute two equals-equals operators in build
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)
  % modsecurity-2.9.3-input_filtering_errors.patch (refreshed)
  % modsecurity-fixes.patch (refreshed)
- added sources
  + apache2-mod_security2.keyring</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1741953600">- build with pcre2 (test suite disabled temporarily)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1748865600">- update to 2.9.10:
  * CVE-2025-48866: excessive number of arguments in sanitiseArg
    can lead to a denial of service due to high memory consumption
    (boo#1243976)
- includes changes from 2.9.9:
  * CVE-2025-47947: DoS through sanitiseMatchedBytes (boo#1243978)
  * log error codes for global mutex failure modes
  * Fix error logging for standalone module
  * improved XMLArgs processing
  * Incorrect utf8toUnicode transformation for 00xx
  * PCRE2 compatibility fixes
  * gcc14 fixes, developer visible fixes
- drop apache2-mod_security2-gcc14.patch
- run tests again as they are now fixed with pcre2</changelog>
  <changelog author="pgajdos@suse.com" date="1751544000">- version update to 2.9.11 [bsc#1245620] (CVE-2025-52891)
  * fix: prevent segmentation fault if the XML node is empty
  * Plug memory leak when msre_op_validateSchema_execute() exits normally (validateSchema)
  * chore: bump version in MSI installer.wxs
  * Fix resource leaks in `msc_status_engine_mac_address`
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)
  % modsecurity-fixes.patch (refreshed)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1754481600">- update to 2.9.12:
  * CVE-2025-54571: Improper error handling (boo#1247674)
  * remove unused condition from msc_status_engine.c
  * remove unwanted '\0' string terminator from argument's valu
- drop modsecurity-2.9.3-input_filtering_errors.patch different
  change included upstream</changelog>
</package>
<package pkgid="abf99d2237d9e0049e6b831f86302b8db3a6cd756af1f3b99a7f31bd3e5edf13" name="apache2-mod_twilio_signature" arch="src">
  <version epoch="0" ver="1.1.0" rel="1.1"/>
  <changelog author="archie.cobbs@gmail.com" date="1689854400">- Initial commit for release 0.9.0.</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1690027200">- Update to release 0.9.1.
  + Fix potential buffer overflow on malformed signature</changelog>
  <changelog author="pgajdos@suse.com" date="1727697600">- added patches
  fix build with gcc14
  + apache2-mod_twilio_signature-gcc14.patch</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1780747200">- Update to release 1.0.0
  + Try tokens in the order specified, inner contexts before outer
  + Reject with 403 Forbidden instead of 401 Unauthorized
  + Remove upstreamed apache2-mod_twilio_signature-gcc14.patch
  + Add "TwilioSignatureMaxBodySize" directive
  + Fix bug where POST request payloads were being zeroed out
  + Consolidate duplicate auth tokens during config setup
  + Modernize configure.ac and fix compiler warning</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1780833600">- Update to release 1.1.0
  + Fix bug when verifying voice requests over HTTPS
  + Add "TwilioSignatureCallbackType" directive
  + Add "TwilioSignatureExplicitDefaultPorts" directive</changelog>
</package>
<package pkgid="0ab9305648204b82e2f54ab4d17a9b56b571ac5bbb33e17ffcfeb537725a72d0" name="apache2-mod_twilio_signature" arch="x86_64">
  <version epoch="0" ver="1.1.0" rel="1.1"/>
  <changelog author="archie.cobbs@gmail.com" date="1689854400">- Initial commit for release 0.9.0.</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1690027200">- Update to release 0.9.1.
