# changelog

author: Carl Edquist <edquist@cs.wisc.edu> - 1.20.3-2
changelog:
  - Fix htcondor-ce probe's condor_config_val queries (SOFTWARE-2629)
  - Update pbs/lsf latest timestamp for empty logfiles (SOFTWARE-3041)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.20.8-1
changelog:
  - Avoid setting processors twice in slurm probe (SOFTWARE-3475)
  - Add travis-ci infrastructure, add condor unit tests (#43)
  - Default to 0 processors in condor probe (SOFTWARE-3474, SOFTWARE-3476)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.20.9-1
changelog:
  - Packaging revamp (SOFTWARE-3546)
  - Document probe xml records (SOFTWARE-3609, SOFTWARE-3641)
  - Cleanup init script (SOFTWARE-2503)
  - Fix Exception string construction (#37)
  - Support slurm v18 schema (SOFTWARE-3724)


author: Brian Lin <blin@cs.wisc.edu> - 3.2.1-1
changelog:
  - Explicitly set ALLOW_READ to support HTCondor 8.9 (SOFTWARE-3538)
  - Add timeouts to the BDII provider


author: Brian Lin <blin@cs.wisc.edu> - 3.2.2-1
changelog:
  - Make blahp requirement binary package specific (SOFTWARE-3623)
  - Added condor_ce_store_cred for PASSWORD authentication
  - Use new multi-line syntax configuration syntax (SOFTWARE-3637)
  - Update MyOSG URL and queries


author: Brian Lin <blin@cs.wisc.edu> - 3.3.0-1
changelog:
  - Add APEL support for HTCondor-CE and HTCondor backends
  - Store malformed ads reporting to htcondor-ce-collector


author: Brian Lin <blin@cs.wisc.edu> - 4.0.0-0.2
changelog:
  - Use simplified CERequirements format:
  https://htcondor-wiki.cs.wisc.edu/index.cgi/tktview?tn=6133,86
  - Reorganize HTCondor-CE configuration: configuration that admins are
  expected to change is in /etc, other configuration is in /usr
  - Remove most OSG-specific configuration into the OSG CE metapackage
  (SOFTWARE-3813)
  - Increase the default maximum walltime to 72 hours


author: Brian Lin <blin@cs.wisc.edu> - 4.1.0-1
changelog:
  - Add non-OSG method for modifying the job environment (SOFTWARE-3871)
  - Simplify configuration of APEL scripts
  - Do not require authentication for queue reads (SOFTWARE-3860)
  - Allow local CE users to submit jobs without a proxy or token (SOFTWARE-3856)
  - Fix the ability to specify grid certificate locations for SSL authentication
  - Refine the APEL record filter to ignore jobs that have not yet started
  - Fix an issue where `condor_ce_q` required authentication
  - Re-enable the ability for local users to submit jobs to the CE queue
  - Fix an issue where some jobs were capped at 72 minutes instead of 72 hours
  - Add `systemctl daemon-reload` to packaging for initial installations
  - Improve robustness of BDII provider


author: Brian Lin <blin@cs.wisc.edu> - 4.2.0-1
changelog:
  - Add SSL support for reporting to central collectors (SOFTWARE-3939)
  - GLUE2 validation improvements for the BDII provider (#308)


author: Brian Lin <blin@cs.wisc.edu> - 4.2.1-1
changelog:
  - Drop vestigial central collector config generator
  - Fix unmapped GSI/SSL regexps and allow unmapped enttities to advertise to the central ceollector (SOFTWARE-3939)


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.7-1
changelog:
  - Updated condor_annex to work with upcoming AWS Lambda function changes
  - Added the ability to specify the order that job routes are applied
  - Fixed a bug that could cause remote condor submits to fail
  - Fixed condor_wait to work when the job event log is on AFS
  - Fixed RPM packaging to be able to install condor-all on CentOS 8
  - Period ('.') is allowed again in DAGMan node names


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.8-1
changelog:
  - Fixes addressing CVE-2019-18823
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2020-0001.html
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2020-0002.html
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2020-0003.html
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2020-0004.html


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.9-1
changelog:
  - Proper tracking of maximum memory used by Docker universe jobs
  - Fixed preempting a GPU slot for a GPU job when all GPUs are in use
  - Fixed a Python crash when queue_item_data iterator raises an exception
  - Fixed a bug where slot attribute overrides were ignored
  - Calculates accounting group quota correctly when more than 1 CPU requested
  - Updated HTCondor Annex to accommodate API change for AWS Spot Fleet
  - Fixed a problem where HTCondor would not start on AWS Fargate
  - Fixed where the collector could wait forever for a partial message
  - Fixed streaming output to large files (>2Gb) when using the 32-bit shadow


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.10-1
changelog:
  - condor_qedit can no longer be used to disrupt the condor_schedd
  - Fixed a bug where the SHARED_PORT_PORT configuration setting was ignored
  - Ubuntu 20.04 and Amazon Linux 2 are now supported
  - In MacOSX, HTCondor now requires LibreSSL, available since MacOSX 10.13


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.10-1.3.osg
changelog:
  - Fix Bosco patch to match upstream source
  - Change permissions on /var/{lock,run}/condor to make rpm verify work


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.11-1
changelog:
  - HTCondor now properly tracks usage over vanilla universe checkpoints
  - New ClassAd equality and inequality operators in the Python bindings
  - Fixed a bug where removing in-use routes could crash the job router
  - Fixed a bug where condor_chirp would abort after success on Windows
  - Fixed a bug where using MACHINE_RESOURCE_NAMES could crash the startd
  - Improved condor c-gahp to prioritize commands over file transfers
  - Fixed a rare crash in the schedd when running many local universe jobs
  - With GSI, avoid unnecessary reverse DNS lookup when HOST_ALIAS is set
  - Fix a bug that could cause grid universe jobs to fail upon proxy refresh


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.12-1
changelog:
  - Added a family of version comparison functions to ClassAds
  - Increased default Globus proxy key length to meet current NIST guidance


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.13-1
changelog:
  - condor_ssh_to_job now maps CR and NL to work with editors like nano
  - Improved the performance of data transfer in condor_ssh_to_job
  - HA replication now accepts SHA-2 checksums to prepare for MD5 removal
  - Submission to NorduGrid ARC CE works with newer ARC CE versions
  - Fixed condor_annex crashes on platforms with newer compilers
  - Fixed "use feature: GPUsMonitor" to locate the monitor binary on Windows
  - Fixed a bug that prevented using the '@' character in an event log path


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.1.4-1
changelog:
  - Fix condor_ce_trace failures caused by transferring /usr/bin/env (SOFTWARE-3387)
  - Fix regex for RDIG certs (SOFTWARE-3399)
  - Don't require authz check for condor_ce_q (SOFTWARE-3414)


author: Brian Lin <blin@cs.wisc.edu> - 3.2.0-1
changelog:
  - Map certs with VOMS attr before local daemons (SOFTWARE-3489)
  - Send CEView keepalives as the condor user (SOFTWARE-3486)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 2.2.2-1
changelog:
  - Add option to evaluate all FQANs with vomsmap auth (SOFTWARE-2932)
  - Tweak comments in 10-misc.ini (SOFTWARE-2941)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 2.2.3-1
changelog:
  - Replace dummy packages with obsoletes (SOFTWARE-3020)
  - Drop el5-isms (SOFTWARE-3050)
  - Put site info config into a separate module so osg-configure-gratia can require it (SOFTWARE-3018)
  - Remove remaining TWiki references (SOFTWARE-3036)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 2.2.4-1
changelog:
  - Improve comment for app_dir in 10-storage.ini (SOFTWARE-3150)
  - Handle exception caused by parse error (SOFTWARE-2310)
  - Don't require CE site information for non-CEs (SOFTWARE-3094)
  - Warn on long-deprecated "site information/site_name" attribute (SOFTWARE-3093)
  - Remove functions used for condor-python < 8.4 (SOFTWARE-3126)
  - Don't make /etc/condor-ce/config.d/50-osg-configure.conf without condor-ce (SOFTWARE-3160)
  - Validate environment variables in 40-localsettings.ini (SOFTWARE-3131)
  - Rename siteattributes.py to siteinformation.py


author: Mátyás Selmeci <matyas@cs.wisc.edu> 2.3.1-1
changelog:
  - Replace info about GOC/OIM in 40-siteinfo.ini comments (SOFTWARE-3297)
  - More thoroughly disable WN proxy renewal in BLAHP config (SOFTWARE-3161)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 2.4.0-1
changelog:
  - Stop checking sponsor field in site information (SOFTWARE-3722)
  - Don't change batch system from slurm to pbs (SOFTWARE-3717)
  - Add option to configure blahp for PBS Pro (SOFTWARE-3674)
  - Stop osg-configure when a bad attribute is found (SOFTWARE-3581)
  - Own a section of the SSH config for bosco (SOFTWARE-3630)


