# changelog

author: Dave Dykstra <dwd@fnal.gov> 1.14-1
changelog:
  - Limit the number of proxy levels stripped off of %certsubject to 5.
    This is to catch programming errors where people call voms-proxy-init
    -noregen after every call to cigetcert, even when cigetcert determines
    that the previous proxy can be reused.


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Fix bug that caused the proxy to be stored into MyProxy under the DN
    of a previous certificate (if it existed but could not be reused)
    rather than the newly generated one.


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Fix typo in the variable name added in the last version.  This was
    not noticed because it was caught in an exception and caused it to
    always behave as if a previous proxy stored in myproxy could not be
    used.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Make source code completely compatible with python3
  - Fix check for more than 5 proxy levels to apply when verbose option
    is not set


author: Dave Dykstra <dwd@fnal.gov> 1.19-1
changelog:
  - Add setup.py for making a standard python installation
  - Use ssl.get_default_verify_paths() to find default CA paths, when possible
  - Make --listinstitutions compatible with python3


author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Add make sources target for koji build
  - Add make srpm target for copr build
  - Support port numbers in https urls
  - Return all received cookies in the final getcert step
  - Add sending Server Name Indication on https connections


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.21-1
changelog:
  - Fix memory leak caused by periodic evaluation of bad ClassAd expressions
  - Fixes for bugs affecting grid jobs


author: Tim Theisen <tim@cs.wisc.edu> - 24.0.5-1
changelog:
  * Thu Feb 27 2025 Tim Theisen <tim@cs.wisc.edu> - 23.10.21-1
  - Fix bug where chirp would not work in container jobs using Docker
  - HTCondor tarballs now contain Pelican 7.13.0


author: Dave Dykstra <dwd@fnal.gov> - 2.1-1
changelog:
  - Merge LIGO changes to debian packaging
  - Move packaging/debian to debian and packaging/redhat to rpm, to work
    better with OBS and new OSG github packaging standard


author: Dave Dykstra <dwd@fnal.gov> - 2.2-1
changelog:
  - Just change the version number because the OSG github-source for
    reading spec files doesn't work with dash release tags.


author: Dave Dykstra <dwd@fnal.gov> - 2.3-1
changelog:
  - Change the changelog date on version 2.0.3 from Feb 28 2017 to
    May 28 2017 because osg-build complained about non-descending order
    of the dates.
  - Change the rpm/rpmbuild-cvmfs-config-osg development test script 
    to read from rpm instead of packaging/redhat.


author: Dave Dykstra <dwd@fnal.gov> - 2.4-1
changelog:
  - Change the server urls for the config-osg repository to use openhtc.io
    aliases when the proxy url can use DIRECT.


author: Dave Dykstra <dwd@fnal.gov> - 2.4-4
changelog:
  - Skipped release 2.4-2 and 2.4-3 to make consistent with cvmfs-config-egi.
  - Change Conflicts: cvmfs-config-default to Obsoletes: to make it
    easier to replace. Add Conflicts: cvmfs-config-egi because it
    is mutually exclusive.


author: Dave Dykstra <dwd@fnal.gov> - 2.5-1
changelog:
  - Update the configuration for the config repo to apply all the logic
    from the config repo's default.conf and common.conf.  That is, support
    USE_CVMFS_CDN and CVMFS_CLIENT_PROFILE and set default CVMFS_PAC_URLS
    covering the WLCG Web Proxy Auto Discovery.
  - Reverse the order of the fallback proxies because of the bug in 
    https://sft.its.cern.ch/jira/browse/CVM-1920


author: Dave Dykstra <dwd@fnal.gov> - 2.2-1
changelog:
  - Prevent exiting after the first token authentication
  - Close token file descriptor after use
  - Enable token debug messages
  - Implement WLCG bearer token discovery standard
  - Add libscitokens-dev build dependency on debian


author: Derek Weitzel <dweitzel@unl.edu> - 2.3
changelog:
  - Fix tokens that are bigger than 1024 bytes
  - Fix the use of $BEARER_TOKEN when accessing data
  - Allow for multiple read operations, needed on el9