  + Fix potential buffer overflow on malformed signature</changelog>
  <changelog author="pgajdos@suse.com" date="1727697600">- added patches
  fix build with gcc14
  + apache2-mod_twilio_signature-gcc14.patch</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1780747200">- Update to release 1.0.0
  + Try tokens in the order specified, inner contexts before outer
  + Reject with 403 Forbidden instead of 401 Unauthorized
  + Remove upstreamed apache2-mod_twilio_signature-gcc14.patch
  + Add "TwilioSignatureMaxBodySize" directive
  + Fix bug where POST request payloads were being zeroed out
  + Consolidate duplicate auth tokens during config setup
  + Modernize configure.ac and fix compiler warning</changelog>
  <changelog author="archie.cobbs@gmail.com" date="1780833600">- Update to release 1.1.0
  + Fix bug when verifying voice requests over HTTPS
  + Add "TwilioSignatureCallbackType" directive
  + Add "TwilioSignatureExplicitDefaultPorts" directive</changelog>
</package>
<package pkgid="d84784ba4f66b555745d1f4787122f1e0d71cc3b28ffa454fab28afd873e9dfd" name="byacc" arch="src">
  <version epoch="0" ver="20241231" rel="2.1"/>
  <changelog author="mpluskal@suse.com" date="1468324800">- Update to version 20160606:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1485518400">- Update to version 20161202:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1491566400">- Update to version 20170201:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1496664000">- Update to version 20170430:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1531310400">- Update to version 20180609:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1560772800">- Update to version 20190617:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1575633600">- Update to version 20191125:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1585915200">- Update to version 20200330:
  * See attached CHANGES for complete list of changes
- Enable btyacc extension</changelog>
  <changelog author="dmueller@suse.com" date="1600603200">- update to 20200910:
  * LICENSE: RCS_BASE
  * reader.c, output.c: cppcheck -- reduce scope
  update to version 2.0
  improve loop which skips backward through a (possibly nested) sequence of
  square-brackets.
  * reader.c: simplify a check to quiet a bogus cppcheck-warning
  * yacc.1: bump date
  * reader.c: add a note about a bogus cppcheck warning
  always check for gcc attributes, to work around defect in clang's imitation
  of this feature
  * reader.c: cppcheck -- scope reduction
  cppcheck -- eliminate bogus returns after no-return functions
  * verbose.c, output.c, mkpar.c, main.c, warshall.c, lr0.c, lalr.c, graph.c, closure.c:
  cppcheck -- scope reduction</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 20210328:
  * reader.c: ignore bison's "%empty" extension
  * reader.c, defs.h:
    %debug was a trivial bison "extension", mark it as such
  * yacc.1: use italics in a few places where bold was inappropriate
  * reader.c:
    add union tag to YYSTYPE structure for compatibility with a feature which
    bison copied from Solaris yacc (request by Ella Stanforth)
  * closure.c, warshall.c:
    fix undefined-behavior diagnosed with gcc -fsanitize=undefined (report by
    Alexander Richardson)</changelog>
  <changelog author="dmueller@suse.com" date="1627387200">- update to 20210619:
  * btyaccpar.skel, yaccpar.skel: cancel unused assignments
  * output.c: fix gcc warning
  * test/run_test.sh, test/run_lint.sh, test/run_make.sh:
    shellcheck-warnings
  * test/run_test.sh: changes suggested at
    https://github.com/jannick0/byacc-snapshots/tree/YYINT-fix-20210520
  * autotools update</changelog>
  <changelog author="dmueller@suse.com" date="1634385600">- update to 20210808:
  * main.c: account for a memory-leak
  * fix memory-leak when replacing $$'s in destructor code
  * main.c, yacc.1: add "-h" option
  * line number reporting fixes</changelog>
  <changelog author="dmueller@suse.com" date="1656158400">- update to 20220128:
  * change a few malloc's to calloc's so clang analyzer can see initialized data
  * modify address computation in closure.c to avoid undefined behavior on
    machines which do not support large offsets (analysis/patch by Jessica Clarke,
    cf: 2014-09-17)
  * testsuite and autotools/build script fixes</changelog>
  <changelog author="dmueller@suse.com" date="1670068800">- update to 20221106:
  * test/run_test.sh: use context diff, to work with AIX
  * defs.h:
    fprintf_lineno might be passed a null, when reading from stdin - show "(null)"
  * makefile.in, test/run_make.sh, test/run_test.sh, test/run_lint.sh:
    fgrep-fixes
  * yacc.1: mention use of stderr/stdout for usage/debugging
  * yacc.1: document %empty
  * yacc.1: document %debug
  * yacc.1: minor fixes with check-manpage</changelog>
  <changelog author="dmueller@suse.com" date="1672660800">- update to 20221229:
  * autoconf update
  * configure.in:
    correct help-message for --disable-btyacc option, and fix the reporting of
    the selected option value in the configure script's output</changelog>
  <changelog author="avinesh.kumar@suse.com" date="1676635200">- update to 20230201:
  * configure.in: initialize $ac_includes_default
  * aclocal.m4: resync with my-autoconf</changelog>
  <changelog author="dmueller@suse.com" date="1678190400">- update to 20230219:
  * maintenance updates</changelog>
  <changelog author="dmueller@suse.com" date="1685707200">- update to 20230521:
  * error.c, defs.h, reader.c:
    allow @1 or $@ with a warning if no %locations was given
  * reader.c: clear pointer in end_ainfo() after freeing it.
