<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="10">
<package pkgid="3cbe1d7f3852c2454a34a72b8a7b978f4b33d1ebe05dc7e402a6ec0a86447757" name="obs-api" arch="noarch">
    <version epoch="0" ver="2.7.3" rel="74.1"/>

<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>

</package>

<package pkgid="f134d0241ad6c571393227ecc3bab803638ab67a01998f3164e34a6d418fabf3" name="obs-common" arch="noarch">
    <version epoch="0" ver="2.7.3" rel="74.1"/>

<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>

</package>

<package pkgid="4af1fb3da011ef6df012bfa7ccbfefb5f9cab85e2c4aabcb1256e6cf8f6fef71" name="obs-devel" arch="noarch">
    <version epoch="0" ver="2.7.3" rel="74.1"/>

<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>

</package>

<package pkgid="16d8a0bb998a8d6abe6dcb0b8a52ab28016e40921b33751065e1e78fd65433d1" name="obs-productconverter" arch="noarch">
    <version epoch="0" ver="2.7.3" rel="74.1"/>

<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>

</package>

<package pkgid="5985f997dc70e3e69d14a4cd0032499fc1cfccf888c38f0c14f3985ca658d986" name="obs-server" arch="noarch">
    <version epoch="0" ver="2.7.3" rel="74.1"/>

<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>

</package>

<package pkgid="4b0a3ccc646dba0d71d88eb3304347905bd9ef096bf339fb872cd7a1225a2ad3" name="obs-server" arch="src">
    <version epoch="0" ver="2.7.3" rel="74.1"/>

<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>

</package>

<package pkgid="09cac776c4c1eb39c2e9648f884686ef1a179e892ca47f7e416650af07b3d7b9" name="obs-source_service" arch="noarch">
    <version epoch="0" ver="2.7.3" rel="74.1"/>

<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>

</package>

<package pkgid="46b1bba867d33c9abd690736bf78f74832ae5a5bc58b9f5817e7fb87e9715fb1" name="obs-tests-appliance" arch="noarch">
    <version epoch="0" ver="2.7.3" rel="74.1"/>

<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>

</package>

<package pkgid="03bec765ab55bc2c0ca7829419859e6b2c2ab27c61db6a14e6c1da05ee02b6ab" name="obs-utils" arch="noarch">
    <version epoch="0" ver="2.7.3" rel="74.1"/>

<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>

</package>

<package pkgid="b2defaf135f3ea4d43fabd8fa078aa748c7ac8e28324991117869c9ec1e2c1d6" name="obs-worker" arch="noarch">
    <version epoch="0" ver="2.7.3" rel="74.1"/>

<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>

</package>

</otherdata>