# changelog

author: Tim Theisen <tim@cs.wisc.edu> - 5.1.6-1
changelog:
  - HTCondor-CE now uses the C++ Collector plugin for payload job traceability
  - Fix HTCondor-CE mapfiles to be compliant with PCRE2 and HTCondor 9.10.0+
  - Add support for multiple APEL accounting scaling factors
  - Suppress spurious log message about a missing negotiator
  - Fix crash in HTCondor-CE View


author: Tim Theisen <tim@cs.wisc.edu> - 6.0.0-1
changelog:
  - Align HTCondor-CE security configuration with HTCondor defaults
  - Add example configuration on how to ban users
  - Add condor_ce_transform_ads command
  - Improve essential directory checking and creation at startup


author: Tim Theisen <tim@cs.wisc.edu> - 6.0.1-1
changelog:
  - Add grid CA and host certificate/key locations to default SSL search paths
  - Verifies that HTCondor-CE can access the local HTCondor's SPOOL directory
  - Can use condor_ce_trace without SciToken to test batch system integration
  - condor_ce_upgrade_check checks compatibility with next HTCondor version
  - Adds deprecation warnings for old job router configuration syntax


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.6-1
changelog:
  - Fix CE job route transform for job environment
  - Fix CERequirements when the default_CERequirements is not set
  - Add condor_ce_test_token tool to generate short lived SciToken for tests
  - Remove GSI from security method list to eliminate annoying warnings


author: Dave Dykstra <dwd@fnal.gov> 1.14-1
changelog:
  - Add auditlog configuration option.  As part of that, disable the
    vault systemd ProtectFull and ProtectHome options.
  - Require vault >= 1.12.1.
  - Update the vault-plugin-auth-jwt to the latest upstream commit.
  - Include gox in the source tarball.


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Update vault-plugin-secrets-oauthapp to 3.1.1 which adds support for token
    exchange at a /sts path instead of /creds.  Keep applying the PR patch
    that also adds it under /creds for a transition period until htgettoken
    is updated everywhere to use the new path.
  - Update vault-plugin-auth-jwt to 0.15.2.
  - Update vault-plugin-auth-ssh to 0.3.0.
  - Require vault >= 1.13.
  - Require diffutils.
  - Fix bug where the kerberos policydomain option was ignored.


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Add 'ratelimits' keyword to put a limit on the number of requests per
    client per interval.
  - Allow '@' to be included in the ssh plugin's keys.
  - Fix bug that prevented reconfiguration when a policy name changed.
  - Update vault-plugin-auth-jwt to 0.18.0.
  - Update vault-plugin-auth-ssh to 0.3.1.
  - Require vault to be >= 1.15.


author: Dave Dykstra <dwd@fnal.gov> 1.17-1
changelog:
  - Add a patch of PR #90 to vault-plugin-secrets-oauthapp which adds caching
    of tokens exchanged via the /sts path and adds a minimum_seconds option to
    the API.
  - Give vault tokens the capabilities of deleting secrets and revoking
    themselves.
  - Update required vault to 1.17.
  - Update vault-plugin-auth-jwt to 0.21.0.
  - Update vault-plugin-auth-ssh to 0.3.2 which includes the patch for '@' 
    that was previously applied.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Restore patch #41 on vault-plugin-secrets-oauthapp which was accidentally
    dropped.
  - Update to latest commit on vault-plugin-auth-jwt because one of the
    other patches now depends on it in order to apply cleanly.