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.8-1.1
changelog:
  - Update to squid-5.8 with release notes at
      https://www.squid-cache.org/Versions/v5/squid-5.8-RELEASENOTES.html and announcement at
      http://lists.squid-cache.org/pipermail/squid-announce/2023-February/000145.html
      Most important new features in 5.8:
      - A predefined ACL named "to_linklocal" which matches traffic attempting to access
       link-local network services has been added. It is set to "deny" in
       squid/files/postinstall/squid.conf.proto.
      - Bug fixed where cache manager API erroneously returns "mgr_index" instead of requested
       data.
   - Add support for rpmbuild on el9
   - Add object-*.cloud to the computecanada portion of MAJOR_CVMFS in
      squid/files/postinstall/squid.conf.proto.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.8-2.1
changelog:
  - For EL9, in this spec file replace calls to obsolete "service" and add new package
     requirements.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-1.1
changelog:
  - Update to squid-5.9, with announcement at
      http://lists.squid-cache.org/pipermail/squid-announce/2023-May/000147.html and
      release notes at http://www.squid-cache.org/Versions/v5/squid-5.9-RELEASENOTES.html.
      squid-5.9 contains small fixes including improvement of debug logging related to the
      reply_body_max_size parameter.
   - Consistent with squid5, disallow the combination of multiple workers, ufs cache,
      and memory_cache_shared even if collapsed_forwarding is off.
   - Limit the  maximum number of file descriptors to 65536 even if the OS would allow
      a higher number.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-1.2
changelog:
  - With the addtion of an EL9 repository, this release includes an EL9 RPM that was
      compiled on EL9 and that fully supports Web Proxy Auto Discovery. The EL7/EL8
      RPM in this release is unchanged from 5.9-1.1, except for version number.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-2.1
changelog:
  - Apply security patches from Squid 6 to address security concerns since 
      a version of Squid 6 suitable for frontier-squid is not available yet.
   - The following security vulnerabilities have been addressed with patches:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46724
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46847
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46848
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49285
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50269
      https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
   - The following two vulnerabilities are addressed by disabling Gopher and TRACE
      requests, respectively, in the squid.conf.proto file:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46728
      https://megamansec.github.io/Squid-Security-Audit/trace-uaf.html
   - To support SELinux, require /sbin/restorecon and apply it to the log directory,
      in addition to the cache directory.
   - Update to shoal-1.0.2 to fix setting of external_ip.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.1
changelog:
  - Upgrade to 5.9-3 tarball with the following release notes:
    - Add *.eessi.science to MAJOR_CVMFS in squid/files/postinstall/squid.conf.proto.
   - Move frontier-squid.sh from /etc/init.d to /usr/libexec/squid. Remove chkconfig
      because it is no longer needed. Move all steps of preparation of the
      frontier-squid-utils prototype files to this file to simplify future
      maintenance.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.2
changelog:
  - Fix building of RPM to properly choose Python36 or Python39.
       Also, restrict building to x86_64 architecture.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.10-1.1
changelog:
  - Update to squid-5.10, with release notes at
      https://github.com/squid-cache/squid/commits/v5.
      The security patches included in frontier-squid-5.9-2 have been incorporated
      into the baseline Squid code in this release.
      It also contains fixes for minor bugs and these security issues:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25617
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23638
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37894
      https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html
      https://megamansec.github.io/Squid-Security-Audit/ftp-fatal.html
      https://megamansec.github.io/Squid-Security-Audit/ipv6-assert.html
      https://megamansec.github.io/Squid-Security-Audit/stream-assert.html
   - For SELinux, provide proper labeling for /usr/libexec/squid/frontier-squid
      script to prevent log rotation failures.


author: Marco Mambelli <marcom@fnal.gov> - 3.10.6
changelog:
  - Glideinwms v3.10.6
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_6/history.html
  - Release candidates 3.10.6-01.rc1 to 3.10.6-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.7-3
changelog:
  - Glideinwms v3.10.7
  - 3.10.7-1 was on Fri Jun 21 2024
  - Removed bash mangling in 3.10.7-3
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_7/history.html
  - Release candidates 3.10.7-01.rc1 to 3.10.7-03.rc3


author: Marco Mambelli <marcom@fnal.gov> - 3.10.8
changelog:
  - Glideinwms v3.10.8
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_8/history.html
  - Release candidates 3.10.8-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.9
changelog:
  - Glideinwms v3.10.9
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_9/history.html
  - Release candidates 3.10.9-01.rc1 to 3.10.9-03.rc3