author: Brian Lin <blin@cs.wisc.edu> - 3.4-1
changelog:
  - Drop GridFTP (SOFTWARE-2633)
  - Drop client tools (SOFTWARE-2650)
  - Drop GUMS and edg-mkgridmap (SOFTWARE-2482, SOFTWARE-2600)
  - Drop GRAM-related osg-configure modules (SOFTWARE-2705)


author: Edgar Fajardo <emfajard@ucsd.edu> - 3.4-3
changelog:
  - Merged osg-base-ce and osg-htcondor-ce into only one subpackages (SOFTWARE-2768)
  - Remove the osg-base-ce package


author: Brian Lin <blin@cs.wisc.edu> - 3.5-2
changelog:
  - Add Blahp location and Gratia cleanup configuration (SOFTWARE-3813)
  - Remove deprecated and 32-bit requirements
  - Add Ansible requirement (SOFTWARE-3813)
  - Add tools that automatically update WN tarball, CAs, and CRLs on the
  remote head node (SOFTWARE-3582)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.1.1-1
changelog:
  - Relax hostname validation in 40-siteinfo.ini (failing to resolve is now a warning) (SOFTWARE-3953)
  - No longer make resource_group mandatory for CEs in 40-siteinfo.ini (SOFTWARE-3949)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.3.0-4
changelog:
  - Use double layer of const for deserialize
    (patch from https://github.com/scitokens/scitokens-cpp/commit/ac0b2f0679488fa91c14ed781268efbcdb69ed3c)


author: Derek Weitzel <dweitzel@unl.edu> - 0.3.3-1
changelog:
  - Merge OSG changes
  - Use a newer, still supported version of devtoolset
  - Fix bug in verifying EC signed tokens #13


author: Brian Lin <blin@cs.wisc.edu> - 113-1
changelog:
  - Add new CLAS12/EIC VO certificates (SOFTWARE-4666)
  - Retire old CLAS12/EIC VO certificates (SOFTWARE-4666)
  - Disable new ATLAS/CMS IAM endpoints (SOFTWARE-4666)


author: Brian Lin <blin@cs.wisc.edu> - 114-1
changelog:
  - Fix typo in CLAS12 and EIC VOMS certificate issuers (SOFTWARE-4701)
  - Add LSC files for CERN VO IAM endpoints (SOFTWARE-4595, SOFTWARE-4576, SOFTWARE-4695)


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.5-1
changelog:
  - Fixed two performance problems on Windows
  - Fixed Java universe on Debian and Ubuntu systems
  - Added two knobs to improve performance on large scale pools
  - Fixed a bug where requesting zero GPUs would require a machine with GPUs
  - HTCondor can now recognize nVidia Volta and Turing GPUs


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.6-1
changelog:
  - Initial support for CentOS 8
  - Fixed a memory leak in SSL authentication
  - Fixed a bug where "condor_submit -spool" would only submit the first job
  - Reduced encrypted file transfer CPU usage by a factor of six
  - "condor_config_val -summary" displays changes from a default configuration
  - Improved the ClassAd documentation, added many functions that were omitted


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.4-5
changelog:
  - Remove edg-mkgridmap requirement; add osg-configure-misc and
    vo-client-lcmaps-voms (SOFTWARE-3138)


author: Carl Edquist <edquist@cs.wisc.edu> - 3.4-6
changelog:
  - Move lcmaps-voms & osg-configure deps to osg-gridftp-hdfs (SOFTWARE-3177)
  - Drop redundant deps from osg-se-hadoop-gridftp (SOFTWARE-3177)


author: Dave Dykstra <dwd@fnal.gov> 4.6-2.1
changelog:
  - Upgrade to 4.6-2 tarball with the following release notes:
   - Add support for sending access_log through syslog
   - Add additional allowed monitoring host CERN IP range of 188.185.48.0/20


author: Dave Dykstra <dwd@fnal.gov> 4.4-2.1
changelog:
  - Upgrade the 4.4-1.1 version to the 4.4-2 tarball with the following
     release note:
   - Apply security patch for CVE-2019-12527
        http://www.squid-cache.org/Advisories/SQUID-2019_5.txt
      which can (before being patched) be exploited through the ftp protocol.


author: Dave Dykstra <dwd@fnal.gov> 4.8-1.1
changelog:
  - Upgrade to 4.8-1 tarball with the following release notes:
   - Update to squid-4.8 with release notes at
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00096.html
     There was no 4.7 announcement but here's the ChangeLog:
      https://github.com/squid-cache/squid/blob/f977bfa698ab92e9474c775cef0e01fb756a4b0f/ChangeLog


author: Dave Dykstra <dwd@fnal.gov> 4.8-2.1
changelog:
  - Upgrade to 4.8-2 tarball with the following release note:
   - Add support for starting and stopping shoal-agent when installed and
     enabled by SQUID_AUTO_DISCOVER=true
  - Add compilation and installation for shoal-agent


author: Dave Dykstra <dwd@fnal.gov> 4.9-1.1
changelog:
  - Upgrade to 4.9-1 tarball with the following release notes:
   - Update to squid-4.9 with release notes at
      http://squid-web-proxy-cache.1019090.n4.nabble.com/squid-announce-Squid-4-9-is-available-td4688506.html
   - Add cvmfs01.nikhef.nl, cvmfs-stratum-one.zeuthen.desy.de, and
      grid-cvmfs-one.desy.de to the MAJOR_CVMFS acl.


author: Dave Dykstra <dwd@fnal.gov> 4.9-2.1
changelog:
  - Upgrade to 4.9-2 tarball with the following release note:
   - Fix bug in daily cron that prevented it from rotating any logs


author: Dave Dykstra <dwd@fnal.gov> 4.9-3.1
changelog:
  - Upgrade to 4.9-3 tarball with the following release notes:
   - Apply a patch for bug #4735, to prevent caching an object when its
      http/1.1 last chunk (that is, zero-length chunk) is missing.
   - Disable the URN proto by default, to avoid potential future security
      vulnerabilities.
   - Fail if the hard nofile ulimit for the squid user is less than 4096
      (which is unlikely since it is the default value on RHEL6 & 7) and
      increase the soft nofile ulimit to match the hard limit.  Squid
      uses the soft limit as the default max_filedescriptors.  Previously
      the root portion of the startup script attempted to increase the
      soft limit to 4096, but it turned out to have no effect because
      runuser resets it to its default for that user.


author: Dave Dykstra <dwd@fnal.gov> 4.9-4.1
changelog:
  - Upgrade to 4.9-4 tarball with the following release note:
   - Limit the hard nofile ulimit check to the "start" operation.


author: Dave Dykstra <dwd@fnal.gov> 4.9-5.1
changelog:
  - Upgrade to 4.9-4 tarball with the following release note:
   - Change compressing log rotation to not use logrotate's copytruncate.
      Instead, use create and a postrotate that sends squid a reconfigure
      signal.  This is needed when using rsyslog's imfile module to copy
      to syslog, but also greatly speeds up rotation when log files are
      large.


author: Dave Dykstra <dwd@fnal.gov> 4.10-1.1
changelog:
  - Upgrade to 4.10-1 tarball with the following release notes:
   - Update to squid-4.10, with release notes at
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00103.html
     including a fix for a serious security vulnerability affecting
     reverse proxies and a potential information leak when proxying ftp.
   - Remove patch for bug #4735, as it has been included in the 4.10 release.
   - Change compressing log rotation back to use copytruncate when there
     are multiple workers, because the reconfigure signal triggers an
     SNMP bug when there are multiple workers (squid bug #5022).
   - Disable log rotatation when SQUID_MAX_ACCESS_LOG=0.  Using this is
      highly discouraged since standard logrotate is usually unable to
      keep up with the high volume of logs typically generated by squid.
      It also interferes with frontier-awstats support.
   - Change log rotating cron scripts to ignore commented lines in
      /etc/sysconfig/frontier-squid


author: Brian Lin <blin@cs.wisc.edu> - 4.3.0-1
changelog:
  - Add the CE registry web application to the central collector. The
    registry provides an interface to OSG site administrators of
    HTCondor-CEs to retrieve an HTCondor IDTOKEN for authenticating
    pilot job submissions (#298, #299)
  - Identify broken job routes upon startup (#319)
  - Add benchmarking parameters to the BDII provider via HTCONDORCE_SPEC
    in the configuration. See /etc/condor-ce/config.d/99-ce-bdii.conf
    for examples (#311)
  - Fix handling of unmapped GSI users in the central collector (#317)
  - Fix reference to old BDII configuration values (#322)


author: Brian Lin <blin@cs.wisc.edu> - 4.4.0-1
changelog:
  - Add plug-in interface to HTCondor-CE View and separate out
    OSG-specific code and configuration (SOFTWARE-3963)
  - Add configuration option (COMPLETED_JOB_EXPIRATION) for how many
    days completed jobs may stay in the queue (SOFTWARE-4108)

