<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="14"><package pkgid="5c6ab2c278b0c9eb6bc880761c0a50f092f2f1616315beea4489c1edf0e7affb" name="obs-api" arch="x86_64">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>
<package pkgid="9d178cfd783c1da9235006101afdeb8ef73a3d0ab404009d30e64de49faa03f9" name="obs-devel" arch="x86_64">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>
<package pkgid="e935655c8834f36801fa61d3e72a26e4321935a3df65ce3cc72f7df0878b3ac2" name="obs-productconverter" arch="x86_64">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>
<package pkgid="39b4303a0830dfd8efb75ecb3f3c9522e54ab3f72b25270238fe6ea9856cc4d0" name="obs-server" arch="src">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>
<package pkgid="d4ddfadfe1e202db198229bc31f7c6cb2d8c67ab7ba5c5e1e765abd0b5651580" name="obs-server" arch="x86_64">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>
<package pkgid="c2eab2a0f17766f60a8dd743746a1ef8cd75308f1c6d3c5c23bbe9230a468469" name="obs-source_service" arch="x86_64">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>
<package pkgid="8a189afcbee7d351ae23e11fb6137d4671eef0b5501953521a4420f721561fd4" name="obs-utils" arch="x86_64">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>
<package pkgid="81d055af0bf16d364c2382d5e967b1e952318813cab4b304c401603a30c4ad87" name="obs-worker" arch="noarch">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>

<package pkgid="2dbea6c20b257a3fdd17bba6365f59427747a8c51d74e86eac27ea87279e2adb" name="obs-api" arch="i586">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>

<package pkgid="d9900b68fee700884caa5c59ff14e1bb436531b15434d5ff69d3fb3219172923" name="obs-devel" arch="i586">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>

<package pkgid="171e301c363f8f731b93547dd072ca4c868aaf3e8d0cde9c4a75641841b419c4" name="obs-productconverter" arch="i586">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>

<package pkgid="f454686bd3c8670b6206a3606047ea6cb309a4ffc53762a2bdc33ced252ecd78" name="obs-server" arch="i586">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>

<package pkgid="c662bd878a621d9d8da41ed53808ca1912abe9994317c5676f64c4b5b71c38dc" name="obs-source_service" arch="i586">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>

<package pkgid="24cbeda9b06b5ea863be9d543413821a08fb02bc8fc91569e7eefa0bb22b28d0" name="obs-utils" arch="i586">
    <version epoch="0" ver="2.4.6" rel="9.1"/>