author: Marco Mambelli <marcom@fnal.gov> - 3.10.10
changelog:
  - Glideinwms v3.10.10
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_10/history.html
  - Release candidates 3.10.10-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.11
changelog:
  - Glideinwms v3.10.11
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_11/history.html
  - Release candidates 3.10.11-01.rc1 to 3.10.11-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.12
changelog:
  - Glideinwms v3.10.12
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_12/history.html
  - Release candidates 3.10.12-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.13
changelog:
  - Glideinwms v3.10.13
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_13/history.html
  - Release candidates 3.10.13-01.rc1


author: Carl Edquist <edquist@cs.wisc.edu> - 2.6.3-1
changelog:
  - Restore ProbeConfig symlinks, and other dcache-transfer fixes (SOFTWARE-5241)
  - Replace default_prefix with _datadir; drop relocatable Prefixes


author: Carl Edquist <edquist@cs.wisc.edu> - 2.7.0-1
changelog:
  - Prefer CpusProvisioned over RequestCpus if set (SOFTWARE-5246)
  - Prefer MachineAttrGLIDEIN_ResourceName0 for ResourceName calculation;
  - Include GLIDEIN_ResourceName in SYSTEM_JOB_MACHINE_ATTRS (SOFTWARE-5249)


author: Brian Lin <blin@cs.wisc.edu.> - 2.8.4-1
changelog:
  - HTCondor AP and CE probes now drop privileges to the 'condor' user
    if run as 'root' (SOFTWARE-5531)
  - Improve logging and failure modes when encountering unwriteable
    directories (SOFTWARE-5531)


author: Matt Westphall <westphall@wisc.edu.> - 2.8.5-1
changelog:
  - Log gratia probe failures to aid debugging (SOFTWARE-6037)
  - Fix NameError in post-install script (SOFTWARE-5558)


author: Tim Theisen <tim@cs.wisc.edu> - 6.0.1-1
changelog:
  - Add grid CA and host certificate/key locations to default SSL search paths
  - Verifies that HTCondor-CE can access the local HTCondor's SPOOL directory
  - Can use condor_ce_trace without SciToken to test batch system integration
  - condor_ce_upgrade_check checks compatibility with next HTCondor version
  - Adds deprecation warnings for old job router configuration syntax


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.6-1
changelog:
  - Fix CE job route transform for job environment
  - Fix CERequirements when the default_CERequirements is not set
  - Add condor_ce_test_token tool to generate short lived SciToken for tests
  - Remove GSI from security method list to eliminate annoying warnings


author: Tim Theisen <tim@cs.wisc.edu> - 23.9.1-1
changelog:
  - Use new Job Router syntax by default
  - Update configuration files to work with HTCondor 23.9.1 and later
  - Use BatchQueue job attribute in CE routes


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Fix httokendecode -H functionality to only attempt to convert a parsed word
    if it is entirely numeric, not if it just contains one digit.  At the same
    time, rewrite the functionality in native bash instead of using grep and sed.
  - Add htdestroytoken command.
  - Add a symlink htdecodetoken pointing to httokendecode.


author: Dave Dykstra <dwd@fnal.gov> 1.17-1
changelog:
  - Fix the usage of getaddrinfo, which caused a fatal error on python3.9
    on Mac.
  - Make --showbearerurl work properly in combination with --nobearertoken.
  - Change the httokendecode error message for a missing token file to
    stderr instead of stdin.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Fix crash introduced in 1.17 when using --nobearertoken while the
    credkey is not known.
  - Make source rpm buildable on el9.


author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Update httokensh to by default set the minimum vault token time to live to
    6 days, and to make sure that the background refresh never gets a new vault
    token.
  - Changed the preferred name of httokendecode to htdecodetoken, keeping
    links in the opposite direction.
  - Add man pages for httokensh, htdestroytoken, and htdecodetoken.