  * reader.c: report errors in %define as "unexpected value"
    add/use macros begin_ainfo() and end_ainfo() to reduce clutter
  * defs.h, error.c: add function unexpected_value()
  * add %nterm as an alias for %type, since bison made that confusion.
  * reader.c:
    ensure that filler_buf and prefix_buf are initialized for the special case
    where they are empty (report by Martin Jansa, cf: 20230219)
  * output.c:
    make test-differences smaller when compiling with YY_NO_LEAKS by replacing
    a blank line with the generated #define rather than adding 3 lines.
  * reader.c:
    correct a use-after-free in more_curly, which could occur if a %lex-param
    or %parse-param was multi-line (Redhat #2183006).
  * main.c: rename no_space() to on_error()
  * error.c: rename no_space() to no_error(), handling any errno
  * defs.h: rename no_space() to on_error()</changelog>
  <changelog author="dmueller@suse.com" date="1710676800">- update to 20240109:
  * maintenance updates</changelog>
  <changelog author="dmueller@suse.com" date="1757678400">- update to 20241231:
  * main.c: s/0/NULL/
  * main.c: gcc warning
  * reader.c:
    make UCH() consistent wrt IS_xxxx macros
  * main.c:
    from NetBSD - if "-o" option is given, derive the filename of the ".h"
    definitions-file by stripping commonly-used C/C++ suffixes such as ".c"
    and then adding ".h"
  * main.c: provide a fallback definition for W_OK, e.g., for Windows
  * main.c: correct condition for using $TEMP environment variable
  * output.c, yaccpar.c: gcc15 zero vs null warnings</changelog>
</package>
<package pkgid="328a44613e59b9f4a188cb6f17d97a06f339664a3b2fe82c80113657997579ed" name="byacc" arch="x86_64">
  <version epoch="0" ver="20241231" rel="2.1"/>
  <changelog author="mpluskal@suse.com" date="1468324800">- Update to version 20160606:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1485518400">- Update to version 20161202:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1491566400">- Update to version 20170201:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1496664000">- Update to version 20170430:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1531310400">- Update to version 20180609:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1560772800">- Update to version 20190617:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1575633600">- Update to version 20191125:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1585915200">- Update to version 20200330:
  * See attached CHANGES for complete list of changes
- Enable btyacc extension</changelog>
  <changelog author="dmueller@suse.com" date="1600603200">- update to 20200910:
  * LICENSE: RCS_BASE
  * reader.c, output.c: cppcheck -- reduce scope
  update to version 2.0
  improve loop which skips backward through a (possibly nested) sequence of
  square-brackets.