<changelog author="adrian@suse.de" date="1341921600">- update to OBS 2.3.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Fix initial database setup on appliances (regression in 2.3.2)
  * New packages got not detected, when using project project links to
    a remote OBS instance.
    Either a scheduler cold start is needed or an
    [#] obs_admin --deep-check-project ...
    for a propper recalculation of the project.
  * Request diffs were broken when the source got removed.
  * removed a sleep on each package build</changelog>
<changelog author="adrian@suse.de" date="1345550400">- update to OBS 2.3.4
  Feature backports:
  ==================
  * Added "Hostarch" in _buildinfo for osc local builds of cross builds
  Changes:
  ========
  * package meta creation of package copy command is not copying
    relationships and devel definitions anymore.
  * Added openSUSE 12.2 to default target list
  * Removed openSUSE 11.4 from default target list (EOL soon)
  * Fedora 15 is EOL, removed from default list
  Bugfixes:
  =========
  * webui: fixed underscores in code listings
  * webui: Do not expose user email address in anonymous mode
  * backend: increase vrev on package source copy
  * obsworker: do not fail when no /etc/sysconfig/proxy exists
  * build: fixed cross architecture initilisation for chroot builds</changelog>
<changelog author="adrian@suse.de" date="1345809600">- update to OBS 2.3.4.1
  - fix a typo in default target list
  - fix publisher timeoute handling</changelog>
<changelog author="adrian@suse.de" date="1347969600">- update to OBS 2.3.5
  Feature backports:
  ==================
  * Simple request collection interface supports simple group request now
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: aggregate block state gets calculated correctly now
  * api: it was possible to remove packages in not writeable projects via
    submit requests.</changelog>
<changelog author="adrian@suse.de" date="1349956800">- update to OBS 2.3.6
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: run the rescale of build monitor statistics hourly
  * api: a package created by submit request took over group roles. Does not happen anymore.
  Bugfixes:
  =========
  * webui: fixed default config for api port (https now)
  * api: close /public route when anonymous access is set to disabled.</changelog>
<changelog author="adrian@suse.de" date="1352721600">- drop perl-BSSolv version number for now.</changelog>
<changelog author="adrian@suse.de" date="1353067200">- update to OBS 2.3.7
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability with perl-BSSolv 0.18 and later.
  * webui: Added Ubuntu 12.10 and removed 11.04 from default list.
  Bugfixes:
  =========
  * webui: fixed source file download link, when anonymous mode got disabled.
  * backend: fixed hostarch cross build support for kiwi and delta jobs
  * backend: fixed scanning of package sources after project copy</changelog>
<changelog author="adrian@suse.de" date="1361880000">- update to OBS 2.3.8
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: Added openSUSE 12.3 and Fedora 18 to default list
  Bugfixes:
  =========
  * webui: build results show up again with latest Rails 2.3 security update</changelog>
<changelog author="adrian@suse.de" date="1362398400">- update to OBS 2.4 RC1 (2.3.95 tag)
  Regressions:
  ============
  * LDAP support is not tested and in unknown state (not part of test suite)
  * source service editor in webui is not available
  Changes on purpose:
  ===================
  * Migration to Ruby 1.9 and Rails 3.2
  * request database got move from backend to the api. Directly
    after update all requests seem to have vanished, but a delayed
    job is importing them again. This can take some hours dependening
    on the amount of requests.
  * package meta of package copy command is not copying
    relationships and devel definitions anymore
  * Requests do require a description now in any case
  * webui configurations got moved from environments/*.rb to config/options.yml.
  * Package conflicts and obsoletes are taken into account when resolving
    dependencies for build jobs. This improves build consistency but may also lead
    to new "unresolvable" errors, since they were ignored so far. The old behaviour
    can be restored by adding the following line into the project configuration:
    ExpandFlags: ignoreconflicts
  * cross architecture build directives in project configuration
    CBInstall and CBPreinstall are not supported anymore. Use standard "Install" and
    "Preinstall" directives instead.
    =&gt; all architectures can be used as host for cross build now.
  * The api file/distribution.xml is obsolete, the config gets stored in the SQL database
    now. Existing file gets imported during migration.
  Features
  ========
  * Arch Linux package format support got added.
  * Build Job Constraints handling. It can be used to define build
    instance requirements for certain build jobs. Either for defined
    package sources or for all repositories.
    Documentation about this can be found here:
    http://openbuildservice.org/help/manuals/obs-reference-guide/cha.obs.build_job_constraints.html
  * Support of preinstall images, which can be used to speed up build
    jobs. They need to be build manually, but get automatically used for
    creating a build instance base in a faster way than just with installing
    packages.
  * Static links (without version and release numbers) for binary results
    in the published repositories can be configured now. This can be done via
    the "staticlinks" keyword in Repotype: definition.
  * Build Prerequires can be used also with the FileProvides feature in the
    build configuration now.
  * Regular users can copy entire projects (without binary results) now.
  * Upload of binaries via api is allowed to administrators now.
  * Data about used resources of build jobs get collected. However it
    gets not yet used for build job assignment
  * Requests can be listed also for given groups now.
  * Checkout of delete packages does not require a srcmd5 sum anymore.
  * Delete Requests can be used to request deletion of repositories from
    a project.
  * Support of creation of application data xml which can be used for app
    stores for application centric browsing versus package browsing.
  * Support hugetable memory usage for kvm workers.
  * Support building cross build formats, eg. building an rpm with a kiwi
    build description or an deb package via a .spec file.
  * Efficient transport of product build results from worker to backend.
  * aarch64 architecture added (aka armv8 or arm64)
  * New generic "emulator" virtualization support. Can be used to build inside
    of system emulators (for foreign hardware for example)
  Deprecated:
  ===========
  The following calls have been marked as deprecated, they will get removed in OBS 3.0
  * api
  - /person/$LOGIN/group   -&gt; use /group?login=$LOGIN   instead