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.3-1
changelog:
  - The HTCondor-CE central collector requires SSL credentials from client CEs
  - Fix BDII crash if an HTCondor Access Point is not available
  - Fix formatting of APEL records that contain huge values
  - HTCondor-CE client mapfiles are not installed on the central collector


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.4-1
changelog:
  - Fix whole node job glidein CPUs and GPUs expressions that caused held jobs
  - Fix bug where default CERequirements were being ignored
  - Pass whole node request from GlideinWMS to the batch system
  - Since CentOS 8 has reached end of life, we build and test on Rocky Linux 8


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.5-1
changelog:
  - Rename AuthToken attributes in the routed job to better support accounting
  - Prevent GSI environment from pointing the job to the wrong certificates
  - Fix issue where HTCondor-CE would need port 9618 open to start up


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.4.0-2
changelog:
  - Add python3-condor and python3-xrootd build dependencies so we don't build RPMs for repos
    which they can't be installed from.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.5.0-1
changelog:
  - Have the authfile updater get a grid-mapfile from Topology for
    stash-cache-auth and stash-origin-auth (SOFTWARE-5467)


author: Matt Westphall <westphall@wisc.edu> - 3.6.0-1
changelog:
  - Make redirector line in cache config customizable (SOFTWARE-5641)
  - check for *.local files in /etc/xrootd in authfile-updater (SOFTWARE-5597)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.7.0-1
changelog:
  - Make use of grid-mapfile downloaded from Topology.
    Requires osg-xrootd >= 3.6-24 (for OSG 3.6) or >= 23-6 (for OSG 23)


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.2-1
changelog:
  - Fixed the default memory and CPU requests when using job router transforms
  - Apply default MaxJobs and MaxJobsIdle when using job router transforms
  - Improved SciTokens support in submission tools
  - Fixed --debug flag in condor_ce_run
  - Update configuration verification script to handle job router transforms
  - Corrected ownership of the HTCondor PER_JOBS_HISTORY_DIR
  - Fix bug passing maximum wall time requests to the local batch system


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.6.9-1.6
changelog:
  - Split 2269-defer-or-disable-tls-client-auth.patch into 3 patches
    and re-do its conflict resolution (SOFTWARE-5876)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.7.0-1.1
changelog:
  - Update to 5.7.0 and merge OSG patches (SOFTWARE-5925)
      - Drop SOFTWARE-5800-pelican-url.patch (applied upstream)
      - Drop 2206-io-time-gstream-monitoring.patch (applied upstream)
      - Drop SOFTWARE-5870-only-if-cached.patch (applied upstream)
      - Drop 2262-fix-timing-on-throttle-plugin.patch (applied upstream)
      - Drop 2269-defer-or-disable-tls-client-auth-*.patch (applied upstream)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.7.0-1.5
changelog:
  - Bump to rebuild for aarch64
  - Don't make the generated documentation (i.e., xrootd-doc subpackage) noarch
    because the generation results are different based on the arch of the builder.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.7.0-1.7
changelog:
  - Add bbockelm-3-oss-statistics.patch (SOFTWARE-5967)
  - Add bbockelm-4-defer-client-auth (as 3 patches) (SOFTWARE-5968);
      this adds libXrdOssStats-5.so to xrootd-server-libs


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 23-5
changelog:
  - Log DNs of incoming certificates (SOFTWARE-5370); raise required XRootD version to 1:5.6.0 for the feature


author: Derek Weitzel <dweitzel@unl.edu> - 2.3
changelog:
  - Fix tokens that are bigger than 1024 bytes
  - Fix the use of $BEARER_TOKEN when accessing data
  - Allow for multiple read operations, needed on el9


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.27.rc3
changelog:
  - Update to version 2.1.0-rc3
  - Drop patches accepted upstream
  - Add new patches (the PRs have been accepted upstream)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.0-1
changelog:
  - Release hosted-ce-tools 1.0 (SOFTWARE-5130)
  - Convert scripts to python3 (SOFTWARE-5131)
  - Timeout rsync in update-remote-wn-client (SOFTWARE-4670)
  - Dereference hardlinks when extracting tarball (SOFTWARE-5254)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.2.0-1
changelog:
  - Turn osg-configure-rsv into a dummy package (SOFTWARE-4511)
  - Add "queue" to OSG_ResourceCatalog for Pilot sections (SOFTWARE-5881)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 2.1.3-1
changelog:
  - Fail plugin initialization if we can't get the OSS (SOFTWARE-5388)
  - If user cannot be mapped to uid, continue as anonymous
  - Change from named daemon to exec


author: Brian Bockelman <bbockelman@morgridge.org> - 0.9.2-1
changelog:
  - Add support for the `pelican://` protocol, allowing XCache to consume
    the federation metadata directly.