  * reader.c: simplify a check to quiet a bogus cppcheck-warning
  * yacc.1: bump date
  * reader.c: add a note about a bogus cppcheck warning
  always check for gcc attributes, to work around defect in clang's imitation
  of this feature
  * reader.c: cppcheck -- scope reduction
  cppcheck -- eliminate bogus returns after no-return functions
  * verbose.c, output.c, mkpar.c, main.c, warshall.c, lr0.c, lalr.c, graph.c, closure.c:
  cppcheck -- scope reduction</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 20210328:
  * reader.c: ignore bison's "%empty" extension
  * reader.c, defs.h:
    %debug was a trivial bison "extension", mark it as such
  * yacc.1: use italics in a few places where bold was inappropriate
  * reader.c:
    add union tag to YYSTYPE structure for compatibility with a feature which
    bison copied from Solaris yacc (request by Ella Stanforth)
  * closure.c, warshall.c:
    fix undefined-behavior diagnosed with gcc -fsanitize=undefined (report by
    Alexander Richardson)</changelog>
  <changelog author="dmueller@suse.com" date="1627387200">- update to 20210619:
  * btyaccpar.skel, yaccpar.skel: cancel unused assignments
  * output.c: fix gcc warning
  * test/run_test.sh, test/run_lint.sh, test/run_make.sh:
    shellcheck-warnings
  * test/run_test.sh: changes suggested at
    https://github.com/jannick0/byacc-snapshots/tree/YYINT-fix-20210520
  * autotools update</changelog>
  <changelog author="dmueller@suse.com" date="1634385600">- update to 20210808:
  * main.c: account for a memory-leak
  * fix memory-leak when replacing $$'s in destructor code
  * main.c, yacc.1: add "-h" option
  * line number reporting fixes</changelog>
  <changelog author="dmueller@suse.com" date="1656158400">- update to 20220128:
  * change a few malloc's to calloc's so clang analyzer can see initialized data
  * modify address computation in closure.c to avoid undefined behavior on
    machines which do not support large offsets (analysis/patch by Jessica Clarke,
    cf: 2014-09-17)
  * testsuite and autotools/build script fixes</changelog>
  <changelog author="dmueller@suse.com" date="1670068800">- update to 20221106:
  * test/run_test.sh: use context diff, to work with AIX
  * defs.h:
    fprintf_lineno might be passed a null, when reading from stdin - show "(null)"
  * makefile.in, test/run_make.sh, test/run_test.sh, test/run_lint.sh:
    fgrep-fixes
  * yacc.1: mention use of stderr/stdout for usage/debugging
  * yacc.1: document %empty
  * yacc.1: document %debug
  * yacc.1: minor fixes with check-manpage</changelog>
  <changelog author="dmueller@suse.com" date="1672660800">- update to 20221229:
  * autoconf update
  * configure.in:
    correct help-message for --disable-btyacc option, and fix the reporting of
    the selected option value in the configure script's output</changelog>
  <changelog author="avinesh.kumar@suse.com" date="1676635200">- update to 20230201:
  * configure.in: initialize $ac_includes_default
  * aclocal.m4: resync with my-autoconf</changelog>
  <changelog author="dmueller@suse.com" date="1678190400">- update to 20230219:
  * maintenance updates</changelog>
  <changelog author="dmueller@suse.com" date="1685707200">- update to 20230521:
  * error.c, defs.h, reader.c:
    allow @1 or $@ with a warning if no %locations was given
  * reader.c: clear pointer in end_ainfo() after freeing it.
  * reader.c: report errors in %define as "unexpected value"
    add/use macros begin_ainfo() and end_ainfo() to reduce clutter
  * defs.h, error.c: add function unexpected_value()
  * add %nterm as an alias for %type, since bison made that confusion.
  * reader.c:
    ensure that filler_buf and prefix_buf are initialized for the special case
    where they are empty (report by Martin Jansa, cf: 20230219)
  * output.c:
    make test-differences smaller when compiling with YY_NO_LEAKS by replacing
    a blank line with the generated #define rather than adding 3 lines.
  * reader.c:
    correct a use-after-free in more_curly, which could occur if a %lex-param
    or %parse-param was multi-line (Redhat #2183006).
  * main.c: rename no_space() to on_error()
  * error.c: rename no_space() to no_error(), handling any errno
  * defs.h: rename no_space() to on_error()</changelog>
  <changelog author="dmueller@suse.com" date="1710676800">- update to 20240109:
  * maintenance updates</changelog>
  <changelog author="dmueller@suse.com" date="1757678400">- update to 20241231:
  * main.c: s/0/NULL/
  * main.c: gcc warning
  * reader.c:
    make UCH() consistent wrt IS_xxxx macros
  * main.c:
    from NetBSD - if "-o" option is given, derive the filename of the ".h"
    definitions-file by stripping commonly-used C/C++ suffixes such as ".c"
    and then adding ".h"
  * main.c: provide a fallback definition for W_OK, e.g., for Windows
  * main.c: correct condition for using $TEMP environment variable
  * output.c, yaccpar.c: gcc15 zero vs null warnings</changelog>
</package>
<package pkgid="f5d0a05df760a0a54cd827a230ab88a1bd56454f43eb54a5afdc0b2be6d64347" name="byacc-debuginfo" arch="x86_64">
  <version epoch="0" ver="20241231" rel="2.1"/>
  <changelog author="mpluskal@suse.com" date="1468324800">- Update to version 20160606:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1485518400">- Update to version 20161202:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1491566400">- Update to version 20170201:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1496664000">- Update to version 20170430:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1531310400">- Update to version 20180609:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1560772800">- Update to version 20190617:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1575633600">- Update to version 20191125:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1585915200">- Update to version 20200330:
  * See attached CHANGES for complete list of changes
- Enable btyacc extension</changelog>
  <changelog author="dmueller@suse.com" date="1600603200">- update to 20200910:
  * LICENSE: RCS_BASE
  * reader.c, output.c: cppcheck -- reduce scope
  update to version 2.0
  improve loop which skips backward through a (possibly nested) sequence of
  square-brackets.