  - Replace APEL uploader SchedD cron with init and systemd services
    (#323)
  - Fix HTCondor-CE View SchedD query that caused "Info" tables to be blank


author: Brian Lin <blin@cs.wisc.edu> - 4.4.1-1
changelog:
  - Fix a stacktrace with the BDII provider when `HTCONDORCE_SPEC` isn't
    defined in the local HTCondor configuration
  - Fixed a race condition that could result in removed jobs being put
    on hold
  - Improve performance of the HTCondor-CE View


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 4.4.1-2
changelog:
  - Change voms-clients-cpp requirement to voms-clients for non-OSG builds,
    because voms-clients-java works equally well


author: Brian Lin <blin@cs.wisc.edu> - 4.4.1-3
changelog:
  - Fix blahp requirements for HTCondor 8.9.9 (HTCONDOR-84)
  - Remove OSG grid-certificates requirement duplicated by downstream
    requirements in the osg-ce metapackage


author: Brian Lin <blin@cs.wisc.edu> - 4.5.0-1
changelog:
  - Whole node jobs (HTCondor batch systems only) now make use of GPUs (HTCONDOR-103)
  - Added `USE_CE_HOME_DIR` configuration variable (default: `True`) to allow users to disable setting `$HOME` in the
    routed job's environment based on the HTCondor-CE user's home directory
  - HTCondor-CE Central Collectors now prefer GSI over SSL authentication (HTCONDOR-237)
  - HTCondor-CE registry now validates the value of submitted client codes (HTCONDOR-241)
  - Automatically remove CE jobs that exceed their `maxWalltime` (if defined) or the configuration value of
    `ROUTED_JOB_MAX_TIME` (default: 4320 sec/72 hrs)
  - Remove circular HTCondor-CE View configuration definition (HTCONDOR-161)
  - Replace htcondor-ce package requirement with python2-condor for htcondor-ce-bdii


author: Brian Lin <blin@cs.wisc.edu> - 4.5.0-2
changelog:
  - Fix an issue with an overly aggressive default SYSTEM_PERIODIC_REMOVE (HTCONDOR-350)
  - Use the GlobalJobID attribute as the APEL record lrmsID (#426)


author: Brian Lin <blin@cs.wisc.edu> - 4.5.2-1
changelog:
  - Use the `GlobalJobID` attribute as the APEL record `lrmsID` (#426)
  - Fix an issue with an overly aggressive default `SYSTEM_PERIODIC_REMOVE` (HTCONDOR-350)
  - Fix faulty validation of `JOB_ROUTER_ROUTE_NAMES` and `JOB_ROUTER_ENTRIES` in the startup script (HTCONDOR-406)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.22.0-1
changelog:
  - Initial release of osg-container-pilot probe (SOFTWARE-4169)
  - More el8 / python3 build fixes (SOFTWARE-4348)
  - Fix bug in cmd.communicate() handling of stderr (SOFTWARE-4348)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.22.1-1
changelog:
  - Add multi-site handling for osg-pilot-container probe (SOFTWARE-4386)
  - More python3 packaging fixes for el8 (SOFTWARE-4398)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.22.2-1
changelog:
  - Fix duration formatting in xml for python3 (SOFTWARE-4416)
  - Report partial jobs for osg pilot container probe (SOFTWARE-4404)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.23.1-1
changelog:
  - Add python2/3 compat for sge probe (SOFTWARE-4286)
  - Add 'QueueTime' collection (SOFTWARE-4479)
  - Add 'GratiaVersion' to UsageRecords (SOFTWARE-4455)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.23.2-1
changelog:
  - Fix attribute list handling for QueueTime (#94) (SOFTWARE-4521)
  - Fix python3 int division in niceNum (#92)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.24.0-1
changelog:
  - Get VO info from AuthToken (SciToken) attrs (SOFTWARE-4615)
  - Lock Version-Release across sub-packages (SOFTWARE-4667)
  - Move 99_gratia-ce.conf to /usr/share location (SOFTWARE-4611)
  - Fix exception handling in condor_meter (SOFTWARE-4711)


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.3-1
changelog:
  - Fixed a bug where jobs were killed instead of peacefully shutting down
  - Fixed a bug where a restarted schedd wouldn't connect to its running jobs
  - Improved file transfer performance when sending multiple files
  - Fix a bug that prevented interactive submit from working with Singularity
  - Orphaned Docker containers are now cleaned up on execute nodes
  - Restored a deprecated Python interface that is used to read the event log


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.4-1
changelog:
  - Python 3 bindings - see version history for details (requires EPEL on EL7)
  - Can configure DAGMan to dramatically reduce memory usage on some DAGs
  - Improved scalability when using the python bindings to qedit jobs
  - Fixed infrequent schedd crashes when removing scheduler universe jobs
  - The condor_master creates run and lock directories when systemd doesn't
  - The condor daemon obituary email now contains the last 200 lines of log


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 8.8.4-1.8
changelog:
  - Add DAEMON_LIST and FS/Password auth configuration;
    autogenerate pool password on install (SOFTWARE-3795)
  - Add version to the Obsoletes for condor-cream-gahp


author: Carl Edquist <edquist@cs.wisc.edu> - 1.20.0-1
changelog:
  - Drop glexec probe & old GRAM code (SOFTWARE-3105)
  - Fix handling of SlurmLocation in slurm probe (SOFTWARE-2795)
  - Make ProjectName case insensitive in condor probe (SOFTWARE-3017)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.4-1
changelog:
  - Add --dry-run option to update-all-remote-wn-clients script
  - Allow more characters in endpoint names in endpoints.ini


author: Carl Edquist <edquist@cs.wisc.edu> - 1.20.13-1
changelog:
  - Fix bug for slurm version < 18 (SOFTWARE-4055)
  - Fix handling of non-word characters in slurm cluster name (SOFTWARE-4032)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.20.14-1
changelog:
  - Fix unquoted cluster names in slurm probe sql (SOFTWARE-4189)
  - Detect condor vs htcondor-ce probe config (SOFTWARE-4195)


author: Tim Theisen <tim@cs.wisc.edu> - 8.7.9-1
changelog:
  - Support for Debian 9, Ubuntu 16, and Ubuntu 18
  - Improved Python bindings to support the full range of submit functionality
  - Allows VMs to shutdown when the job is being gracefully evicted
  - Can now specify a host name alias (CNAME) for NETWORK_HOSTNAME
  - Added the ability to run a job immediately by replacing a running job


author: Tim Theisen <tim@cs.wisc.edu> - 8.6.13-1
changelog:
  - Made the Python 'in' operator case-insensitive for ClassAd attributes
  - Python bindings are now built for the Debian and Ubuntu platforms
  - Fixed a memory leak in the Python bindings
  - Fixed a bug where absolute paths failed for output/error files on Windows
  - Fixed a bug using Condor-C to run Condor-C jobs
  - Fixed a bug where Singularity could not be used if Docker was not present


author: Tim Theisen <tim@cs.wisc.edu> - 8.7.10-1
changelog:
  - Can now interactively submit Docker jobs
  - The administrator can now add arguments to the Singularity command line
  - The MUNGE security method is now supported on all Linux platforms
  - The grid universe can create and manage VM instances in Microsoft Azure
  - Added a single-node package to facilitate using a personal HTCondor


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.0-1
changelog:
  - Automatically add AWS resources to your pool using HTCondor Annex
  - The Python bindings now include submit functionality
  - Added the ability to run a job immediately by replacing a running job
  - A new minicondor package makes single node installations easy
  - HTCondor now tracks and reports GPU utilization
  - Several performance enhancements in the collector
  - The grid universe can create and manage VM instances in Microsoft Azure
  - The MUNGE security method is now supported on all Linux platforms