author: Brian Bockelman <bbockelman@morgridge.org> - 0.9.3-1
changelog:
  - Add support for requesting reversed connections from the Pelican connection broker.
  - Plugin no longer drops query parameters when `pelican://` is used; fixes
    issues with missing authorization from URL.


author: Brian Lin <blin@cs.wisc.edu> - 132-1
changelog:
  - Update certificates for FNAL and SLAC VOMS servers
  - Update certificates for CLAS12, EIC, GLOW, and HCC
  - Drop stale certificates for nanohub, STAR, and wisc.edu lz


author: Marco Mambelli <marcom@fnal.gov> - 3.9.6
changelog:
  - Glideinwms v3.9.6
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_9_6/history.html
  - Release candidates 3.9.6-01.rc1 to 3.9.6-06.rc6


author: Marco Mambelli <marcom@fnal.gov> - 3.10.0
changelog:
  - Glideinwms v3.10.0
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_0/history.html
  - Release candidates 3.10.0-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.1
changelog:
  - Glideinwms v3.10.1
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_1/history.html
  - Release candidates 3.10.1-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.2
changelog:
  - Glideinwms v3.10.2
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_2/history.html
  - Release candidates 3.10.2-01.rc1 to 3.10.2-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.3
changelog:
  - Glideinwms v3.10.3
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_3/history.html
  - Release candidates 3.10.3-01.rc1 to 3.10.3-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.6
changelog:
  - Glideinwms v3.10.6
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_6/history.html
  - Release candidates 3.10.6-01.rc1 to 3.10.6-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.7-2
changelog:
  - Glideinwms v3.10.7
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_7/history.html
  - Release candidates 3.10.7-01.rc1 to 3.10.7-03.rc3


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.7.0-1
changelog:
  - Convert osg-system-profiler-viewer to Python 3
  - Add XRootD cconfig dumps (SOFTWARE-4933)
  - Print crypto policy if available (SOFTWARE-5330)
  - Fix email address in help message


author: Brian Lin <blin@cs.wisc.edu> - 0.8.1-1
changelog:
  - Add the --pw-store option to the invocation of oidc-add and add a default
    scope of blank if no scopes are configured.  These are needed for the
    CILogon issuer (SOFTWARE-4983).


author: Carl Edquist <edquist@cs.wisc.edu> - 0.8.2-1
changelog:
  - Increase renewal frequency to ensure continual validity (SOFTWARE-5137)
  - Fix password file handling for restricted permissions in setup script (#17)
  - Use newer --pw-file option for oidc-add (SOFTWARE-5050)
  - Bump version requirement for oidc-agent package (SOFTWARE-5050)


author: Brian Lin <blin@cs.wisc.edu> - 3.6.0
changelog:
  - Add configuration file for osg-incommon-cert-request (SOFTWARE-5668)
  - Update default CSR key length to 4096, add CLI option (SOFTWARE-5651)


author: Brian Lin <blin@cs.wisc.edu> - 3.6.1
changelog:
  - Fix bug with default CA config file option (SOFTWARE-5668)
  - Update default InCommon IGTF CA IDs to point to CA 3


author: Dave Dykstra <dwd@fnal.gov> - 3.7.0
changelog:
  - Convert osg-incommon-cert-request to use urllib3 instead of M2crypto 
    for its https connection, to make it work properly on EL9.