  * reader.c: simplify a check to quiet a bogus cppcheck-warning
  * yacc.1: bump date
  * reader.c: add a note about a bogus cppcheck warning
  always check for gcc attributes, to work around defect in clang's imitation
  of this feature
  * reader.c: cppcheck -- scope reduction
  cppcheck -- eliminate bogus returns after no-return functions
  * verbose.c, output.c, mkpar.c, main.c, warshall.c, lr0.c, lalr.c, graph.c, closure.c:
  cppcheck -- scope reduction</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 20210328:
  * reader.c: ignore bison's "%empty" extension
  * reader.c, defs.h:
    %debug was a trivial bison "extension", mark it as such
  * yacc.1: use italics in a few places where bold was inappropriate
  * reader.c:
    add union tag to YYSTYPE structure for compatibility with a feature which
    bison copied from Solaris yacc (request by Ella Stanforth)
  * closure.c, warshall.c:
    fix undefined-behavior diagnosed with gcc -fsanitize=undefined (report by
    Alexander Richardson)</changelog>
  <changelog author="dmueller@suse.com" date="1627387200">- update to 20210619:
  * btyaccpar.skel, yaccpar.skel: cancel unused assignments
  * output.c: fix gcc warning
  * test/run_test.sh, test/run_lint.sh, test/run_make.sh:
    shellcheck-warnings
  * test/run_test.sh: changes suggested at
    https://github.com/jannick0/byacc-snapshots/tree/YYINT-fix-20210520
  * autotools update</changelog>
  <changelog author="dmueller@suse.com" date="1634385600">- update to 20210808:
  * main.c: account for a memory-leak
  * fix memory-leak when replacing $$'s in destructor code
  * main.c, yacc.1: add "-h" option
  * line number reporting fixes</changelog>
  <changelog author="dmueller@suse.com" date="1656158400">- update to 20220128:
  * change a few malloc's to calloc's so clang analyzer can see initialized data
  * modify address computation in closure.c to avoid undefined behavior on
    machines which do not support large offsets (analysis/patch by Jessica Clarke,
    cf: 2014-09-17)
  * testsuite and autotools/build script fixes</changelog>
  <changelog author="dmueller@suse.com" date="1670068800">- update to 20221106:
  * test/run_test.sh: use context diff, to work with AIX
  * defs.h:
    fprintf_lineno might be passed a null, when reading from stdin - show "(null)"
  * makefile.in, test/run_make.sh, test/run_test.sh, test/run_lint.sh:
    fgrep-fixes
  * yacc.1: mention use of stderr/stdout for usage/debugging
  * yacc.1: document %empty
  * yacc.1: document %debug
  * yacc.1: minor fixes with check-manpage</changelog>
  <changelog author="dmueller@suse.com" date="1672660800">- update to 20221229:
  * autoconf update
  * configure.in:
    correct help-message for --disable-btyacc option, and fix the reporting of
    the selected option value in the configure script's output</changelog>
  <changelog author="avinesh.kumar@suse.com" date="1676635200">- update to 20230201:
  * configure.in: initialize $ac_includes_default
  * aclocal.m4: resync with my-autoconf</changelog>
  <changelog author="dmueller@suse.com" date="1678190400">- update to 20230219:
  * maintenance updates</changelog>
  <changelog author="dmueller@suse.com" date="1685707200">- update to 20230521:
  * error.c, defs.h, reader.c:
    allow @1 or $@ with a warning if no %locations was given
  * reader.c: clear pointer in end_ainfo() after freeing it.