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.1-1
changelog:
  - Fixed excessive CPU consumption with GPU monitoring
  - GPU monitoring is off by default; enable with "use feature: GPUsMonitor"
  - HTCondor now works with the new CUDA version 10 libraries
  - Fixed a bug where sometimes jobs would not start on a Windows execute node
  - Fixed a bug that could cause DAGman to go into an infinite loop on exit
  - The JobRouter doesn't forward the USER attribute between two UID Domains
  - Made Collector.locateAll() more efficient in the Python bindings
  - Improved efficiency of the negotiation code in the condor_schedd


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.2-1
changelog:
  - Fixed problems with condor_ssh_to_job and Singularity jobs
  - Fixed a problem that could cause condor_annex to crash
  - Fixed a problem where the job queue would very rarely be corrupted
  - condor_userprio can report concurrency limits again
  - Fixed the GPU discovery and monitoring code to map GPUs in the same way
  - Made the CHIRP_DELAYED_UPDATE_PREFIX configuration knob work again
  - Fixed restarting HTCondor from the Service Control Manager on Windows
  - Fixed a problem where local universe jobs could not use condor_submit
  - Restored a deprecated Python interface that is used to read the event log
  - Fixed a problem where condor_shadow reuse could confuse DAGMan


author: Marco Mambelli <marcom@fnal.gov> - 3.5
changelog:
  - GlideinWMS v3.5
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_5/history.html
  - Release candidates: 3.5-0.1.rc1 to 3.5-0.1.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.4.6-1
changelog:
  - GlideinWMS v3.4.6
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_4_6/history.html
  - Release candidates: 3.4.6-0.1.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.5.1-1
changelog:
  - GlideinWMS v3.5.1
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_5_1/history.html
  - Release candidates: 3.5.1-0.1.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.6-1
changelog:
  - GlideinWMS v3.6
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_6/history.html
  - This is a rename of 3.5.1, to respect the odd-even numbering


author: Marco Mambelli <marcom@fnal.gov> - 3.6.1-1
changelog:
  - GlideinWMS v3.6.1
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_6_1/history.html
  - Release candidates: 3.6.1-0.1.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.6.2-1
changelog:
  - GlideinWMS v3.6.2
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_6_2/history.html
  - Release candidates: 3.6.2-0.0.rc0 to 3.6.2-0.3.rc3


author: Marco Mambelli <marcom@fnal.gov> - 3.6.3-1
changelog:
  - GlideinWMS v3.6.3
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_6_3/history.html
  - Release candidates: 3.6.3-0.1.rc1 to 3.6.3-0.3.rc3


author: Marco Mambelli <marcom@fnal.gov> - 3.6.4-1
changelog:
  - GlideinWMS v3.6.4
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_6_4/history.html
  - Release candidates: 3.6.4-0.1.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.6.5-1
changelog:
  - GlideinWMS v3.6.5
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_6_5/history.html
  - Release candidates: 3.6.5-0.1.rc1


author: Carl Edquist <edquist@cs.wisc.edu> - 0.2-1
changelog:
  - Address code review comments (SOFTWARE-4719)
    - Improve config validation & error messages
    - Improve error handling; continue on errors
    - Increase the systemd timer frequency
  - Add README leftovers from usage doc (SOFTWARE-4763)


author: Marco Mambelli <marcom@fnal.gov> - 3.4.3-1
changelog:
  - GlideinWMS v3.4.3
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_4_3/history.html
  - Release candidates: 3.4.3-0.1.rc1 to 3.4.3-0.2.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.4.4-1
changelog:
  - GlideinWMS v3.4.4
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_4_4/history.html
  - Release candidates: 3.4.4-0.1.rc1 to 3.4.4-0.4.rc4


author: Marco Mambelli <marcom@fnal.gov> - 3.4.5-1
changelog:
  - GlideinWMS v3.4.5
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_4_5/history.html
  - Release candidates: 3.4.5-0.1.rc1


author: Brian Lin <blin@cs.wisc.edu> - 3.5-1
changelog:
  - Add packaging for OSG XRootD standalone installations
  - Unify Stash Origin HTTP/S and XRootD ports (SOFTWARE-3558)


author: Brian Lin <blin@cs.wisc.edu> - 3.5-2
changelog:
  - Opt into default configuration provided by xrootd-lcmaps-1.7.4 (SOFTWARE-3534)
  - Remove osg-configure and redundant dependencies


author: Brian Lin <blin@cs.wisc.edu> - 3.5-3
changelog:
  - Restore osg-configure requirement for standalone installations
    since they'll be using /etc/lcmaps.db instead of the LCMAPS configuration
    shipped with xrootd-lcmaps
  - Ensure that XRootd/HTTP ports are the same


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.1-1
changelog:
  - Use --location argument to specify destination; use /etc or $OSG_LOCATION/etc if not specified (SOFTWARE-2527)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.3.0-1
changelog:
  - Add osg-release requirement
  - Allow taking osg repo definition from osg-release installed in a tarball client (SOFTWARE-2527)


author: Brian Bockelman <brian.bockelman@cern.ch> - 2.1.4-1
changelog:
  - Recompute checksum on parse failure.
  - Force flush before close to hew closer to open-to-close semantics.


author: Diego Davila <didavila@ucsd.edu> - 2.1.5-1
changelog:
  - Adding directory config.d and file config.d/40-xrootd-hdfs.cfg (SOFTWARE-3535)
  - Changing xrootd requirement to 4.9.0


author: Zalak Shah <zsshah@iu.edu> 1.94-3
changelog:
  - Fix version number in changelog and HTML
  - Verify SHA2 checksums
  - Update the package summary and description


author: Matyas Selmeci <matyas@cs.wisc.edu> - 2.0.0+1612-1.cdh4.7.1.p0.12.6
changelog:
  - Add 2588-out-of-quota-msg.patch to fix error message when diskspace quota is exceeded (SOFTWARE-2588)
  - Fix SELinux build error on EL7 due to excessive pickiness about .te file names


author: Dave Dykstra <dwd@fnal.gov> - 1.0-1
changelog:
  - Use the same root / $CWD as the target process.  Without this, the
    authz process may utilize the incorrect file for target processes
    that are in a chroot or provide a relative path for the X509 proxy.


author: Dave Dykstra <dwd@fnal.gov> - 2.2-1
changelog:
  - Prevent exiting after the first token authentication
  - Close token file descriptor after use
  - Enable token debug messages
  - Implement WLCG bearer token discovery standard
  - Add libscitokens-dev build dependency on debian


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.14-1
changelog:
  - Fix for security issue
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0003.html


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.16-1
changelog:
  - Fix for security issue
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0003.html


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.0.2-1
changelog:
  - Add missing xrootd-lcmaps dependency for the origin
  - Start and stop xrootd and cmsd together for the origin (SOFTWARE-3544)
  - Drop workaround for LIGO not being part of the OSG Data Federation (SOFTWARE-3507)
  - Start proxy renewal script for both unauth and auth cache and origin instances;
    only mandatory for auth cache
  - Fix permissions in tmpfiles.d config for cache
  - Add vo-client and voms-clients-cpp dependency
  - Proxy renewal script now uses voms-proxy-init instead of grid-proxy-init
  - "sitename" xrootd config variable in 10-common-site-local.cfg renamed to "resourcename"


author: Edgar Fajardo <emfajard@ucsd.edu> - 1.1.0-0.3
changelog:
  - Adding ATLAS and CMS overides for the proxy generation
  - Adding RucioN2N config for ATLAS Xcache (SOFTWARE-3784)


author: Edgar Fajardo <emfajard@ucsd.edu> - 1.1.0-0.4
changelog:
  - Changing order of LCMAPS configuration files for CMS
  - Fixing bug on refresh-proxy call for CMS and ATLAS proxies


author: Mischa Salle <msalle@nikhef.nl> 1.5.1-2
changelog:
  - Add minimal lcmaps version.
  - Remove configure flag for moduledir.