author: Mats Rynge <rynge@isi.edu> 1.7-1
changelog:
  - Moved to the new ospool.osg-htc.org central managers in high
    availability setup
  - Removed pre-9.0 HTCondor config - this is no longer
    supported by the OSPool (IDTOKENS only)
  - Change the VO override to the lowercase "osg" (SOFTWARE-4905)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.8-1
changelog:
  - Include the package version in the schedd classad (SOFTWARE-5105)
  - Disable .sif images on 3.x kernels (OSPOOL-18)
  - Improve OS_VERSION handling
  - Drop Map* ProbeConfig overrides (SOFTWARE-5042)


author: Dave Dykstra <dwd@fnal.gov> 1.17.2-1
changelog:
  - Update to upstream 1.17.2
  - Add a temporary wrapper script on the vault command to avoid an irrelevant
    warning issued by the gosnowflake dependency when DBUS_SESSION_BUS_ADDRESS
    is not set


author: Dave Dykstra <dwd@fnal.gov> 1.17.2-2
changelog:
  - Stop including go in the source tarball, instead assume the build pulls
    in a new enough version of golang.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.0.1-1.1
changelog:
  - Build for OSG; add setuptools_scm build dependency (SOFTWARE-4877)
    Ignore byte-compile errors: they fail on Python 2 code in the examples


author: Carl Edquist <edquist@cs.wisc.edu> - 2.6.3-1
changelog:
  - Restore ProbeConfig symlinks, and other dcache-transfer fixes (SOFTWARE-5241)
  - Replace default_prefix with _datadir; drop relocatable Prefixes


author: Carl Edquist <edquist@cs.wisc.edu> - 2.7.0-1
changelog:
  - Prefer CpusProvisioned over RequestCpus if set (SOFTWARE-5246)
  - Prefer MachineAttrGLIDEIN_ResourceName0 for ResourceName calculation;
  - Include GLIDEIN_ResourceName in SYSTEM_JOB_MACHINE_ATTRS (SOFTWARE-5249)


author: Brian Lin <blin@cs.wisc.edu.> - 2.8.4-1
changelog:
  - HTCondor AP and CE probes now drop privileges to the 'condor' user
    if run as 'root' (SOFTWARE-5531)
  - Improve logging and failure modes when encountering unwriteable
    directories (SOFTWARE-5531)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.6-9
changelog:
  - Replace RPM-GPG-KEY-OSG-3 with something that's accepted by rpm on both EL7 and EL9 (SOFTWARE-5408)


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Fix httokendecode -H functionality to only attempt to convert a parsed word
    if it is entirely numeric, not if it just contains one digit.  At the same
    time, rewrite the functionality in native bash instead of using grep and sed.
  - Add htdestroytoken command.
  - Add a symlink htdecodetoken pointing to httokendecode.


author: Dave Dykstra <dwd@fnal.gov> 1.17-1
changelog:
  - Fix the usage of getaddrinfo, which caused a fatal error on python3.9
    on Mac.
  - Make --showbearerurl work properly in combination with --nobearertoken.
  - Change the httokendecode error message for a missing token file to
    stderr instead of stdin.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Fix crash introduced in 1.17 when using --nobearertoken while the
    credkey is not known.
  - Make source rpm buildable on el9.


author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Update httokensh to by default set the minimum vault token time to live to
    6 days, and to make sure that the background refresh never gets a new vault
    token.
  - Changed the preferred name of httokendecode to htdecodetoken, keeping
    links in the opposite direction.
  - Add man pages for httokensh, htdestroytoken, and htdecodetoken.


