<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="10">
<package pkgid="fe7f592a54eb0b6966a6fbbdbae6109f500d9dc7871d85eb3ec9bc52e424aea8" name="obs-api" arch="noarch">
    <version epoch="0" ver="2.7.5" rel="86.1"/>

<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>
<changelog author="biao716.wang@samsung.com" date="1590580800">- OBS 2.7.4 Tizen 20200527 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [backend] createrelease_debian: use utc instead of local time
  * apply the patch to support onlybuild attribute in proj config file
  * [backend] Fix empty packages.gz test
  * [backend] Create Packages.gz for debian-installer
  * [backend] split createrepo_debian()
  * [backend] publish udebs in repo.
  * Enable networking inside VM.
  * Change the logrotate schedule.
  * Send a publish event if :need_publish exists.
  * Generate publish event for failed/broken/unresolvable.
  * check unpublished prior to publishing.
  * DXLTTC-759 Fixed 404 Error when using a repa list
  * FIXED obs-server build error, stop printing cmp error log.</changelog>
<changelog author="biao716.wang@samsung.com" date="1641384000">- OBS 2.7.5 Tizen 20230105 release
  Feature backports:
  ==================
  * [api][backend] Add support for riscv64
  * [backend] Add support zstd format.</changelog>

</package>

<package pkgid="326beb46e31710e8c3fde063bd587b5608306d675f8d50459f8c8e5d7dd31354" name="obs-common" arch="noarch">
    <version epoch="0" ver="2.7.5" rel="86.1"/>

<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>
<changelog author="biao716.wang@samsung.com" date="1590580800">- OBS 2.7.4 Tizen 20200527 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [backend] createrelease_debian: use utc instead of local time
  * apply the patch to support onlybuild attribute in proj config file
  * [backend] Fix empty packages.gz test
  * [backend] Create Packages.gz for debian-installer
  * [backend] split createrepo_debian()
  * [backend] publish udebs in repo.
  * Enable networking inside VM.
  * Change the logrotate schedule.
  * Send a publish event if :need_publish exists.
  * Generate publish event for failed/broken/unresolvable.
  * check unpublished prior to publishing.
  * DXLTTC-759 Fixed 404 Error when using a repa list
  * FIXED obs-server build error, stop printing cmp error log.</changelog>
<changelog author="biao716.wang@samsung.com" date="1641384000">- OBS 2.7.5 Tizen 20230105 release
  Feature backports:
  ==================
  * [api][backend] Add support for riscv64
  * [backend] Add support zstd format.</changelog>

</package>

<package pkgid="d65cb9c61b9bb2adf7d8916d06b405975b7e4527362c7c3ad2a3b704e3720e88" name="obs-devel" arch="noarch">
    <version epoch="0" ver="2.7.5" rel="86.1"/>

<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>
<changelog author="biao716.wang@samsung.com" date="1590580800">- OBS 2.7.4 Tizen 20200527 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [backend] createrelease_debian: use utc instead of local time
  * apply the patch to support onlybuild attribute in proj config file
  * [backend] Fix empty packages.gz test
  * [backend] Create Packages.gz for debian-installer
  * [backend] split createrepo_debian()
  * [backend] publish udebs in repo.
  * Enable networking inside VM.
  * Change the logrotate schedule.
  * Send a publish event if :need_publish exists.
  * Generate publish event for failed/broken/unresolvable.
  * check unpublished prior to publishing.
  * DXLTTC-759 Fixed 404 Error when using a repa list
  * FIXED obs-server build error, stop printing cmp error log.</changelog>
<changelog author="biao716.wang@samsung.com" date="1641384000">- OBS 2.7.5 Tizen 20230105 release
  Feature backports:
  ==================
  * [api][backend] Add support for riscv64
  * [backend] Add support zstd format.</changelog>

</package>

<package pkgid="48c185c8b7deb19a24309f1c0b461c9964a002a870daa2d959d47f4f0449b74d" name="obs-productconverter" arch="noarch">
    <version epoch="0" ver="2.7.5" rel="86.1"/>