  - Added plugin lcmaps_ban_dn including manpage.
  - Update URL.
  - Add run-time requirement for lcmaps for basic package.
  - Add architecture to run-time requirement for ldap subpackage.
  - Updated version


author: Mischa Salle <msalle@nikhef.nl> 1.6.2-1
changelog:
  - update builddep on lcmaps-devel instead of -interface
  - prevent unnecessary linking
  - specify BuildRoot (and clean section) for EPEL5
  - remove defattr
  - updated version


author: Mischa Salle <msalle@nikhef.nl> 1.6.2-2
changelog:
  - clean up installed documentation files (breaks Fedora20)
  - correct bogus dates in changelog (breaks Fedora20)
  - correct duplicate entry in filelist


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 12.7-1
changelog:
  - GT6 update:
    - Force IPC encryption if server configuration requires
    - Fix old IPC bug making it hard to diagnose racy connection failures


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 12.12-1
changelog:
  - GT6 update:
    - Use 2048 bit keys to support openssl 1.1.1 (12.10)
    - Log remote http connection address for legacy s3 transfers (12.11/12.12)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 13.8-1
changelog:
  - Switch upstream to Grid Community Toolkit
  - Grid Community Toolkit merged a number of outstanding pull requests (13.0)
    - Add option to send IPv6 address in EPSV response
    - Add function to get the command string
    - Be more selective in what config files we skip
    - Add unames for GNU/Hurd and kfreebsd to chroot setup script
  - Merge GT6 update 12.5 into GCT (13.1)
  - First Grid Community Toolkit release (13.2)
    - Disable usage statistics reporting by default
    - Add man page for globus-gridftp-password - contribution from IGE
  - Use 2048 bit RSA key for tests (13.3)
  - Merge GT6 update 12.6 into GCT (13.4)
  - Merge GT6 update 12.7 into GCT (13.5)
  - Merge GT6 update 12.8 into GCT (13.6)
  - Merge GT6 update 12.9 into GCT (13.7)
  - Merge GT6 update 12.12 into GCT (13.8)
  - Drop patches globus-gridftp-server-unames.patch, -epsv-ip.patch,
    -cmd-string.patch and -config.patch (accepted upstream)
  - Drop the man page for globus-gridftp-password from the source package
    (accepted upstream)


author: Brian Lin <blin@cs.wisc.edu> - 4.4.0-1
changelog:
  - Add plug-in interface to HTCondor-CE View and separate out
    OSG-specific code and configuration (SOFTWARE-3963)
  - Add configuration option (COMPLETED_JOB_EXPIRATION) for how many days (SOFTWARE-4108)
  - Replace APEL uploader SchedD cron with init and systemd services
    (#323)
  - Fix HTCondor-CE View SchedD query that caused "Info" tables to be blank


author: Dave Dykstra <dwd@fnal.gov> 1.7.1-1
changelog:
  - Update to upstream 1.7.1.  Add patch for el7 to allow go 1.15.5.
  - Stop disabling vault service on upgrade.


author: Tim Theisen <tim@cs.wisc.edu> - 1.104-1
changelog:
  - Update to IGTF 1.114 (SOFTWARE-4965)
  - SOFTWARE-4965: Remove expired Let's Encrypt ROOT CA X3
  - SOFTWARE-4965: Remove expired Let's Encrypt ROOT CA X4


author: Carl Edquist <edquist@cs.wisc.edu> - 3.5-3
changelog:
  - Add schedd cron config for gratia probe (SOFTWARE-3841)
  - Drop ansible requirement (SOFTWARE-3920)


author: Carl Edquist <edquist@cs.wisc.edu> - 3.5-5
changelog:
  - Add SCHEDD_CRON_GRATIA_ARGS to 51-gratia.conf (SOFTWARE-3973)
  - Move 51-gratia.conf to bosco subpackage


author: Carl Edquist <edquist@cs.wisc.edu> - 100-1
changelog:
  - Drop MIS VO (SOFTWARE-3575)
  - Map FNAL VO subgroups to the VO-wide target (SOFTWARE-4005)
  - New cert for GLOW (SOFTWARE-4006)
  - Replace one of the certs for OSG (SOFTWARE-4007)
  - Update Gluex cert for gryphn.phys.uconn.edu (SOFTWARE-4008)
  - Update voms2.fnal.gov DN for DES, DUNE, Fermilab (SOFTWARE-4012)
  - Drop CDF (SOFTWARE-4012)
  - Crosscheck script improvements


author: Carl Edquist <edquist@cs.wisc.edu> - 101-1
changelog:
  - Second round of InCommon subject DN changes (SOFTWARE-4018)
  - Add new GlueX DN (SOFTWARE-4008)
  - Drop obsolete GLOW cert
  - Update LZ DN for voms.hep.wisc.edu (SOFTWARE-4021)
  - Retire DOSAR (SOFTWARE-4019)


author: Zalak Shah <zsshah@iu.edu> 1.76-3
changelog:
  - CA release corresponding to IGTF 1.94 release.
  - Renamed 1.77NEW to 1.76NEW_2 and 1.77IGTFNEW to 1.76IGTFNEW_2


author: Carl Edquist <edquist@cs.wisc.edu> - 88-1
changelog:
  - Update DNs for OSG (SOFTWARE-3647)
  - Add gluex.phys.uconn.edu VOMS server (SOFTWARE-3656)
  - Update cert for voms1.fnal.gov (SOFTWARE-3634)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.6-1
changelog:
  - Have update-all-remote-wn-ce run updaters with a timeout (SOFTWARE-4081)
  - If one update fails, keep going with the other updates instead of bailing out


author: Dave Dykstra <dwd@fnal.gov> 1.1-1
changelog:
  - Integrate with htcondor, including these changes:
   - Change --authpath option name to --oidcpath.
   - Add --noidc option.
   - Add --vaulttokenttl option.
   - Make --vaulttokenfile default to /dev/stdout if the ttl is more than
      a million seconds, and also require it to start with /dev/std or
      /dev/fd if the ttl is more than a million seconds.
   - Add --vaulttokeninfile option.
   - Add --nobearertoken option.
   - Add --showbearerurl option.
   - Send progress output to stderr if --vaulttokenfile is /dev/stdout or
       --showbearerurl option is enabled.
  - Use a separate version number for the python library downloads tarball.


author: Dave Dykstra <dwd@fnal.gov> 1.2-1
changelog:
  - Fix working with a kerberos domain that is missing from krb5.conf
  - Extract more formatted information from http exceptions
  - Improve format of printed kerberos exceptions


author: Dave Dykstra <dwd@fnal.gov> 1.3-1
changelog:
  - Add --kerbprincipal option
  - Change the default kerbpath to include issuer and role
  - Limit oidc polling to 2 minutes
  - Disable oidc authentication when running in the background, that is, when
      none of stdin, stdout, or stderr are on a tty
  - Document that audience can be a comma or space separated list
  - Updated pip-installed dependent packages to latest versions


author: Dave Dykstra <dwd@fnal.gov> 1.4-1
changelog:
  - Add --vaulttokenminttl option
  - Add --web-open-command option, and default it to xdg-open only when
    $SSH_CLIENT is not set
  - Send the extra 'server' parameter recognized by htvault-config >= 1.5
    when --secretpath=secret/oauth/creds/%issuer/%credkey:%role, to use
    shared vault secrets instance (will be default later)
  - Use the new pyinstaller 4.5 exclude_system_libraries() function instead
    of the previous hack to exclude system libraries from being bundled


author: Dave Dykstra <dwd@fnal.gov> 1.6-1
changelog:
  - Try a default cafile of '/etc/pki/tls/cert.pem' if system default is empty.
    This can happen when the SSL_CERT_FILE environment variable is empty.


author: Dave Dykstra <dwd@fnal.gov> 1.7-1
changelog:
  - Start using new vault secrets plugin feature that allows it to be shared
     between all issuers.  Requires htvault-config >= 1.5.
  - Expand the --vaultalias option to also additionally allow that name
  -  in vault's host certificate.
  - Support finding python3 from PATH and not only /usr/bin
  - Support python38
  - Add httokendecode -H option
  - Fix bug that caused traceback when handling an error writing the credkey
  - Update python dependencies to current versions in pip


author: Dave Dykstra <dwd@fnal.gov> 1.8-1
changelog:
  - If kerberos initialization fails with the default KRB5_CONFIG="", try
      again without it.  Observed to be needed at CNAF, although not for
      FNAL, CERN, or LIGO.  Don't do second try if the first error was due
      to an expired ticket, because that sometimes erroneously succeeds on
      second try.


author: Diego Davila <didavila@ucsd.edu> - 7.0.21-1
changelog:
  - Update to 7.0.21 (SOFTWARE-3883)
  - Changed the -n argument on prep section to match to the untared directory name