author: Dave Dykstra <dwd@fnal.gov> 2.0-1
changelog:
  - Replace use of m2crypto and pyOpenSSL with urllib3
  - Replace use of pykerberos with gssapi
  - Use standard Requires for Python modules instead of PyInstaller
  - Add --vaultcertname option to specify an alternative certificate name.
    That used to be an additional optional meaning of the --vaultalias option,
    but urllib3 requires only one name to match.
  - Add setuptools build infrastructure
  - Refactor htgettoken script into module with entry point.
    This enables invoking htgettoken as `htgettoken.main()` from Python.
  - Use wheels to build/install Python package, which simplified the entry
    points and improves (slightly) the metadata
  - Fix the httokensh background process's check for its parent process.
    That is only a backup in case only the parent process is hard-killed,
    because normally the parent process kills the background process when
    the parent exits.
  - Use newer `sts` secrets API for token exchanges.
  - Fix the `-o`/`--outfile` option to work with relative paths. 
  - Change the `--nobearertoken` option to always get and save a vault token.


author: Dave Dykstra <dwd@fnal.gov> 2.0-2
changelog:
  - Fix broken httokendecode symlink.
  - Use python wheels to build/install on el9.  It didn't work on el8 so
    the use of wheels was removed at the last minute before the 2.0-1
    release (without removing it from the changelog like it should have).


author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Add make sources target for koji build
  - Add make srpm target for copr build
  - Support port numbers in https urls
  - Return all received cookies in the final getcert step
  - Add sending Server Name Indication on https connections


author: Brian Lin <blin@cs.wisc.edu> - 3.6-5
changelog:
  - Add OSG release series SchedD attribute (SOFTWARE-4984)
  - Remove upstreamed blahpd location configuration (SOFTWARE-4984)


author: Carl Vuosalo <carl.vuosalo@cern.ch> 4.17-2.1
changelog:
  - Upgrade to 4.17-2 tarball with the following release notes:
   - Add sites sampacs*.if.usp.br and cvmfs-*.hpc.swin.edu.au to MAJOR_CVMFS in
       squid/files/postinstall/squid.conf.proto.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.1
changelog:
  - Upgrade to 5.7-1 tarball with the following release notes:
   - Update to squid-5.7 with release notes at https://wiki.squid-cache.org/Squid-5 and
      http://www.squid-cache.org/Versions/v5/RELEASENOTES.html.
      Most important new feature in 5.7:
      - "Happy Eyeballs" feature uses the first destination IP address that responds
         from DNS, whether it is IPv4 (A records) or IPv6 (AAAA records). A consequence
         of this feature is that the dns_v4_first directive is no longer supported.
   - Add sites cvmfs-stratum-one.cc.kek.jp and cvmfs*.sdcc.bnl.gov
      to MAJOR_CVMFS in squid/files/postinstall/squid.conf.proto.
   - Remove obsolete frontier*.racf.bnl.gov from ATLAS_FRONTIER
      in squid/files/postinstall/squid.conf.proto.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.2
changelog:
  - Add pretrans scriplet to this spec file to fix problem with squid-4 to
     squid-5 upgrade where a link becomes a directory.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.3
changelog:
  - Complete the fix from 5.7-1.2. An additional work-around was needed
     for the squid-4 to squid-5 upgrade to change a directory that was generating
     yum transaction errors into a link, which silenced the errors.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.8-1.1
changelog:
  - Update to squid-5.8 with release notes at
      https://www.squid-cache.org/Versions/v5/squid-5.8-RELEASENOTES.html and announcement at
      http://lists.squid-cache.org/pipermail/squid-announce/2023-February/000145.html
      Most important new features in 5.8:
      - A predefined ACL named "to_linklocal" which matches traffic attempting to access
       link-local network services has been added. It is set to "deny" in
       squid/files/postinstall/squid.conf.proto.
      - Bug fixed where cache manager API erroneously returns "mgr_index" instead of requested
       data.
   - Add support for rpmbuild on el9
   - Add object-*.cloud to the computecanada portion of MAJOR_CVMFS in
      squid/files/postinstall/squid.conf.proto.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.8-2.1
changelog:
  - For EL9, in this spec file replace calls to obsolete "service" and add new package
     requirements.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-1.1
changelog:
  - Update to squid-5.9, with announcement at
      http://lists.squid-cache.org/pipermail/squid-announce/2023-May/000147.html and
      release notes at http://www.squid-cache.org/Versions/v5/squid-5.9-RELEASENOTES.html.
      squid-5.9 contains small fixes including improvement of debug logging related to the
      reply_body_max_size parameter.
   - Consistent with squid5, disallow the combination of multiple workers, ufs cache,
      and memory_cache_shared even if collapsed_forwarding is off.
   - Limit the  maximum number of file descriptors to 65536 even if the OS would allow
      a higher number.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-1.2
changelog:
  - With the addtion of an EL9 repository, this release includes an EL9 RPM that was
      compiled on EL9 and that fully supports Web Proxy Auto Discovery. The EL7/EL8
      RPM in this release is unchanged from 5.9-1.1, except for version number.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-2.1
changelog:
  - Apply security patches from Squid 6 to address security concerns since 
      a version of Squid 6 suitable for frontier-squid is not available yet.
   - The following security vulnerabilities have been addressed with patches:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46724
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46847
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46848
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49285
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50269
      https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
   - The following two vulnerabilities are addressed by disabling Gopher and TRACE
      requests, respectively, in the squid.conf.proto file:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46728
      https://megamansec.github.io/Squid-Security-Audit/trace-uaf.html
   - To support SELinux, require /sbin/restorecon and apply it to the log directory,
      in addition to the cache directory.
   - Update to shoal-1.0.2 to fix setting of external_ip.


