# changelog

author: Tim Theisen <tim@cs.wisc.edu> - 23.10.20-1
changelog:
  - Fix bug where STARTD_ENFORCE_DISK_LIMITS would excessively save metadata
  - Fix bug where container_service_names did not work
  - Fix rare startd crash when collector queries time out and DNS is slow


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.21-1
changelog:
  - Fix memory leak caused by periodic evaluation of bad ClassAd expressions
  - Fixes for bugs affecting grid jobs


author: Tim Theisen <tim@cs.wisc.edu> - 23.10.21-1
changelog:
  - Fix bug where chirp would not work in container jobs using Docker
  - HTCondor tarballs now contain Pelican 7.13.0


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.25-1
changelog:
  - Fix problems where parallel universe jobs could crash the condor_schedd
  - Prevent condor_starter crash when evicting job during input file transfer
  - condor_watch_q now properly displays job id ranges by using numeric sort


author: Tim Theisen <tim@cs.wisc.edu> - 23.10.25-1
changelog:
  - Fix bug where DAGMAN_MAX_JOBS_IDLE was being ignored
  - HTCondor tarballs now contain Pelican 7.16.5 and Apptainer 1.4.1


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.26-1
changelog:
  - Fix ingestion of ads into Elasticsearch under very rare circumstances
  - DAGMan better handles being unable to write to a full filesystem
  - 'kill_sig' submit commands are now ignored on the Windows platform


author: Tim Theisen <tim@cs.wisc.edu> - 23.10.26-1
changelog:
  - Fix memory leak in the condor_schedd when using late materialization
  - Fix condor_master start up when file descriptor ulimit was huge
  - HTCondor tarballs now contain Pelican 7.17.0


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-1.2
changelog:
  - With the addtion of an EL9 repository, this release includes an EL9 RPM that was
      compiled on EL9 and that fully supports Web Proxy Auto Discovery. The EL7/EL8
      RPM in this release is unchanged from 5.9-1.1, except for version number.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-2.1
changelog:
  - Apply security patches from Squid 6 to address security concerns since
      a version of Squid 6 suitable for frontier-squid is not available yet.
   - The following security vulnerabilities have been addressed with patches:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46724
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46847
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46848
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49285
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50269
      https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
   - The following two vulnerabilities are addressed by disabling Gopher and TRACE
      requests, respectively, in the squid.conf.proto file:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46728
      https://megamansec.github.io/Squid-Security-Audit/trace-uaf.html
   - To support SELinux, require /sbin/restorecon and apply it to the log directory,
      in addition to the cache directory.
   - Update to shoal-1.0.2 to fix setting of external_ip.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.1
changelog:
  - Upgrade to 5.9-3 tarball with the following release notes:
    - Add *.eessi.science to MAJOR_CVMFS in squid/files/postinstall/squid.conf.proto.
   - Move frontier-squid.sh from /etc/init.d to /usr/libexec/squid. Remove chkconfig
      because it is no longer needed. Move all steps of preparation of the
      frontier-squid-utils prototype files to this file to simplify future
      maintenance.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.2
changelog:
  - Fix building of RPM to properly choose Python36 or Python39.
       Also, restrict building to x86_64 architecture.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.10-1.1
changelog:
  - Update to squid-5.10, with release notes at
      https://github.com/squid-cache/squid/commits/v5.
      The security patches included in frontier-squid-5.9-2 have been incorporated
      into the baseline Squid code in this release.
      It also contains fixes for minor bugs and these security issues:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25617
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23638
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37894
      https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html
      https://megamansec.github.io/Squid-Security-Audit/ftp-fatal.html
      https://megamansec.github.io/Squid-Security-Audit/ipv6-assert.html
      https://megamansec.github.io/Squid-Security-Audit/stream-assert.html
   - For SELinux, provide proper labeling for /usr/libexec/squid/frontier-squid
      script to prevent log rotation failures.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 6.13-1.3
changelog:
  - Update to squid-6.13, with announcement at
      https://lists.squid-cache.org/pipermail/squid-announce/2025-February/000167.html
      and release notes at https://github.com/squid-cache/squid/releases/tag/SQUID_6_13
      squid-6 has a number of new features and changes, such as
      - TLS ServerHello
      - Log TLS Communication Secrets
      - Ban ACL key Changes in ACLs
      - Block to-local Traffic
      - RFC 9211: HTTP Cache-Status support
      - RFC 9111: Stop treating Warning specially
      - ext_kerberos_ldap_group_acl: Support -b with -D
      - Remove Gopher Protocol Support
      - Remove Outdated Tools
   - Set "memory_cache_shared on" as work-around for Squid bug 5332:
      https://bugs.squid-cache.org/show_bug.cgi?id=5332
   - Require Rock cache when workers > 1.  NOTE: This is a breaking change for
      installations with multiple workers, but necessary because of the work-around
      for bug 5332.
   - Set "request_header_access If-Modified-Since deny all" when Rock cache is used to
      avoid Squid bug 4890: https://bugs.squid-cache.org/show_bug.cgi?id=4890
   - Add patch to fix reporting of number of cache objects.