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.11.0-1
changelog:
  - Add Pilot entries (SOFTWARE-4177)
  - Don't try to resolve Squid on the CE (SOFTWARE-4362)
  - Ignore all fetch-crl errors, but warn if no CRLs exist (SOFTWARE-4364)


author: Matyas Selmeci <matyas@cs.wisc.edu> 1.3.0-1
changelog:
  - Add SELinux audit logs to osg-system-profiler and URL support to
    osg-system-profiler-viewer (SOFTWARE-2275)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.4.0-1
changelog:
  - Include dump of tomcat server config (SOFTWARE-1099)
  - Create osg-profile.txt in temp dir, do not include old profiles in
    directory dumps (SOFTWARE-1773)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.1-1
changelog:
  - Drop osg-version check (SOFTWARE-2916)
  - Update instructions for getting help (SOFTWARE-2908)
  - Don't include logs for deprecated software (SOFTWARE-2905)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.3-1
changelog:
  - Drop unused files:
      - httpcert.pem
      - tomcat config
      - edg-mkgridmap.log
      - bestman2 logs


author: Dave Dykstra <dwd@fnal.gov> - 3.1.1-1
changelog:
  - Rename request.py to cert_request.py
  - Move common crypto code to cert_utils.py
  - Change permissions on generated keys to 644
  - Make -k and -c required in osg-incommon-cert-request, with no default
  - Expand tildes in --cert= and --key= osg-incommon-cert-request options
  - Immediately fail osg-incommon-cert-request if InCommon authentication fails


author: Jeny Teheran <jteheran@fnal.gov> - 3.2.0
changelog:
  - Change -f/--hostfile to -F/--hostfile
  - Change -T/--test to -t/--test
  - Switch argparsing to ArgumentParser
  - Validate if filepath exists and can be read at the ArgumentParser
  - Stop wrapping text messages
  - Include the program name in error messages
  - Show message per certificate when request or retrieval fails
  - Increased the number of retries for certificate retrieval


author: Jeny Teheran <jteheran@fnal.gov> - 3.2.1
changelog:
  - Add man page for osg-incommon-cert-request
  - Add .html version of man page for osg-incommon-cert-request


author: Jeny Teheran <jteheran@fnal.gov> - 3.2.2
changelog:
  - Fix format error for message when retrieval times out
  - Increased the wait time between retrieval attempts
  - Improve formatting of osg-incommon-cert-request man page


author: Dave Dykstra <dwd@fnal.gov> - 3.3.0
changelog:
  - Bump to new middle version number because of the new -O/--orgid option.
  - Slightly reorganize the man page documentation of the new option.


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 13.11-1
changelog:
  - Improvements for filesystems that encounter listing timeouts (13.10)
  - Remove usage statistics collection support (13.11)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 13.20-1
changelog:
  - Fake stat responses when slow listings enabled (13.12)
  - Send markers in stream mode when requested by 'OPTS RETR Markers=n;'
    (13.13)
  - Update documentation links to always point to the latest documentation
    (13.14)
  - Fix doxygen warning (13.15)
  - Remove obsolete acconfig.h file (13.16)
  - Add simple checksum read throttling (13.17)
  - Add support for supported checksum advertising (13.18)
  - Add support for SHA1, SHA256, SHA512 to POSIX DSI (13.18)
  - Avoid unknown secondary groups in test. Causes failures on launchpad
    (13.19)
  - Fix problems between dual-stack (IPv4/IPv6) servers and IPv4-only clients
    (13.20)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 13.20-1.1.osg
changelog:
  - Add patch for gridcf/gct#117 "Restore log transfer functionality that was accidentally removed" (SOFTWARE-4041)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 2.0.14-1.6
changelog:
  - Also accept VOMS attributes that only have a top-level group (SOFTWARE-4114)
    - Drop Validate-top-level-group-of-VOMS-attribute.patch
    - Add Validate-top-level-group-of-VOMS-attribute-also-acce.patch


author: Brian Bockelman <bbockelm@cse.unl.edu> - 0.5.0-1
changelog:
  - Add support for multiple base paths of an issuer.
  - Add concept of restricting authorized paths within an issuer's namespace.
  - Fix potential segfault when a user environment isnt available.


author: Marco Mambelli <marcom@fnal.gov> - 3.4.2-1
changelog:
  - Controlling that Frontend is not using options incompatible w/ linked Factories
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_4_2/history.html


author: Diego Davila <didavila@ucsd.edu> - 1.7.1-1
changelog:
  - Adding directory config.d and file config.d/40-xrootd-lcmaps.cfg (SOFTWARE-3534)
  - Changing xrootd requirement to 4.9.0


author: Brian Lin <blin@cs.wisc.edu> - 1.7.3-1
changelog:
  - Add support for unauthenticated Stash Caches and Origins
  - Fix authzfunparms syntax
  - Use the canonical LCMAPS config location in the default config


author: Dave Dykstra <dwd@fnal.gov> - 1.3-1
changelog:
  - Add CVMFS_CONFIG_REPO_REQUIRED=yes.  Change Conflicts on cvmfs to be less
    than version 2.3.3 because the option was added then.


author: Dave Dykstra <dwd@fnal.gov> - 2.1-1
changelog:
  - Merge LIGO changes to debian packaging
  - Move packaging/debian to debian and packaging/redhat to rpm, to work
    better with OBS and new OSG github packaging standard


author: Dave Dykstra <dwd@fnal.gov> - 2.2-1
changelog:
  - Just change the version number because the OSG github-source for
    reading spec files doesn't work with dash release tags.


author: Dave Dykstra <dwd@fnal.gov> - 2.3-1
changelog:
  - Change the changelog date on version 2.0.3 from Feb 28 2017 to
    May 28 2017 because osg-build complained about non-descending order
    of the dates.
  - Change the rpm/rpmbuild-cvmfs-config-osg development test script 
    to read from rpm instead of packaging/redhat.


author: Dave Dykstra <dwd@fnal.gov> - 2.4-1
changelog:
  - Change the server urls for the config-osg repository to use openhtc.io
    aliases when the proxy url can use DIRECT.


author: Dave Dykstra <dwd@fnal.gov> - 2.4-4
changelog:
  - Skipped release 2.4-2 and 2.4-3 to make consistent with cvmfs-config-egi.
  - Change Conflicts: cvmfs-config-default to Obsoletes: to make it
    easier to replace. Add Conflicts: cvmfs-config-egi because it
    is mutually exclusive.


author: Brian Lin <blin@cs.wisc.edu> 1.1.6-1
changelog:
  - Change software.grid.iu.edu to repo.grid.iu.edu in osg-ca-scripts (SOFTWARE-2666)
  - Remove unsupported compat links for old OpenSSL hashes
  - Added `ITB` options back to help text


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.3.0-3
changelog:
  - Add Force-aud-test-in-the-validator.patch from
    https://github.com/scitokens/scitokens-cpp/pull/8


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.0.1-1
changelog:
  - Config changes:
    - fix name of logging config and decrease verbosity
    - change default root dir from /stash to /mnt/stash
    - various other tweaks for understandability


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.1.31-1
changelog:
  - GT6 update: Use 2048 bit keys to support openssl 1.1.1
  - Drop patch myproxy-2048-bits.patch (accepted upstream)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.2.3-1
changelog:
  - Switch upstream to Grid Community Toolkit
  - First Grid Community Toolkit release (6.2.0)
    - Disable usage statistics reporting by default
    - Fix option parsing bug
  - Merge GT6 update 6.1.29 into GCT (6.2.1)
  - Use 2048 bit CA key for myproxy tests (6.2.2)
  - Merge GT6 update 6.1.30 into GCT (6.2.3)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 6.2.6-1
changelog:
  - Clean up old GPT references (6.2.5)
  - Install myproxy-get-trustroots man page (6.2.5)
  - Remove LICENSE.globus file - usage statistics collection (6.2.6)


author: Derek Weitzel <dweitzel@cse.unl.edu> - 1.2.0-1
changelog:
  - Add issuer for latter mapping decisions by issuer
  - Correct access control when allowing only reads


author: Diego Davila <didavila@ucsd.edu> - 1.2.1-1
changelog:
  - Adding XrootD major version to the shared file name
  - building against XrootD-4.12.2 (software-4093)


author: Mattias Ellert <mattias.ellert@fysast.uu.se> - 2.0.13-1
changelog:
  - Update to version 2.0.13
  - Drop patches: voms-nossl3.patch, voms-tls1.patch, voms-gcc6.patch,
    voms-paren.patch, voms-comment-in-comment.patch and voms-doxygen.patch


author: Dave Dykstra <dwd@fnal.gov> 1.8-1
changelog:
  - Allow a previous output file to have additional proxy layers added
    on to it when checking to see if it is still valid.  That is, strip
    off any number of /CN=[0-9]+ or /CN=proxy patterns appended to the
    certificate subject.  In particular this is useful for when someone
    does voms-proxy-init -noregen after a previous run of cigetcert.


author: Dave Dykstra <dwd@fnal.gov> 1.10-1
changelog:
  - Change default --minhours value from 12 to 1.
  - If the formula calculating the remaining hours in the myproxy cert
      (%hours - %proxyhours - %minhours) comes out to a value lower
      than %minhours, set it to %minhours


author: Dave Dykstra <dwd@fnal.gov> 1.11-1
changelog:
  - If the requested --hours is fractional, round the hours of the
    original certificate up to the next whole number rather than down.
    In this case generate a proxy with the requested fractional hours.


author: Dave Dykstra <dwd@fnal.gov> 1.13-1
changelog:
  - Choose a prefix for the temp output file in the same directory as the
    output file to avoid renaming across filesystems.


author: Dave Dykstra <dwd@fnal.gov> 1.14-1
changelog:
  - Limit the number of proxy levels stripped off of %certsubject to 5.
    This is to catch programming errors where people call voms-proxy-init
    -noregen after every call to cigetcert, even when cigetcert determines
    that the previous proxy can be reused.