author: Tim Theisen <tim@cs.wisc.edu> - 10.8.0-1
changelog:
  - Fold the classads, blahp, and procd RPMs into the main condor RPM
  - Align the Debian packages and package names with the RPM packaging
  - On Linux, the default configuration enforces memory limits with cgroups
  - condor_status -gpus shows nodes with GPUs and the GPU properties
  - condor_status -compact shows a row for each slot type
  - New ENV command controls which environment variables are present in DAGMan


author: Tim Theisen <tim@cs.wisc.edu> - 10.0.9-1
changelog:
  - The condor_upgrade_check script now provides guidance on updating to 23.0
  - The htchirp Python binding now properly locates the chirp configuration
  - Fix bug that prevented deletion of HTCondor passwords on Windows


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.0-1
changelog:
  - Absent slot configuration, execution points will use a partitionable slot
  - Linux cgroups enforce maximum memory utilization by default
  - Can now define DAGMan save points to be able to rerun DAGs from there
  - Much better control over environment variables when using DAGMan
  - Administrators can enable and disable job submission for a specific user
  - Can set a minimum number of CPUs allocated to a user
  - condor_status -gpus shows nodes with GPUs and the GPU properties
  - condor_status -compact shows a row for each slot type
  - Container images may now be transferred via a file transfer plugin
  - Support for Enterprise Linux 9, Amazon Linux 2023, and Debian 12
  - Can write job information in AP history file for every execution attempt
  - Can run defrag daemons with different policies on distinct sets of nodes
  - Add condor_test_token tool to generate a short lived SciToken for testing
  - The job’s executable is no longer renamed to ‘condor_exec.exe’


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.1-1
changelog:
  - Fix 10.6.0 bug that broke PID namespaces
  - Fix bug where execution times for ARC CE jobs were 60 times too large
  - Fix bug where a failed 'Service' node would crash DAGMan
  - Condor-C and Job Router jobs now get resources provisioned updates


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.2-1
changelog:
  - Fix bug where OIDC login information was missing when submitting jobs
  - Improved sandbox and ssh-agent clean up for batch grid universe jobs
  - Fix bug where daemons with a private network address couldn't communicate
  - Fix cgroup v2 memory enforcement for custom configurations
  - Add DISABLE_SWAP_FOR_JOB support on cgroup v2 systems
  - Fix log rotation for OAuth and Vault credmon daemons


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.3-1
changelog:
  - Preliminary support for openSUSE LEAP 15
  - All non-zero exit values from file transfer plugins are now errors
  - Fix crash in Python bindings when job submission fails
  - Chirp uses a 5120 byte buffer and errors out for bigger messages
  - condor_adstash now recognizes GPU usage values as floating point numbers