<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>
<changelog author="biao716.wang@samsung.com" date="1590580800">- OBS 2.7.4 Tizen 20200527 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [backend] createrelease_debian: use utc instead of local time
  * apply the patch to support onlybuild attribute in proj config file
  * [backend] Fix empty packages.gz test
  * [backend] Create Packages.gz for debian-installer
  * [backend] split createrepo_debian()
  * [backend] publish udebs in repo.
  * Enable networking inside VM.
  * Change the logrotate schedule.
  * Send a publish event if :need_publish exists.
  * Generate publish event for failed/broken/unresolvable.
  * check unpublished prior to publishing.
  * DXLTTC-759 Fixed 404 Error when using a repa list
  * FIXED obs-server build error, stop printing cmp error log.</changelog>
<changelog author="biao716.wang@samsung.com" date="1641384000">- OBS 2.7.5 Tizen 20230105 release
  Feature backports:
  ==================
  * [api][backend] Add support for riscv64
  * [backend] Add support zstd format.</changelog>

</package>

<package pkgid="1b290b528c65a646e0aeae6407425ed222acb2aec1f6f18ec1eb338b95f8a476" name="obs-server" arch="noarch">
    <version epoch="0" ver="2.7.5" rel="86.1"/>

<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>
<changelog author="biao716.wang@samsung.com" date="1590580800">- OBS 2.7.4 Tizen 20200527 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [backend] createrelease_debian: use utc instead of local time
  * apply the patch to support onlybuild attribute in proj config file
  * [backend] Fix empty packages.gz test
  * [backend] Create Packages.gz for debian-installer
  * [backend] split createrepo_debian()
  * [backend] publish udebs in repo.
  * Enable networking inside VM.
  * Change the logrotate schedule.
  * Send a publish event if :need_publish exists.
  * Generate publish event for failed/broken/unresolvable.
  * check unpublished prior to publishing.
  * DXLTTC-759 Fixed 404 Error when using a repa list
  * FIXED obs-server build error, stop printing cmp error log.</changelog>
<changelog author="biao716.wang@samsung.com" date="1641384000">- OBS 2.7.5 Tizen 20230105 release
  Feature backports:
  ==================
  * [api][backend] Add support for riscv64
  * [backend] Add support zstd format.</changelog>

</package>

<package pkgid="23570b7cf0cbc9bd5a54b95dffd195b4d1547096d2f99a468338da43f9b0f5e5" name="obs-server" arch="src">
    <version epoch="0" ver="2.7.5" rel="86.1"/>

<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>
<changelog author="biao716.wang@samsung.com" date="1590580800">- OBS 2.7.4 Tizen 20200527 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [backend] createrelease_debian: use utc instead of local time
  * apply the patch to support onlybuild attribute in proj config file
  * [backend] Fix empty packages.gz test
  * [backend] Create Packages.gz for debian-installer
  * [backend] split createrepo_debian()
  * [backend] publish udebs in repo.
  * Enable networking inside VM.
  * Change the logrotate schedule.
  * Send a publish event if :need_publish exists.
  * Generate publish event for failed/broken/unresolvable.
  * check unpublished prior to publishing.
  * DXLTTC-759 Fixed 404 Error when using a repa list
  * FIXED obs-server build error, stop printing cmp error log.</changelog>
<changelog author="biao716.wang@samsung.com" date="1641384000">- OBS 2.7.5 Tizen 20230105 release
  Feature backports:
  ==================
  * [api][backend] Add support for riscv64
  * [backend] Add support zstd format.</changelog>

</package>

<package pkgid="f6b422b1b0b6d8fece9303a4d7224bb7790a2b604b60886c2fd851676b2aeec9" name="obs-source_service" arch="noarch">
    <version epoch="0" ver="2.7.5" rel="86.1"/>

<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>
<changelog author="biao716.wang@samsung.com" date="1590580800">- OBS 2.7.4 Tizen 20200527 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [backend] createrelease_debian: use utc instead of local time
  * apply the patch to support onlybuild attribute in proj config file
  * [backend] Fix empty packages.gz test
  * [backend] Create Packages.gz for debian-installer
  * [backend] split createrepo_debian()
  * [backend] publish udebs in repo.
  * Enable networking inside VM.
  * Change the logrotate schedule.
  * Send a publish event if :need_publish exists.
  * Generate publish event for failed/broken/unresolvable.
  * check unpublished prior to publishing.
  * DXLTTC-759 Fixed 404 Error when using a repa list
  * FIXED obs-server build error, stop printing cmp error log.</changelog>
<changelog author="biao716.wang@samsung.com" date="1641384000">- OBS 2.7.5 Tizen 20230105 release
  Feature backports:
  ==================
  * [api][backend] Add support for riscv64
  * [backend] Add support zstd format.</changelog>