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Fix bug that caused the proxy to be stored into MyProxy under the DN
    of a previous certificate (if it existed but could not be reused)
    rather than the newly generated one.


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Fix typo in the variable name added in the last version.  This was
    not noticed because it was caught in an exception and caused it to
    always behave as if a previous proxy stored in myproxy could not be
    used.


author: Dave Dykstra <dwd@fnal.gov> 4.10-2.1
changelog:
  - Upgrade to 4.10-2 tarball with the following release notes:
   - Apply patch for squid bug #5022, to prevent a reconfigure from crashing
      the coordinator process when there are multiple workers.
   - Use reconfigure signal for log rotation in all cases again.


author: Dave Dykstra <dwd@fnal.gov> 4.10-3.1
changelog:
  - Upgrade to 4.10-3 tarball with the following release notes:
   - Update patch for squid bug #5022 to final version.
   - Add patch for squid bug #5030 which reported that negative caching
      was not working.  This is an important feature for keeping load
      down on CVMFS stratum 1s that are not hosting a repository.


author: Dave Dykstra <dwd@fnal.gov> 4.10-4.1
changelog:
  - Upgrade to 4.10-4 tarball with the following release note:
   - Add patch for bug 5036 which caused a varying number of capital 'L's
      to appear at the beginning of access.log lines when the log buffer
      overflows.


author: Dave Dykstra <dwd@fnal.gov> 4.11-1.1
changelog:
  - Upgrade to 4.11-1 tarball with the following release notes:
   - Update to squid-4.11.  There's no announcement yet but the change log
      is at http://www.squid-cache.org/Versions/v4/changesets/.
   - Remove patches for bugs #5022 and #5036 which are in version 4.11. The
      patch for #5030 is still applied.


author: Dave Dykstra <dwd@fnal.gov> 4.11-2.1
changelog:
  - Upgrade to 4.11-2 tarball with the following release notes:
   - The 4.11 release announcement is now at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00108.html
      The announcement was delayed because security vulnerabilities were
      being double-checked.
   - frontier-squid was not susceptible to the ESI vulnerability, because of
      missing libraries on the build machine.  Add --disable-esi to make
      sure it doesn't get accidentally enabled.


author: Dave Dykstra <dwd@fnal.gov> 4.11-3.1
changelog:
  - Upgrade to 4.11-3 tarball with the following release notes:
   - Apply patch for bug #5051 which prevents a negative cache from
      persisting indefinitely with if-modified-since and collapsed forwarding.
   - Fix shoal when there are multiple squid workers.
   - Add cc.*\.in2p3\.fr to MAJOR_CVMFS.  It was already in ATLAS_FRONTIER
      so it was included for installations that accept both, but not for
      those that accept only MAJOR_CVMFS.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 4.2.3-1.1
changelog:
  - Update to 4.2.3-1 from upstream (SOFTWARE-4885)
  - Add Check-for-DT_REG-macro.patch to avoid compile error on EL7 due to missing DT_REG macro


author: Carl Edquist <edquist@cs.wisc.edu> - 1.18.42
changelog:
  - Move glite-build-common-cpp m4 files to vendor area (SOFTWARE-3587)
  - Pull rpm spec file into source repo


author: Carl Edquist <edquist@cs.wisc.edu> - 1.18.44
changelog:
  - Add Slurm SystemCpu accounting when job completes (SOFTWARE-3825)
  - Add support for decimal seconds fields from sacct (SOFTWARE-3826)
  - Pull in various updates to slurm scripts from htcondor's blap (SOFTWARE-3587)
  - Move local submit attributes scripts from spec to sources (SOFTWARE-3749)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.18.46
changelog:
  - Fix an issue where the slurm binpath always returned scontrol (SOFTWARE-3986)
  - Python 3 compatibility (#7)
  - Handle extra-quoted arguments to condor_submit.sh (SOFTWARE-3993)
  - Expand env vars in configured slurm_binpath (#10)
  - Fix cluster handling in slurm_status.py (#13)
  - Introduce blah_job_env_confs for dynamic env var expansion (SOFTWARE-2521)
  - Add EXIT trap to remove barrier file (SOFTWARE-3930)
  - Amended file credits for Matt Farrellee (#17)


author: Brian Lin <blin@cs.wisc.edu> - 1.18.48-1
changelog:
  - Add an option for HTCondor batch system to expand references to $HOME in the job environment (#23)
  - Add efficient querying of LSF job statuses (#14)
  - Improve logic when proxy refresh is disabled (#24)
  - Fix invalid argument, output, and error format for HTCondor job submission (#22)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 7.4p1-2.3
changelog:
  - systemctl daemon-reload in post scriptlet to fix failure when upgrading from an init-based version


author: Carl Edquist <edquist@cs.wisc.edu> - 87-1
changelog:
  - Add new hcc cert (SOFTWARE-3608)
  - Retire unused VOs: dzero, SBGrid, suragrid & dream (SOFTWARE-3617)
  - Update voms.hep.wisc.edu lz VO certificate (SOFTWARE-3635)
  - Update FNAL voms2 VO configuration (SOFTWARE-3633)


author: Diego Davila <didavila@ucsd.edu> - 3.5-3
changelog:
  - Changing "koji.chtc.wisc.edu" for "koji.opensciencegrid.org" (SOFTWARE-3863)
  - Fixing date issue on changelog Fri Feb 08 2018 -> Thu


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4-1
changelog:
  - Remove osg-release requirement; ignore missing compat packages; only try to
    update packages that are installed (SOFTWARE-2146)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6-1
changelog:
  - Replace references to OSG Twiki with links to current docs (SOFTWARE-3083)
  - Replace help email (SOFTWARE-3015)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 1.6.6-1.2.osg
changelog:
  - Add ban-mapfile, ban-voms-mapfile and updated lcmaps.db with a new
    authorize_only policy that uses the ban files, voms mapfiles, and a
    modified verify_proxy.  This adds new requirements on:
    - lcmaps-plugins-voms >= 1.7.1-1.1
    - lcmaps-plugins-verify-proxy >= 1.5.9-1.1
    (SOFTWARE-2602)


author: Brian Lin <blin@cs.wisc.edu> - 0.8.1-1
changelog:
  - Add the --pw-store option to the invocation of oidc-add and add a default
    scope of blank if no scopes are configured.  These are needed for the
    CILogon issuer (SOFTWARE-4983).


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.4-7
changelog:
  - Add mistakenly dropped gratia-probe-xrootd-transfer requirement to
    osg-gridftp-xrootd (SOFTWARE-3141)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.18.40.bosco-1
changelog:
  - Update PBS Pro qstat options for completed jobs (SOFTWARE-3675)
  - Apply patches from condor blahp (SOFTWARE-3587)
  - Use the original proxy if blahp proxy delegation is disabled (SOFTWARE-3661)
  - Use new condor env format (SOFTWARE-3589)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.8-1
changelog:
  - Download osg-ca-manage from GitHub instead of using a tarball client for fetching CAs (SOFTWARE-4242)


author: Tim Cartwright <cat@cs.wisc.edu> 3.4.3+15-1.cdh4.0.1.p0.4
changelog:
  - EL 7: Add tmpfiles configuration to manage /run/zookeeper (SOFTWARE-2511)
  - Own the (/var)?/run directory that the pre scriptlet makes (SOFTWARE-2511)
  - Correct hostname build requirement to use /bin/hostname


author: Dave Dykstra <dwd@fnal.gov> 4.13-2.1
changelog:
  - Upgrade to 4.13-2 tarball with the following release note:
   - Move temporary logrotate config file to the log directory, to keep
     SELinux on CentOS8 happy.