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.4-1
changelog:
  - NVIDIA_VISIBLE_DEVICES environment variable lists full uuid of slot GPUs
  - Fix problem where some container jobs would see GPUs not assigned to them
  - Restore condor keyboard monitoring that was broken since HTCondor 23.0.0
  - In condor_adstash, the search engine timeouts now apply to all operations
  - Ensure the prerequisite perl modules are installed for condor_gather_info


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.6-1
changelog:
  - Fix DAGMan where descendants of removed retry-able jobs are marked futile
  - Ensure the condor_test_token works correctly when invoked as root
  - Fix bug where empty multi-line values could cause a crash
  - condor_qusers returns proper exit code for errors in formatting options
  - Fix crash in job router when a job transform is missing an argument


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.8-1
changelog:
  - Fix bug where ssh-agent processes were leaked with grid universe jobs
  - Fix DAGMan crash when a provisioner node was given a parent
  - Fix bug that prevented use of "ftp:" URLs in file transfer
  - Fix bug where jobs that matched an offline slot never start


author: Tim Theisen <tim@cs.wisc.edu> - 10.0.7-1
changelog:
  - Fixed bug where held condor cron jobs would never run when released
  - Improved daemon IDTOKENS logging to make useful messages more prominent
  - Remove limit on certificate chain length in SSL authentication
  - condor_config_val -summary now works with a remote configuration query
  - Prints detailed message when condor_remote_cluster fails to fetch a URL
  - Improvements to condor_preen


author: Tim Theisen <tim@cs.wisc.edu> - 10.7.0-1
changelog:
  - Support for Debian 12 (Bookworm)
  - Can run defrag daemons with different policies on distinct sets of nodes
  - Added want_io_proxy submit command
  - Apptainer is now included in the HTCondor tarballs
  - Fix 10.5.0 bug where reported CPU time is very low when using cgroups v1
  - Fix 10.5.0 bug where .job.ad and .machine.ad were missing for local jobs


author: Tim Theisen <tim@cs.wisc.edu> - 10.0.8-1
changelog:
  - Avoid kernel panic on some Enterprise Linux 8 systems
  - Fix bug where early termination of service nodes could crash DAGMan
  - Limit email about long file transfer queue to once daily
  - Various fixes to condor_adstash


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.10-1
changelog:
  - Preliminary support for Ubuntu 22.04 (Noble Numbat)
  - Warns about deprecated multiple queue statements in a submit file
  - Fix bug where plugins could not signify to retry a file transfer
  - The condor_upgrade_check script checks for proper token file permissions
  - Fix bug where the condor_upgrade_check script crashes on older platforms
  - The bundled version of apptainer was moved to libexec in the tarball


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.12-1
changelog:
  - Remote condor_history queries now work the same as local queries
  - Improve error handling when submitting to a remote scheduler via ssh
  - Fix bug on Windows where condor_procd may crash when suspending a job
  - Fix Python binding crash when submitting a DAG which has empty lines


author: Tim Theisen <tim@cs.wisc.edu> - 10.6.0-1
changelog:
  - Administrators can enable and disable job submission for a specific user
  - Work around memory leak in libcurl on EL7 when using the ARC-CE GAHP
  - Container images may now be transferred via a file transfer plugin
  - Add ClassAd stringlist subset match function
  - Add submit file macro '$(JobId)' which expands to full ID of the job
  - The job's executable is no longer renamed to 'condor_exec.exe'


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.14-1
changelog:
  - Docker and Container jobs run on EPs that match AP's CPU architecture
  - Fixed premature cleanup of credentials by the condor_credd
  - Fixed bug where a malformed SciToken could cause a condor_schedd crash
  - Fixed crash in condor_annex script
  - Fixed daemon crash after IDTOKEN request is approved by the collector