  - /search/project_id     -&gt; use /search/project/id    instead
  - /search/package_id     -&gt; use /search/package/id    instead
  * The deprecated support to copy qemu binaries from external build host into
    build environment has been removed.
  Notes for systems using systemd:
  ================================
  OBS is using init scripts, not systemd style .service files. This will stay until
  we will switch from SLES 11 to SLES 12 as default production platform.
  openSUSE installations may use systemd (instead of sysvinit) and it should work
  in general. Not working are usages like
  [#] rcobssrcserver status
  You will only get the systemd status here. To see what the daemon is doing you need to
  [#] cd /etc/init.d
  [#] ./obssrcserver status</changelog>
<changelog author="adrian@suse.de" date="1364990400">- update to OBS 2.4 RC2 (2.3.96 tag)
  * fixed loading of ruby LDAP module
  * signer performance optimizations
  * solving migration issues</changelog>
<changelog author="adrian@suse.de" date="1367323200">- update to OBS 2.4.0
  * LDAP support is fixed
  * webui points admin to add a remote instance for adding repos.</changelog>
<changelog author="adrian@suse.de" date="1367582400">- update to 2.4.1
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: the scheduler ignores a left over exit event during
  intial startup now
  * backend: support static links for kiwi installation medias
  * backend: use async mode during test suite run
  * backend: catch cases where broken repositories cause endless builds
  * runlevel scripts have nicer output now
  Bugfixes:
  =========
  * api: check_database script works now also before calling db:migrate
  * api: support packager owner search with explicit no filters
  * api: stream file uploads directly to backend, fixes OOM kills with large files
  * backend: fixed source caching from remote instance source packages
  * backend: fixed role analyses for read protected projects and packages
  * backend: fixed update of static links during publishing
  * backend: fixed ordering of binary upload events
  * general: documentation updates</changelog>
<changelog author="adrian@suse.de" date="1368532800">- update to 2.4.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * build: vminit can now be installed for multiple architectures in parallel on
  OBS server.
  * build: debian builds call linitian now if installed
  * build: Arch Linux: support new pacman tool syntax
  * build: support kiwi installation medias with new kiwi versions
  * api: Interconnect supports to use credentials as part of the remoteurl.
    Note: the url must not use /public suffix in that case
  * webui: change password is allowed by default in config file now
  * webui: Disable browser autocomplete on sign up form
  Bugfixes:
  =========
  * build: fixed regression using build host rpm instead of the version from chroot
  * build: fixed repository priority ordering, when only some repos have a priority
  and kiwi appliances get build
  * build: support kiwi appliances using multiple &lt;packages&gt; sections in config file
  * build: rpm packages get installed again without fsync which speeds up the installation
  * backend: fixed binary rpm cache handling for image building via interconnect
  * webui: fixed change password dialog
  * webui: fixed display of groups and globalrole</changelog>
<changelog author="adrian@suse.de" date="1371124800">- update to 2.4.3
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * api: support default targets on OBS 2.5 remote instances using defined architecture
    per repositories
  Bugfixes:
  =========
  * webui: fix for user editing could have dropped admin role
  * api: documentation fixes
  * api: fix storage of Download on Demand path in API
    (Note: this is still an experimental feature likely to change)
  * api: crash fixed when request status includes repository pathes to remote instances
  * api: allow request state change to approved only from new/review states (regression fix)
  * backend: fix scanprjbinaries event handling
  * backend: fixed caching for remote source handling in some cases
  * backend: undelete of a project does restore the signkey now
  * backend: fixed macro block parsing when using %if statements</changelog>
<changelog author="adrian@suse.de" date="1373284800">- update to 2.4.4
  This release fixes a serious security leak tracked as CVE-2013-3703:
  Users can add or remove other users to projects or packages where
  they have no maintainership.
  All OBS 2.4 user a requested to updated immediatly to close this
  hole. Instances with OBS 2.3 and before are not affected.
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * api: Fix for CVE-2013-3703
  * api: Do not hide projects which have an explicit access enabled tag.
  * api: handle invalid strings in options.yml for allow_user_to_create_home_project setting
  * backend: repository type changes got not catched by the scheduler
  * backend: fix project deleting not cleaning up build area in async mode
  * backend: hostlabel build constraints had no effect
  * backend: constraints defined in project config had no effect
  * backend: start more then one worker by default if not using zVM</changelog>
<changelog author="adrian@suse.de" date="1373457600">- require explicit createrepo 0.9.8. All other versions have
  currently a problem.</changelog>
<changelog author="adrian@suse.de" date="1382529600">- update to 2.4.5
  Bugfixes and feature backports to support new CVE and Ubuntu distribution.
  Feature backports:
  ==================
  * backend: Debian multiarch support (for Ubuntu 13.10 via perl-BSSolver)
  * api: support new CVE syntax as it will be used in 2014
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * appliance: fix start order between apache and mysql when using systemd
  * backend: fix for using if conditions in prjconf macros sections
  * backend: fix possible cache inconstency in worker binary cache
  * backend: multiple fixes for constraints handling
  * backend: use configured http proxies when download worker code.
  * api: ensure existins of "deleted" project and repository on update</changelog>
<changelog author="adrian@suse.de" date="1395662400">- update to 2.4.6
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * webui: fix CSRF protection (CVE-2014-0594) (bnc#870606)
  * webui: fix a syntax error when storing instance configuration
  * api: fix database locking when changing states of requests
  * api: fix typo that fails retry for connection when using LDAP auth.
  * api: fix issue tracking via delayed job</changelog>
<changelog author="adrian@suse.de" date="1426161600">- update to 2.4.7
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- update to 2.4.8
  Feature backports:
  ==================
  * None
  Changes:
  ========
  * None
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)</changelog>

</package>

</otherdata>