  * reader.c: report errors in %define as "unexpected value"
    add/use macros begin_ainfo() and end_ainfo() to reduce clutter
  * defs.h, error.c: add function unexpected_value()
  * add %nterm as an alias for %type, since bison made that confusion.
  * reader.c:
    ensure that filler_buf and prefix_buf are initialized for the special case
    where they are empty (report by Martin Jansa, cf: 20230219)
  * output.c:
    make test-differences smaller when compiling with YY_NO_LEAKS by replacing
    a blank line with the generated #define rather than adding 3 lines.
  * reader.c:
    correct a use-after-free in more_curly, which could occur if a %lex-param
    or %parse-param was multi-line (Redhat #2183006).
  * main.c: rename no_space() to on_error()
  * error.c: rename no_space() to no_error(), handling any errno
  * defs.h: rename no_space() to on_error()</changelog>
  <changelog author="dmueller@suse.com" date="1710676800">- update to 20240109:
  * maintenance updates</changelog>
  <changelog author="dmueller@suse.com" date="1757678400">- update to 20241231:
  * main.c: s/0/NULL/
  * main.c: gcc warning
  * reader.c:
    make UCH() consistent wrt IS_xxxx macros
  * main.c:
    from NetBSD - if "-o" option is given, derive the filename of the ".h"
    definitions-file by stripping commonly-used C/C++ suffixes such as ".c"
    and then adding ".h"
  * main.c: provide a fallback definition for W_OK, e.g., for Windows
  * main.c: correct condition for using $TEMP environment variable
  * output.c, yaccpar.c: gcc15 zero vs null warnings</changelog>
</package>
<package pkgid="efe2ae2f67db4d5714075899cfb586050bc1a71a7f6f2e0735de0e4e7441227d" name="byacc-debugsource" arch="x86_64">
  <version epoch="0" ver="20241231" rel="2.1"/>
  <changelog author="mpluskal@suse.com" date="1468324800">- Update to version 20160606:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1485518400">- Update to version 20161202:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1491566400">- Update to version 20170201:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1496664000">- Update to version 20170430:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1531310400">- Update to version 20180609:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1560772800">- Update to version 20190617:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1575633600">- Update to version 20191125:
  * See attached CHANGES for complete list of changes</changelog>
  <changelog author="mpluskal@suse.com" date="1585915200">- Update to version 20200330:
  * See attached CHANGES for complete list of changes
- Enable btyacc extension</changelog>
  <changelog author="dmueller@suse.com" date="1600603200">- update to 20200910:
  * LICENSE: RCS_BASE
  * reader.c, output.c: cppcheck -- reduce scope
  update to version 2.0
  improve loop which skips backward through a (possibly nested) sequence of
  square-brackets.
  * reader.c: simplify a check to quiet a bogus cppcheck-warning
  * yacc.1: bump date
  * reader.c: add a note about a bogus cppcheck warning
  always check for gcc attributes, to work around defect in clang's imitation
  of this feature
  * reader.c: cppcheck -- scope reduction
  cppcheck -- eliminate bogus returns after no-return functions
  * verbose.c, output.c, mkpar.c, main.c, warshall.c, lr0.c, lalr.c, graph.c, closure.c:
  cppcheck -- scope reduction</changelog>
  <changelog author="dmueller@suse.com" date="1620475200">- update to 20210328:
  * reader.c: ignore bison's "%empty" extension
  * reader.c, defs.h:
    %debug was a trivial bison "extension", mark it as such
  * yacc.1: use italics in a few places where bold was inappropriate
  * reader.c:
    add union tag to YYSTYPE structure for compatibility with a feature which
    bison copied from Solaris yacc (request by Ella Stanforth)
  * closure.c, warshall.c:
    fix undefined-behavior diagnosed with gcc -fsanitize=undefined (report by
    Alexander Richardson)</changelog>
  <changelog author="dmueller@suse.com" date="1627387200">- update to 20210619:
