# changelog

author: Nvidia <networking-support@nvidia.com>
changelog:
  - dpacc release v1.7.0
  - Full release notes: https://docs.nvidia.com/doca/sdk/doca-release-notes/index.html


author: Nvidia <networking-support@nvidia.com>
changelog:
  - dpacc-extract release v1.7.0
  - Full release notes: https://docs.nvidia.com/doca/sdk/doca-release-notes/index.html


author: Spencer Lingard <spencer@nvidia.com> - 3.0.0~beta1-2
changelog:
  - Use systemd macros for unit setup
  - Use preset file instead of enabling service manually
  - Fix Requires/BuildRequires


author: Spencer Lingard <Spencer@nvidia.com> - 3.0.0~beta1-3
changelog:
  - Add -p to all install invocations
  - Change __install macro to just install
  - Add autogenerated comment to Source to tell how to obtain sources


author: Spencer Lingard <spencer@nvidia.com> - 1.1-5
changelog:
  - Simplify release tag
  - Add comment explaining ExclusiveArch tag
  - Improve description
  - Remove unneeded build dependency
  - Move mlxbf-bootctl from /sbin to /usr/sbin
  - Pull in code coverage fixes


author: Björn Esser <besser82@fedoraproject.org> - 1.9.0-5
changelog:
  - Add conditional for bootstrapping new architectures
  - Use %set_build_flags macro to export buildflags, if available


author: Jeff Squyres <jsquyres@cisco.com>
changelog:
  - Add missing executables to specfile (ompi-server, etc.)
  - Fix: pull in VT files when building multiple RPMs (reported by Jim
    Kusznir).
  - Add allow_fortify_source option to let users selectively disable
    _FORTIFY_SOURCE processing on platforms where it just doesn't work
    (even with gcc; also reported by Jim Kusznir).


author: Jeff Squyres <jsquyres@cisco.com>
changelog:
  - Removed OSCAR defines.
  - If use_mpi_selector==1, then also set install_shell_scripts to 1.
  - Change modules default RPM name and modulefiles path to the defaults
    on RHEL6.


author: Jeff Squyres <jsquyres@cisco.com>
changelog:
  - Didn't change the specfile, but changed the script that generates
    the SRPM to force the use of MD5 checksums (vs. SHA1 checksums) so
    that the SRPM is friendly to older versions of RPM, such as that on
    RHEL 5.x.


author: Jeff Squyres <jsquyres@cisco.com>
changelog:
  - Remove the "ofed" and "munge_build_into_install" options, because
    OFED no longer distributes MPI implementations.  Yay!


author: Jeff Squyres <jsquyres@cisco.com>
changelog:
  - Re-release 1.6.0-1.6.3 SRPMs (with new SRPM Release numbers) with
    patch for VampirTrace's configure script to make it install the
    private "libtool" script in the right location (the script is used
    to build user VT applications).
  - Update the regexps/methodology used to generate the lists of files
    in the multi-RPM sub-packages; it's been broken for a little while.
  - No longer explicitly list the bin dir executables in the multi-RPM
    sub-packages
  - Per https://svn.open-mpi.org/trac/ompi/ticket/3382, remove all files
    named "config.log" from the install tree so that we can use this
    spec file to re-release all OMPI v1.6.x SRPMs.


author: Jeff Squyres <jsquyres@cisco.com>
changelog:
  - Several minor fixes from Oliver Lahaye: fix dates in changelog,
    added  tag to the Release field, and added some Provides
    fields in case openmpi is overridden.


author: Jeff Squyres <jsquyres@cisco.com>
changelog:
  - Reverting a decision from a prior changelog entry: if
    install_in_opt==1, then even put the modulefile under /opt.