author: Marco Mambelli <marcom@fnal.gov> - 3.10.8
changelog:
  - Glideinwms v3.10.8
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_8/history.html
  - Release candidates 3.10.8-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.9
changelog:
  - Glideinwms v3.10.9
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_9/history.html
  - Release candidates 3.10.9-01.rc1 to 3.10.9-03.rc3


author: Marco Mambelli <marcom@fnal.gov> - 3.10.10
changelog:
  - Glideinwms v3.10.10
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_10/history.html
  - Release candidates 3.10.10-01.rc1


author: Bruno Coimbra <coimbra@fnal.gov> - 3.11.0
changelog:
  - Glideinwms v3.11.0
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_11_0/history.html
  - Release candidates 3.11.0-01.rc1 to 3.11.0-09.rc9


author: Marco Mambelli <marcom@fnal.gov> - 3.10.11
changelog:
  - Glideinwms v3.10.11
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_11/history.html
  - Release candidates 3.10.11-01.rc1 to 3.10.11-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.12
changelog:
  - Glideinwms v3.10.12
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_12/history.html
  - Release candidates 3.10.12-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.13
changelog:
  - Glideinwms v3.10.13
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_13/history.html
  - Release candidates 3.10.13-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.14
changelog:
  - Glideinwms v3.10.14
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_14/history.html
  - Release candidates 3.10.14-01.rc1 to 3.10.14-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.15
changelog:
  - Glideinwms v3.10.15
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_15/history.html
  - Release candidates 3.10.15-01.rc1 to 3.10.15-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.11.1
changelog:
  - Glideinwms v3.11.1
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_11_1/history.html
  - Release candidates 3.11.1-01.rc1 to 3.11.1-06.rc6


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.6-1
changelog:
  - Fix CE job route transform for job environment
  - Fix CERequirements when the default_CERequirements is not set
  - Add condor_ce_test_token tool to generate short lived SciToken for tests
  - Remove GSI from security method list to eliminate annoying warnings


author: Tim Theisen <tim@cs.wisc.edu> - 23.9.1-1
changelog:
  - Use new Job Router syntax by default
  - Update configuration files to work with HTCondor 23.9.1 and later
  - Use BatchQueue job attribute in CE routes


author: Justin Hiemstra <jhiemstra@wisc.edu> - 0.0.2-1
changelog:
  - v0.0.2 release of LotMan -- adds the ability to set sqlite timeouts
    and enables WAL mode for better concurrency.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 4.2.3-1.1
changelog:
  - Update to 4.2.3-1 from upstream (SOFTWARE-4885)
  - Add Check-for-DT_REG-macro.patch to avoid compile error on EL7 due to missing DT_REG macro


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 5.0.1-1
changelog:
  - Update to version 5.0.1
  - Drop patch oidc-agent-webkit.patch (previously backported
  - Drop patch oidc-agent.patch (accepted upstram)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 7.9.3-1
changelog:
  - Upgrade to Pelican 7.9.3 (SOFTWARE-5847)
  - Require xrootd >= 5.6.9-1.6 for various backports from 5.7.0


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 7.9.9-1
changelog:
  - Upgrade to Pelican 7.9.9
  - Require pelican version >= service version
  - Restart service if pelican or (for xrootd-requiring services) xrootd-server is upgraded
  - Require xrootd >= 5.7.0
  - Require xrootd-multiuser


author: Mátyás Selmeci <mselmeci@wisc.edu> - 7.16.1-1
changelog:
  - Upgrade to Pelican 7.16.1 (SOFTWARE-6152)
  - Require "pelican-server" for the cache and origin (SOFTWARE-6152)


author: Mátyás Selmeci <mselmeci@wisc.edu> - 7.16.6-1
changelog:
  - Upgrade to Pelican 7.16.6 (SOFTWARE-6152)
  - Require xrootd-s3-http where available
  - Drop explicit dependency on xrootd since it is already implied by pelican-server
  - Instruct user to specify Cache.StorageLocation in cache config


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 7.4.0-1
changelog:
  - Add minimum version requirements:
    - xrootd must be 5.6.3 to avoid chunked upload incompatibility
    - pelican must be 7.3.3 to avoid authfile/scitokens.conf parsing issues
  - Make origin and origin-multiuser services conflict


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 7.4.0-2
changelog:
  - Remove xrootd requirements from registry and director
  - Add pelican-osdf-compat requirement to osdf subpackages


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 7.4.0-3
changelog:
  - Updates to yaml and service files
  - Remove redundant *-origin-multiuser services
  - Add osdf-cache-public and osdf-origin-public


author: Brian Lin <blin@cs.wisc.edu> - 0.8.1-1
changelog:
  - Add the --pw-store option to the invocation of oidc-add and add a default
    scope of blank if no scopes are configured.  These are needed for the
    CILogon issuer (SOFTWARE-4983).


author: Carl Edquist <edquist@cs.wisc.edu> - 0.8.2-1
changelog:
  - Increase renewal frequency to ensure continual validity (SOFTWARE-5137)
  - Fix password file handling for restricted permissions in setup script (#17)
  - Use newer --pw-file option for oidc-add (SOFTWARE-5050)
  - Bump version requirement for oidc-agent package (SOFTWARE-5050)


author: Dave Dykstra - 0.9.0-1
changelog:
  - Require oidc-agent-cli-5.1.0, and use a new oidc-add --skip-check option
    there to avoid trying to get an access token at load time.  This avoids
    a 'No scopes found' error when the token issuer returns different scopes
    than requested (e.g. wlcg.capabilityset which returns a set of scopes).