author: Dave Dykstra <dwd@fnal.gov> 2.0-1
changelog:
  - Replace use of m2crypto and pyOpenSSL with urllib3
  - Replace use of pykerberos with gssapi
  - Use standard Requires for Python modules instead of PyInstaller
  - Add --vaultcertname option to specify an alternative certificate name.
    That used to be an additional optional meaning of the --vaultalias option,
    but urllib3 requires only one name to match.
  - Add setuptools build infrastructure
  - Refactor htgettoken script into module with entry point.
    This enables invoking htgettoken as `htgettoken.main()` from Python.
  - Use wheels to build/install Python package, which simplified the entry
    points and improves (slightly) the metadata
  - Fix the httokensh background process's check for its parent process.
    That is only a backup in case only the parent process is hard-killed,
    because normally the parent process kills the background process when
    the parent exits.
  - Use newer `sts` secrets API for token exchanges.
  - Fix the `-o`/`--outfile` option to work with relative paths. 
  - Change the `--nobearertoken` option to always get and save a vault token.


author: Dave Dykstra <dwd@fnal.gov> 2.0-2
changelog:
  - Fix broken httokendecode symlink.
  - Use python wheels to build/install on el9.  It didn't work on el8 so
    the use of wheels was removed at the last minute before the 2.0-1
    release (without removing it from the changelog like it should have).


author: Dave Dykstra <dwd@fnal.gov> 2.1-1
changelog:
  - Fix htdecodetoken to work with token files that do not end in a newline.
  - Support args in htgettoken.main() Python entry point.


author: Dave Dykstra <dwd@fnal.gov> 2.2-1
changelog:
  - Add BuildRequires python3-devel to generate correct Python metadata.
  - Remove explicit Requires for python dependencies, rely on Python metadata.
  - Always build with wheels.
  - Remove Python root logger configuration.


author: Dave Dykstra <dwd@fnal.gov> 1.12-1
changelog:
  - Require vault-1.10.0 and update vault-plugin-auth-jwt to version 0.12.1
    and vault-plugin-auth-ssh to version 0.1.1.


author: Dave Dykstra <dwd@fnal.gov> 1.13-1
changelog:
  - Remove support for old-style per issuer/role secret plugins.  Requires
    htgettoken >= 1.7.
  - Add ability to delete a previously defined configuration by using
    a keyword "delete:" under the configuration name and setting it to
    any value.
  - Update vault-plugin-auth-jwt to the latest commit (because the patches
    had been rebased on it).


author: Dave Dykstra <dwd@fnal.gov> 1.14-1
changelog:
  - Add auditlog configuration option.  As part of that, disable the
    vault systemd ProtectFull and ProtectHome options.
  - Require vault >= 1.12.1.
  - Update the vault-plugin-auth-jwt to the latest upstream commit.
  - Include gox in the source tarball.


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Update vault-plugin-secrets-oauthapp to 3.1.1 which adds support for token
    exchange at a /sts path instead of /creds.  Keep applying the PR patch
    that also adds it under /creds for a transition period until htgettoken
    is updated everywhere to use the new path.
  - Update vault-plugin-auth-jwt to 0.15.2.
  - Update vault-plugin-auth-ssh to 0.3.0.
  - Require vault >= 1.13.
  - Require diffutils.
  - Fix bug where the kerberos policydomain option was ignored.


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Add 'ratelimits' keyword to put a limit on the number of requests per
    client per interval.
  - Allow '@' to be included in the ssh plugin's keys.
  - Fix bug that prevented reconfiguration when a policy name changed.
  - Update vault-plugin-auth-jwt to 0.18.0.
  - Update vault-plugin-auth-ssh to 0.3.1.
  - Require vault to be >= 1.15.


author: Dave Dykstra <dwd@fnal.gov> 1.17-1
changelog:
  - Add a patch of PR #90 to vault-plugin-secrets-oauthapp which adds caching
    of tokens exchanged via the /sts path and adds a minimum_seconds option to
    the API.
  - Give vault tokens the capabilities of deleting secrets and revoking
    themselves.
  - Update required vault to 1.17.
  - Update vault-plugin-auth-jwt to 0.21.0.
  - Update vault-plugin-auth-ssh to 0.3.2 which includes the patch for '@' 
    that was previously applied.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Restore patch #41 on vault-plugin-secrets-oauthapp which was accidentally
    dropped.
  - Update to latest commit on vault-plugin-auth-jwt because one of the
    other patches now depends on it in order to apply cleanly.