author: Robert Scheck <robert@fedoraproject.org> 1.1.1c-2
changelog:
  - backport from 1.1.1c-15: add selftest of the RAND_DRBG implementation
  - backport from 1.1.1c-14: fix incorrect error return value from FIPS_selftest_dsa
  - backport from 1.1.1c-14: S390x: properly restore SIGILL signal handler
  - backport from 1.1.1c-12: additional fix for the edk2 build
  - backport from 1.1.1c-9: disallow use of SHA-1 signatures in TLS in FIPS mode
  - backport from 1.1.1c-8: fix CVE-2019-1547 - side-channel weak encryption vulnerability
  - backport from 1.1.1c-8: fix CVE-2019-1563 - padding oracle in CMS API
  - backport from 1.1.1c-8: fix CVE-2019-1549 - ensure fork safety of the DRBG
  - backport from 1.1.1c-8: fix handling of non-FIPS allowed EC curves in FIPS mode
  - backport from 1.1.1c-8: fix TLS compliance issues
  - backport from 1.1.1c-7: backported ARM performance fixes from master
  - backport from 1.1.1c-6: backport of S390x ECC CPACF enhancements from master
  - backport from 1.1.1c-6: FIPS mode: properly disable 1024 bit DSA key generation
  - backport from 1.1.1c-6: FIPS mode: skip ED25519 and ED448 algorithms in openssl speed
  - backport from 1.1.1c-6: FIPS mode: allow AES-CCM ciphersuites
  - backport from 1.1.1c-5: make the code suitable for edk2 build
  - backport from 1.1.1c-4: backport of SSKDF from master
  - backport from 1.1.1c-3: backport of KBKDF and KRB5KDF from master


author: Robert Scheck <robert@fedoraproject.org> 1.1.1g-1
changelog:
  - backport from 1.1.1g-11: Further changes for SP 800-56A rev3 requirements
  - backport from 1.1.1g-9: Rewire FIPS_drbg API to use the RAND_DRBG
  - backport from 1.1.1g-9: Use the well known DH groups in TLS even for 2048 and 1024 bit parameters
  - backport from 1.1.1g-7: Disallow dropping Extended Master Secret extension on renegotiation
  - backport from 1.1.1g-7: Return alert from s_server if ALPN protocol does not match
  - backport from 1.1.1g-7: SHA1 is allowed in @SECLEVEL=2 only if allowed by TLS SigAlgs configuration
  - backport from 1.1.1g-6: Add FIPS selftest for PBKDF2 and KBKDF
  - backport from 1.1.1g-5: Allow only well known DH groups in the FIPS mode
  - backport from 1.1.1g-1: update to the 1.1.1g release
  - backport from 1.1.1g-1: FIPS module installed state definition is modified


author: Robert Scheck <robert@fedoraproject.org> 1.1.1g-2
changelog:
  - backport from 1.1.1g-12: Fix CVE-2020-1971 ediparty null pointer dereference
  - backport from 1.1.1g-11.1: Implemented new FIPS requirements in regards to KDF and DH selftests
  - backport from 1.1.1g-11.1: Disallow certificates with explicit EC parameters


author: Robert Scheck <robert@fedoraproject.org> 1.1.1g-3
changelog:
  - backport from 1.1.1g-15: version bump
  - backport from 1.1.1g-14: CVE-2021-3450 openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT
  - backport from 1.1.1g-13: Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-1
changelog:
  - backport from 1.1.1k-4: Fixes bugs in s390x AES code
  - backport from 1.1.1k-4: Uses the first detected address family if IPv6 is not available
  - backport from 1.1.1k-4: Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx could
    early callback instead of servername callback. Resolves: rhbz#197821, related: rhbz#1934534
  - backport from 1.1.1k-3: Cleansup the peer point formats on renegotiation. Resolves rhbz#1965362
  - backport from 1.1.1k-2: Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - backport from 1.1.1k-2: Using safe primes for FIPS DH self-test
  - backport from 1.1.1k-1: Update to version 1.1.1k
  - backport from 1.1.1g-16: Use AI_ADDRCONFIG only when explicit host name is given
  - backport from 1.1.1g-16: Allow only curves defined in RFC 8446 in TLS 1.3


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-2
changelog:
  - backport from 1.1.1k-5: CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
    Resolves: rhbz#2005402


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-3
changelog:
  - backport from 1.1.1k-6: CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
    Resolves: rhbz#2067146


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-4
changelog:
  - backport from 1.1.1k-7: CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - backport from 1.1.1k-7: Update expired certificates used in the testsuite
    Resolves: rhbz#2092462
  - backport from 1.1.1k-7: CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090372
  - backport from 1.1.1k-7: CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098279


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-5
changelog:
  - backport from 1.1.1k-9: Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - backport from 1.1.1k-9: Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - backport from 1.1.1k-9: Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - backport from 1.1.1k-9: Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286
  - backport from 1.1.1k-8: Fix no-ec build
    Resolves: rhbz#2071020