  * btyaccpar.skel, yaccpar.skel: cancel unused assignments
  * output.c: fix gcc warning
  * test/run_test.sh, test/run_lint.sh, test/run_make.sh:
    shellcheck-warnings
  * test/run_test.sh: changes suggested at
    https://github.com/jannick0/byacc-snapshots/tree/YYINT-fix-20210520
  * autotools update</changelog>
  <changelog author="dmueller@suse.com" date="1634385600">- update to 20210808:
  * main.c: account for a memory-leak
  * fix memory-leak when replacing $$'s in destructor code
  * main.c, yacc.1: add "-h" option
  * line number reporting fixes</changelog>
  <changelog author="dmueller@suse.com" date="1656158400">- update to 20220128:
  * change a few malloc's to calloc's so clang analyzer can see initialized data
  * modify address computation in closure.c to avoid undefined behavior on
    machines which do not support large offsets (analysis/patch by Jessica Clarke,
    cf: 2014-09-17)
  * testsuite and autotools/build script fixes</changelog>
  <changelog author="dmueller@suse.com" date="1670068800">- update to 20221106:
  * test/run_test.sh: use context diff, to work with AIX
  * defs.h:
    fprintf_lineno might be passed a null, when reading from stdin - show "(null)"
  * makefile.in, test/run_make.sh, test/run_test.sh, test/run_lint.sh:
    fgrep-fixes
  * yacc.1: mention use of stderr/stdout for usage/debugging
  * yacc.1: document %empty
  * yacc.1: document %debug
  * yacc.1: minor fixes with check-manpage</changelog>
  <changelog author="dmueller@suse.com" date="1672660800">- update to 20221229:
  * autoconf update
  * configure.in:
    correct help-message for --disable-btyacc option, and fix the reporting of
    the selected option value in the configure script's output</changelog>
  <changelog author="avinesh.kumar@suse.com" date="1676635200">- update to 20230201:
  * configure.in: initialize $ac_includes_default
  * aclocal.m4: resync with my-autoconf</changelog>
  <changelog author="dmueller@suse.com" date="1678190400">- update to 20230219:
  * maintenance updates</changelog>
  <changelog author="dmueller@suse.com" date="1685707200">- update to 20230521:
  * error.c, defs.h, reader.c:
    allow @1 or $@ with a warning if no %locations was given
  * reader.c: clear pointer in end_ainfo() after freeing it.
  * reader.c: report errors in %define as "unexpected value"
    add/use macros begin_ainfo() and end_ainfo() to reduce clutter
  * defs.h, error.c: add function unexpected_value()
  * add %nterm as an alias for %type, since bison made that confusion.
  * reader.c:
    ensure that filler_buf and prefix_buf are initialized for the special case
    where they are empty (report by Martin Jansa, cf: 20230219)
  * output.c:
    make test-differences smaller when compiling with YY_NO_LEAKS by replacing
    a blank line with the generated #define rather than adding 3 lines.
  * reader.c:
    correct a use-after-free in more_curly, which could occur if a %lex-param
    or %parse-param was multi-line (Redhat #2183006).
  * main.c: rename no_space() to on_error()
  * error.c: rename no_space() to no_error(), handling any errno
  * defs.h: rename no_space() to on_error()</changelog>
  <changelog author="dmueller@suse.com" date="1710676800">- update to 20240109:
  * maintenance updates</changelog>
  <changelog author="dmueller@suse.com" date="1757678400">- update to 20241231:
  * main.c: s/0/NULL/
  * main.c: gcc warning
  * reader.c:
    make UCH() consistent wrt IS_xxxx macros
  * main.c:
    from NetBSD - if "-o" option is given, derive the filename of the ".h"
    definitions-file by stripping commonly-used C/C++ suffixes such as ".c"
    and then adding ".h"
  * main.c: provide a fallback definition for W_OK, e.g., for Windows
  * main.c: correct condition for using $TEMP environment variable
  * output.c, yaccpar.c: gcc15 zero vs null warnings</changelog>
</package>
<package pkgid="7b679f65cf1ef794d5423266b69199ed3c9dff1d21d6d0b586ba1bf58dc3b158" name="pwauth" arch="src">
  <version epoch="0" ver="2.3.10" rel="5.1"/>
  <changelog author="mrueckert@suse.de" date="1146225600">- Initial package of version 2.3.2</changelog>