author: Dave Dykstra <dwd@fnal.gov> 1.19-1
changelog:
  - Replace vault with openbao-2.2.0 and remove vault-plugin-secrets-jwt
    (since the builtin version works with openbao).
  - Replace vault-plugin-secrets-oauthapp with openbao-plugin-secrets-oauthapp
    3.2.0 but still install it as vault-plugins-secrets-oauthapp for upgrade
    compatibility.
  - Update vault-plugin-auth-ssh to 0.3.4.


author: Dave Dykstra <dwd@fnal.gov> 2.0.0-1
changelog:
  - Remove the external auth/oidc plugin registration to switch to the
    builtin plugin.
  - Change to semantic versioning starting at 2.0.0.  Compared to 1.18,
    the removal of the external vault-plugin-secrets-jwt plugin causes
    some incompatibility and requires a careful upgrade path in HA
    installations (that is, upgrade all vault/openbao first).


author: Edgar Fajardo <efajardo@cern.ch> 1.1.0-1
changelog:
  Updated to the 1.1.0 release. It could not be a pass through build since the dist was missing in the Release entry in the spec file


author: Justin Hiemstra <jhiemstra@wisc.edu> - 0.0.2-1
changelog:
  - v0.0.2 release of LotMan -- adds the ability to set sqlite timeouts
    and enables WAL mode for better concurrency.


author: Dave Dykstra <dwd@fnal.gov> 1.11.1-1
changelog:
  - Update to upstream 1.11.1, which includes a fix to avoid denial of
    service on HA installation.
  - Remove $GOPATH/mod/*.* from the source tarball, leaving just
    $GOPATH/mod/cache/download.  That saves about 300M while still
    allowing offline builds.


author: Dave Dykstra <dwd@fnal.gov> 1.17.2-1
changelog:
  - Update to upstream 1.17.2
  - Add a temporary wrapper script on the vault command to avoid an irrelevant
    warning issued by the gosnowflake dependency when DBUS_SESSION_BUS_ADDRESS
    is not set


author: Dave Dykstra <dwd@fnal.gov> 1.17.2-2
changelog:
  - Stop including go in the source tarball, instead assume the build pulls
    in a new enough version of golang.


author: Dave Dykstra <dwd@fnal.gov> 2.2.0-2
changelog:
  - Update to use official build instructions, including showing the correct
    version number in the `bao status` command and not using the testonly
    build tag unless the go_debug macro is enabled.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 7.5.6-1
changelog:
  - Upgrade to Pelican 7.5.6
  - Require xrootd >= 5.6.6 for pelican:// URL support
  - Put log files in /var/log/pelican


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 7.9.3-1
changelog:
  - Upgrade to Pelican 7.9.3 (SOFTWARE-5847)
  - Require xrootd >= 5.6.9-1.6 for various backports from 5.7.0


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 7.9.9-1
changelog:
  - Upgrade to Pelican 7.9.9
  - Require pelican version >= service version
  - Restart service if pelican or (for xrootd-requiring services) xrootd-server is upgraded
  - Require xrootd >= 5.7.0
  - Require xrootd-multiuser


author: Mátyás Selmeci <mselmeci@wisc.edu> - 7.16.1-1
changelog:
  - Upgrade to Pelican 7.16.1 (SOFTWARE-6152)
  - Require "pelican-server" for the cache and origin (SOFTWARE-6152)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4-1
changelog:
  - Remove osg-release requirement; ignore missing compat packages; only try to
    update packages that are installed (SOFTWARE-2146)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6-1
changelog:
  - Replace references to OSG Twiki with links to current docs (SOFTWARE-3083)
  - Replace help email (SOFTWARE-3015)


author: Brian Lin <blin@cs.wisc.edu> 1.1.6-1
changelog:
  - Change software.grid.iu.edu to repo.grid.iu.edu in osg-ca-scripts (SOFTWARE-2666)
  - Remove unsupported compat links for old OpenSSL hashes
  - Added `ITB` options back to help text