</package>

<package pkgid="41103ac02563647aaf61dfd4ed8d62cf39e992b61689292a922514361ef8f9f7" name="obs-tests-appliance" arch="noarch">
    <version epoch="0" ver="2.7.5" rel="86.1"/>

<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>
<changelog author="biao716.wang@samsung.com" date="1590580800">- OBS 2.7.4 Tizen 20200527 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [backend] createrelease_debian: use utc instead of local time
  * apply the patch to support onlybuild attribute in proj config file
  * [backend] Fix empty packages.gz test
  * [backend] Create Packages.gz for debian-installer
  * [backend] split createrepo_debian()
  * [backend] publish udebs in repo.
  * Enable networking inside VM.
  * Change the logrotate schedule.
  * Send a publish event if :need_publish exists.
  * Generate publish event for failed/broken/unresolvable.
  * check unpublished prior to publishing.
  * DXLTTC-759 Fixed 404 Error when using a repa list
  * FIXED obs-server build error, stop printing cmp error log.</changelog>
<changelog author="biao716.wang@samsung.com" date="1641384000">- OBS 2.7.5 Tizen 20230105 release
  Feature backports:
  ==================
  * [api][backend] Add support for riscv64
  * [backend] Add support zstd format.</changelog>

</package>

<package pkgid="104d2238c959ffca07d3d38b88f3f651b33aa47d657ee049e805f34861ac45d9" name="obs-utils" arch="noarch">
    <version epoch="0" ver="2.7.5" rel="86.1"/>

<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>
<changelog author="biao716.wang@samsung.com" date="1590580800">- OBS 2.7.4 Tizen 20200527 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [backend] createrelease_debian: use utc instead of local time
  * apply the patch to support onlybuild attribute in proj config file
  * [backend] Fix empty packages.gz test
  * [backend] Create Packages.gz for debian-installer
  * [backend] split createrepo_debian()
  * [backend] publish udebs in repo.
  * Enable networking inside VM.
  * Change the logrotate schedule.
  * Send a publish event if :need_publish exists.
  * Generate publish event for failed/broken/unresolvable.
  * check unpublished prior to publishing.
  * DXLTTC-759 Fixed 404 Error when using a repa list
  * FIXED obs-server build error, stop printing cmp error log.</changelog>
<changelog author="biao716.wang@samsung.com" date="1641384000">- OBS 2.7.5 Tizen 20230105 release
  Feature backports:
  ==================
  * [api][backend] Add support for riscv64
  * [backend] Add support zstd format.</changelog>

</package>

<package pkgid="756d0f04aa1c8dcab691664a806677b0593083bf78d685cb060640b97c84faa3" name="obs-worker" arch="noarch">
    <version epoch="0" ver="2.7.5" rel="86.1"/>

<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372852800">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
<changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
<changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
<changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
<changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>
<changelog author="biao716.wang@samsung.com" date="1590580800">- OBS 2.7.4 Tizen 20200527 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [backend] createrelease_debian: use utc instead of local time
  * apply the patch to support onlybuild attribute in proj config file
  * [backend] Fix empty packages.gz test
  * [backend] Create Packages.gz for debian-installer
  * [backend] split createrepo_debian()
  * [backend] publish udebs in repo.
  * Enable networking inside VM.
  * Change the logrotate schedule.
  * Send a publish event if :need_publish exists.
  * Generate publish event for failed/broken/unresolvable.
  * check unpublished prior to publishing.
  * DXLTTC-759 Fixed 404 Error when using a repa list
  * FIXED obs-server build error, stop printing cmp error log.</changelog>
<changelog author="biao716.wang@samsung.com" date="1641384000">- OBS 2.7.5 Tizen 20230105 release
  Feature backports:
  ==================
  * [api][backend] Add support for riscv64
  * [backend] Add support zstd format.</changelog>

</package>

</otherdata>