  <changelog author="poeml@suse.de" date="1213099200">- build service supports the debuginfo flag in metadata now; remove
  debug_package macro from the specfile therefore.</changelog>
  <changelog author="mrueckert@suse.de" date="1274184000">- update to 2.3.8
- fix uid in config patch, fixes bnc#457121</changelog>
  <changelog author="pieter@hollants.com" date="1348142400">- update to 2.3.10</changelog>
  <changelog author="pief@hollants.com" date="1348142401">- add pam configuration file</changelog>
  <changelog author="pief@hollants.com" date="1348660800">- add Apache2 configuration fragment</changelog>
  <changelog author="pgajdos@suse.com" date="1606737600">- fix build for 15, clean the spec</changelog>
  <changelog author="pgajdos@suse.com" date="1743595200">- use %autosetup</changelog>
</package>
<package pkgid="70c071731c36d11e5ff13833fe280a77685e3358911087478adfe4ff2594f08d" name="pwauth" arch="x86_64">
  <version epoch="0" ver="2.3.10" rel="5.1"/>
  <changelog author="mrueckert@suse.de" date="1146225600">- Initial package of version 2.3.2</changelog>
  <changelog author="poeml@suse.de" date="1213099200">- build service supports the debuginfo flag in metadata now; remove
  debug_package macro from the specfile therefore.</changelog>
  <changelog author="mrueckert@suse.de" date="1274184000">- update to 2.3.8
- fix uid in config patch, fixes bnc#457121</changelog>
  <changelog author="pieter@hollants.com" date="1348142400">- update to 2.3.10</changelog>
  <changelog author="pief@hollants.com" date="1348142401">- add pam configuration file</changelog>
  <changelog author="pief@hollants.com" date="1348660800">- add Apache2 configuration fragment</changelog>
  <changelog author="pgajdos@suse.com" date="1606737600">- fix build for 15, clean the spec</changelog>
  <changelog author="pgajdos@suse.com" date="1743595200">- use %autosetup</changelog>
</package>
<package pkgid="2ae3b786a95b3f84bcfc7a6c5e400a6ce6419784cf726ecba06264356afca423" name="pwauth-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.3.10" rel="5.1"/>
  <changelog author="mrueckert@suse.de" date="1146225600">- Initial package of version 2.3.2</changelog>
  <changelog author="poeml@suse.de" date="1213099200">- build service supports the debuginfo flag in metadata now; remove
  debug_package macro from the specfile therefore.</changelog>
  <changelog author="mrueckert@suse.de" date="1274184000">- update to 2.3.8
- fix uid in config patch, fixes bnc#457121</changelog>
  <changelog author="pieter@hollants.com" date="1348142400">- update to 2.3.10</changelog>
  <changelog author="pief@hollants.com" date="1348142401">- add pam configuration file</changelog>
  <changelog author="pief@hollants.com" date="1348660800">- add Apache2 configuration fragment</changelog>
  <changelog author="pgajdos@suse.com" date="1606737600">- fix build for 15, clean the spec</changelog>
  <changelog author="pgajdos@suse.com" date="1743595200">- use %autosetup</changelog>
</package>
<package pkgid="d52581eabfcd70ca712799865bf66ade231a7102a6e205bd6337dc45edfdded5" name="pwauth-debugsource" arch="x86_64">
  <version epoch="0" ver="2.3.10" rel="5.1"/>
  <changelog author="mrueckert@suse.de" date="1146225600">- Initial package of version 2.3.2</changelog>
  <changelog author="poeml@suse.de" date="1213099200">- build service supports the debuginfo flag in metadata now; remove
  debug_package macro from the specfile therefore.</changelog>
  <changelog author="mrueckert@suse.de" date="1274184000">- update to 2.3.8
- fix uid in config patch, fixes bnc#457121</changelog>
  <changelog author="pieter@hollants.com" date="1348142400">- update to 2.3.10</changelog>
  <changelog author="pief@hollants.com" date="1348142401">- add pam configuration file</changelog>
  <changelog author="pief@hollants.com" date="1348660800">- add Apache2 configuration fragment</changelog>
  <changelog author="pgajdos@suse.com" date="1606737600">- fix build for 15, clean the spec</changelog>
  <changelog author="pgajdos@suse.com" date="1743595200">- use %autosetup</changelog>
</package>
</otherdata>