author: Brian Lin <blin@cs.wisc.edu> - 3.6-5
changelog:
  - Add OSG release series SchedD attribute (SOFTWARE-4984)
  - Remove upstreamed blahpd location configuration (SOFTWARE-4984)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.1.1-1
changelog:
  - Relax hostname validation in 40-siteinfo.ini (failing to resolve is now a warning) (SOFTWARE-3953)
  - No longer make resource_group mandatory for CEs in 40-siteinfo.ini (SOFTWARE-3949)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.11.0-1
changelog:
  - Add Pilot entries (SOFTWARE-4177)
  - Don't try to resolve Squid on the CE (SOFTWARE-4362)
  - Ignore all fetch-crl errors, but warn if no CRLs exist (SOFTWARE-4364)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.0.0-1
changelog:
  - Drop lcmaps-db-templates dependency (SOFTWARE-4503)
  - Turn osg-configure-misc into a dummy package (SOFTWARE-4507)
  - Rename 30-gip.ini to 31-cluster.ini and osg-configure-gip to osg-configure-cluster (SOFTWARE-4485)
  - Deprecate RSV  (SOFTWARE-4511)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.1.0-0.15
changelog:
  - Depend on /usr/bin/condor_remote_cluster instead of condor-bosco (SOFTWARE-4973)
  - Split libs into separate RPM
  - Add osg-ce-attributes-generator (SOFTWARE-4895)
  - Don't require base osg-configure package in osg-configure-siteinfo and osg-configure-cluster
    because they can also be used by osg-ce-attributes-generator
  - Advertise batch system used by bosco (SOFTWARE-3720)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.2.0-1
changelog:
  - Turn osg-configure-rsv into a dummy package (SOFTWARE-4511)
  - Add "queue" to OSG_ResourceCatalog for Pilot sections (SOFTWARE-5881)


author: Brian Lin <blin@cs.wisc.edu> - 3.6.0
changelog:
  - Add configuration file for osg-incommon-cert-request (SOFTWARE-5668)
  - Update default CSR key length to 4096, add CLI option (SOFTWARE-5651)


author: Brian Lin <blin@cs.wisc.edu> - 3.6.1
changelog:
  - Fix bug with default CA config file option (SOFTWARE-5668)
  - Update default InCommon IGTF CA IDs to point to CA 3


author: Dave Dykstra <dwd@fnal.gov> - 3.7.0
changelog:
  - Convert osg-incommon-cert-request to use urllib3 instead of M2crypto
    for its https connection, to make it work properly on EL9.


author: Dave Dykstra <dwd@fnal.gov> - 3.7.2
changelog:
  - Fix bug in invocation of urllib3.request() in restclient's get_request();
    it was passing headers as the 4th parameter instead of identifying it
    by name.  Broke retrieval of cert with osg-incommon-cert-request in
    some cases.


author: Matyas Selmeci <matyas@cs.wisc.edu> 1.3.0-1
changelog:
  - Add SELinux audit logs to osg-system-profiler and URL support to
    osg-system-profiler-viewer (SOFTWARE-2275)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.4.0-1
changelog:
  - Include dump of tomcat server config (SOFTWARE-1099)
  - Create osg-profile.txt in temp dir, do not include old profiles in
    directory dumps (SOFTWARE-1773)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.1-1
changelog:
  - Drop osg-version check (SOFTWARE-2916)
  - Update instructions for getting help (SOFTWARE-2908)
  - Don't include logs for deprecated software (SOFTWARE-2905)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.3-1
changelog:
  - Drop unused files:
      - httpcert.pem
      - tomcat config
      - edg-mkgridmap.log
      - bestman2 logs


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6.0-1
changelog:
  - Query multiple python executables, not just `which python` (which may not exist on EL8) (SOFTWARE-4146)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.7.0-1
changelog:
  - Convert osg-system-profiler-viewer to Python 3
  - Add XRootD cconfig dumps (SOFTWARE-4933)
  - Print crypto policy if available (SOFTWARE-5330)
  - Fix email address in help message


author: Brian Lin <blin@cs.wisc.edu> - 0.8.1-1
changelog:
  - Add the --pw-store option to the invocation of oidc-add and add a default
    scope of blank if no scopes are configured.  These are needed for the
    CILogon issuer (SOFTWARE-4983).


author: Carl Edquist <edquist@cs.wisc.edu> - 0.8.2-1
changelog:
  - Increase renewal frequency to ensure continual validity (SOFTWARE-5137)
  - Fix password file handling for restricted permissions in setup script (#17)
  - Use newer --pw-file option for oidc-add (SOFTWARE-5050)
  - Bump version requirement for oidc-agent package (SOFTWARE-5050)


author: Dave Dykstra - 0.9.0-1
changelog:
  - Require oidc-agent-cli-5.1.0, and use a new oidc-add --skip-check option
    there to avoid trying to get an access token at load time.  This avoids
    a 'No scopes found' error when the token issuer returns different scopes
    than requested (e.g. wlcg.capabilityset which returns a set of scopes).


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.3.0-1
changelog:
  - Add osg-release requirement
  - Allow taking osg repo definition from osg-release installed in a tarball client (SOFTWARE-2527)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 23-5
changelog:
  - Log DNs of incoming certificates (SOFTWARE-5370); raise required XRootD version to 1:5.6.0 for the feature


author: Mats Rynge <rynge@isi.edu> 1.7-1
changelog:
  - Moved to the new ospool.osg-htc.org central managers in high
    availability setup
  - Removed pre-9.0 HTCondor config - this is no longer
    supported by the OSPool (IDTOKENS only)
  - Change the VO override to the lowercase "osg" (SOFTWARE-4905)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.8-1
changelog:
  - Include the package version in the schedd classad (SOFTWARE-5105)
  - Disable .sif images on 3.x kernels (OSPOOL-18)
  - Improve OS_VERSION handling
  - Drop Map* ProbeConfig overrides (SOFTWARE-5042)


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.7.3-1.5
changelog:
  - Add:
      - 0010-Fix-gstream-configuration-processing~bece0de.patch
      - 0012-Temporary-workaround-for-segfault-noted-in-upstream~3b485c0.patch
  - Re-add (with update):
      - 0011-Xrd-Fix-MacOS-poller~9704d2a.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.8.0-1.1
changelog:
  - Update to 5.8.0 (SOFTWARE-6114)
      - Patches added:
          - 0005-Since-the-XrdPss-did-not-implement-the-auto-stat-pro~4c5e0ae.patch
          - 0006-XrdPss-Fix-proxy-when-using-tokens-and-crc32c~328ae18.patch
          - 0007-XrdHttp-Fix-HTTP-protocol-errors-on-failure~4fb2221.patch
      - Patches kept:
          - 0003-XrdTls-Allow-disabling-of-X.509-client-auth~18e1c81.patch -> 0002-XrdTls-Allow-disabling-of-X.509-client-auth~18e1c81.patch
          - 0008-XrdHttp-Undo-HTTP-PUT-response-code-change~956b9fa.patch -> 0004-XrdHttp-Undo-HTTP-PUT-response-code-change~956b9fa.patch
      - Patches updated:
          - 0001-Allow-hostname-used-by-XRootD-to-be-overridden-by-en~e13587e.patch -> 0001-Allow-hostname-used-by-XRootD-to-be-overridden-by-en~7c119b0.patch
          - 0005-XrdSciTokens-Handle-multiple-authorization-token-set~a33ca13.patch -> 0003-XrdSciTokens-Handle-multiple-authorization-token-set~ec1eb0c.patch
      - Patches dropped:
          - 0002-XrdHttp-determines-the-presence-of-the-Age-header-in~092c7a5.patch
          - 0004-Add-new-filesystem-load-counter-plugin~3c1be23.patch
          - 0006-XrdHttp-Add-http.staticheader~5c6ee05.patch
          - 0007-XrdPfc-Check-for-a-null-pointer-dereference~121f60b.patch
          - 0009-Add-ResourceMonitor-and-PurgePlugin~f34a39d.patch
          - 0010-Fix-gstream-configuration-processing~bece0de.patch
          - 0011-Xrd-Fix-MacOS-poller~9704d2a.patch
          - 0012-Temporary-workaround-for-segfault-noted-in-upstream~3b485c0.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.8.1-1.1
changelog:
  - Update to 5.8.1 (SOFTWARE-6114)
      - Patches added:
          - 0006-XrdPosix-Map-operation-timeouts-to-ETIME~9480232.patch
          - 0007-XrdSciTokens-Automatically-add-WLCG-audiences-upon-r~92c168c.patch
      - Patches kept:
          - 0007-XrdHttp-Fix-HTTP-protocol-errors-on-failure~4fb2221.patch -> 0005-XrdHttp-Fix-HTTP-protocol-errors-on-failure~4fb2221.patch
      - Patches dropped:
          - 0005-Since-the-XrdPss-did-not-implement-the-auto-stat-pro~4c5e0ae.patch
          - 0006-XrdPss-Fix-proxy-when-using-tokens-and-crc32c~328ae18.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.8.1-1.2
changelog:
  - Comment out 0007-XrdSciTokens-Automatically-add-WLCG-audiences-upon-r~92c168c.patch
  - Add 0008-Include-additional-XrdPfc-headers.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.8.1-1.5
changelog:
  - Patches added:
      - 0008-Tweak-throttle-manager-after-large-scale-testing~273c58e.patch
      - 0009-Modify-XrdThrottle-to-be-an-OSS-plugin~580a3f1.patch
      - 0010-CMake-changes-for-XrdThrottle-overhaul~fe965e8.patch
  - Patches dropped:
      - 0007-XrdSciTokens-Automatically-add-WLCG-audiences-upon-r~92c168c.patch
  - Patches kept:
      - 0008-Re-engineer-concurrency-limits-for-throttles~0ef6dbc.patch -> 0007-Re-engineer-concurrency-limits-for-throttles~0ef6dbc.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.8.2-1.1
changelog:
  - Update to XRootD 5.8.2 (SOFTWARE-6151)
      - Patches added:
          0 0008-XRootD-s-xml-response-for-PROPFIND-will-now-include~aacf631.patch
      - Patches kept:
          - 0001-Allow-hostname-used-by-XRootD-to-be-overridden-by-en~7c119b0.patch
          - 0002-XrdTls-Allow-disabling-of-X.509-client-auth~18e1c81.patch
          - 0003-XrdSciTokens-Handle-multiple-authorization-token-set~ec1eb0c.patch -> 0003-XrdSciTokens-Handle-multiple-authorization-token-set~b82ddc3.patch
          - 0004-XrdHttp-Undo-HTTP-PUT-response-code-change~956b9fa.patch
          - 0005-XrdHttp-Fix-HTTP-protocol-errors-on-failure~4fb2221.patch
          - 0007-Re-engineer-concurrency-limits-for-throttles~0ef6dbc.patch -> 0006-Re-engineer-concurrency-limits-for-throttles~39fea57.patch
          - 0009-Modify-XrdThrottle-to-be-an-OSS-plugin~580a3f1.patch -> 0007-Modify-XrdThrottle-to-be-an-OSS-plugin~921fef5.patch
      - Patches dropped:
          - 0006-XrdPosix-Map-operation-timeouts-to-ETIME~9480232.patch
          - 0008-Tweak-throttle-manager-after-large-scale-testing~273c58e.patch
          - 0010-CMake-changes-for-XrdThrottle-overhaul~fe965e8.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 138-1
changelog:
  - Add new CERN IAM endpoint for CMS (SOFTWARE-6072)
  - Remove lcg-voms2.cern.ch and voms2.cern.ch LSC files and vomses entries (SOFTWARE-6072)


author: Brian Bockelman <bbockelman@morgridge.org> - 1.0.0-1
changelog:
  - Switch to using PROPFIND for stat, preventing opening a directory as a file
  - Implement directory listings at the cache
  - Cache the results of the director response, skipping director lookup when not needed
  - Forward pelican.timeout header to the remote origin
  - Fix a bug that invoked a callback twice, potentially segfaulting the process
  - Add unit tests to the project


author: Brian Bockelman <bbockelman@morgridge.org> - 1.1.0-1
changelog:
  - Add support for Write and VectorRead operations
  - Add support for checksum query and caching
  - Add support for COPY verb to enable third-party-copy
  - Fix the returned stat flags
  - Fix uninitialized read when using the broker


author: Brian Bockelman <bbockelman@morgridge.org> - 1.2.0-1
changelog:
  - Add progress- and stall-based timeout checks.
  - Add timeout check while requests are queued.
  - Increase the default number of workers to 8.
  - Add ability to tune more parameters via environment variables.
  - Fix bug where uploads fail for files that don't exist
  - Fix thread-safety issues which could cause a libcurl deadlock.


author: Carl Edquist <edquist@cs.wisc.edu> - 2.0.4-1
changelog:
  - Initialize crc32
  - Fix assert in el8 due to vector reserve
  - Reorder variables to address compiler warning/error


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 2.1.3-1
changelog:
  - Fail plugin initialization if we can't get the OSS (SOFTWARE-5388)
  - If user cannot be mapped to uid, continue as anonymous
  - Change from named daemon to exec