author: Dave Dykstra <dwd@fnal.gov> 4.13-3.1
changelog:
  - Upgrade to 4.13-3 tarball with the following release notes:
   - Change log rotates to no longer use reconfigure signal but to instead
      set logfile_rotate to zero and use the rotate signal.  This is much
      lighter weight and works around squid bug #5113.  Administrators can
      still set logfile_rotate to non-default values, but it is used only
      by fn-local-squid.sh and overridden for squid.
   - With multiple squid services, send the rotate signal only once to each
      squid.
   - Add timestamps to squidcron.log for the beginning and end of rotation.
  - Remove el6 support


author: Dave Dykstra <dwd@fnal.gov> 4.13-4.1
changelog:
  - Increase shoal-agent version to 1.0.0.
  - Upgrade to 4.13-4 tarball with the following release notes:
   - Add Compute Canada stratum 1s to MAJOR_CVMFS
   - Add any parameters passed in by $SQUID_START_ARGS to the starting of
      squid.  This is set to --foreground by the OSG frontier-squid docker
      container.


author: Dave Dykstra <dwd@fnal.gov> 4.13-5.1
changelog:
  - Upgrade to 4.13-5 tarball with the following release notes:
   - Use /bin/bash instead of $SHELL in fn-local-squid.sh because $SHELL
      is sometimes set to /bin/nologin (in particular when the squid user
      directly invokes fn-local-squid.sh).  This affected cleaning out old
      cache files and starting shoal.
   - Do not attempt to set net.core.somaxconn higher than the kernel
      maximum of 65335.


author: Dave Dykstra <dwd@fnal.gov> 4.13-5.2
changelog:
  - Fix bad permissions on one of the shoal-agent dependency directories.
    Only caused a problem when rebuilding from src rpm.


author: Dave Dykstra <dwd@fnal.gov> 4.15-1.1
changelog:
  - Upgrade to 4.15-1 tarball with the following release notes:
   - Update to squid-4.15 with release announcement at
       http://lists.squid-cache.org/pipermail/squid-announce/2021-May/000127.html
      The update includes security fixes, and at least one (SQUID-2020:11)
      is relevant because it enables someone that is allowed by access
      controls to use squid for some purpose to bypass any other access
      controls and use it for any purpose.  That one can be worked around
      with "uri_whitespace deny", but other denial of service vulnerabilities
      fixed in this version have no workaround.
   - Set "uri_whitespace deny" by default to avoid any other related
      vulnerabilities in the future.
   - Exit with an error if either of the two required logfile_rotate entries
      are not in squid.conf.  This is for the protection of who are using
      SQUID_CUSTOMIZE=false and have not properly merged the changes from
      squid.conf.frontierdefault.
   - Update the customhelps.awk function setoption() to work correctly
      after a setoptionparameter().
   - Allow cache_dir null type which means no disk cache, for systems that
      have very large cache_mem and maximum_object_size_in_memory.


author: Dave Dykstra <dwd@fnal.gov> 4.15-2.1
changelog:
  - Upgrade to 4.15-2 tarball with the following release notes:
   - Fix SQUID_COMPRESS_LOGS=false, which was broken since 4.13-3.  Change
      it to also use the external logrotate command instead of the squid
      builtin log rotation.


author: Brian Bockelman <bbockelm@cse.unl.edu> - 0.4.0-1
changelog:
  - Add support for POSIX-like umask.
  - Make multiuser plugin compatible with Macaroons.
  - Avoid a segfault if the plugin is improperly configured.


author: Dave Dykstra <dwd@fnal.gov> 0.2-1
changelog:
  - Pre-download and prepare all the go modules using new make-downloads
    script, so no network is needed during rpm build.


author: Dave Dykstra <dwd@fnal.gov> 0.3-1
changelog:
  - Rename make-downloads to make-source-tarball and make it have more
    in common with the vault-rpm build


author: Dave Dykstra <dwd@fnal.gov> 0.5-1
changelog:
  - Always reconfigure everything when systemd service is started, just don't
    disable/reenable oauthapp because that wipes out stored secrets.
  - Support multiple roles per issuer.


author: Dave Dykstra <dwd@fnal.gov> 4.11-4.1
changelog:
  - Upgrade to 4.11-4 tarball with the following release note:
    - Apply patch for bug #5041 which broke compilation in squid-4.11 on
      el7 with systemd.
  - Update rpm spec to build on el8.
  - Use python3 for shoal instead of python2 because that has the greatest
    portability across operating systems.  On el6, use the scl add-on
    package from Red Hat.  Apply a patch to shoal to work with python3.  
  - Pre-download python pip packages into shoal-downloads.tar.gz to include
    them in the src rpm.
  - Disable NIS basic-authentication on el8 because required header files
    are missing


author: Dave Dykstra <dwd@fnal.gov> 4.11-4.2
changelog:
  - Fix quoting on el6 build options to select the correct types of basic
    authentication.  The bug accidentally enabled ldap authentication which
    prevented an el6 rpm from installing on el7.
  - Remove openldap-devel build dependency.


author: Dave Dykstra <dwd@fnal.gov> 4.11-4.3
changelog:
  - Require systemd-devel on non-el6 systems, so squid's configure will
    recognize that it is on a systemd-based system.
  - Update to shoal-agent-0.9.9, and remove python3 patch because that
    is now merged.


author: Dave Dykstra <dwd@fnal.gov> 4.12-2.1
changelog:
  - Upgrade to 4.12-2 tarball with the following release notes (from 4.12-1
     and 4.12-2):
   - Update to squid-4.12 with release announcement at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00114.html
      It includes a couple of security advisories, but they are on
      features that as far as I know are not used by frontier-squid users.
   - Remove patches for bug #5030 and #5041 which are included in 4.12
   - Slightly update patch for bug #5051 as recommended by squid consultant
   - Note that an additional, more relevant squid advisory fixed in 4.12 was
      published late:
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00116.html
   - Support the "stdio:" prefix for access_log


author: Dave Dykstra <dwd@fnal.gov> 4.13-1.1
changelog:
  - Upgrade to 4.13-1tarball with the following release notes:
   - Update to squid-4.13 with release announcement at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00117.html
      It includes a couple of relevant security advisories related to
      cache poisoning.
   - Remove patch for bug 5051 since it is included in the 4.13 release.
  - Remove the recursion on the restorecon for SELinux in the %post install
      step, to avoid taking a long time when going through a large cache.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.5-4
changelog:
  - Add configs and systemd files from OSG modifications of globus-gridftp-server (SOFTWARE-2996)
  - Drop env var to disable SSLv3 (no longer needed)


author: Derek Weitzel <dweitzel@cse.unl.edu> - 1.3.1-1
changelog:
  - Fix dependency change of behavior in PyJWT
  - Add lifetime argument to scitokens-admin-create-token


author: Dave Dykstra <dwd@fnal.gov> 0.2.4-1.3.osg
changelog:
  - Change gsi-authz.conf to have the callout commented out by default
    so globus will fall back to the grid-mapfile


author: Mischa Salle <msalle@nikhef.nl> 0.3.1-1
changelog:
  - remove README file which is now a manpage
  - rename gt4-interface-install script
  - add gt4-interface-install man page
  - remove globus-core and globus-gsi-callback-devel build dependencies
  - update builddep on lcmaps-devel instead of -interface
  - prevent unnecessary linking
  - specify BuildRoot (and clean section) for EPEL5
  - remove defattr
  - cleanup docdir
  - adding BUGS and NEWS files
  - updated version


author: Brian Lin <blin@cs.wisc.edu> - 7.1.7-1
changelog:
  - Update to 7.1.7 (SOFTWARE-4237)
  - Add Python3 to the packaging for EL8 even though it's not yet supported upstream


author: Diego Davila <didavila@ucsd.edu> - 2.3.6
changelog:
  - Hardcoding the version (SOFTWARE-3820) 
  - Changing Source0 to match the downloaded tarball name from github


author: Dave Dykstra <dwd@fnal.gov>> - 1.5.11-1.1
changelog:
  - Updated to upstream 1.5.11-1.1, removed patch for unloading
      OpenSSL error strings (SOFTWARE-3282).


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 7.4p1-5.1
changelog:
  - Merge OSG changes:
      * Mon Dec 16 2019 Carl Edquist <edquist@cs.wisc.edu> - 7.4p1-4.5
      - Move gsisshd.sysconfig changes to osg-gsi-openssh-addons (SOFTWARE-3915)

      * Fri Dec 13 2019 Carl Edquist <edquist@cs.wisc.edu> - 7.4p1-4.4
      - Move OSG-specific items to osg-gsi-openssh-addons (SOFTWARE-3915)

      * Mon Sep 16 2019 Carl Edquist <edquist@cs.wisc.edu> - 7.4p1-4.1
      - Merge OSG changes (SOFTWARE-3828)


author: Derek Weitzel <dweitzel@unl.edu> - 0.6.0-1
changelog:
  - Fix compilation errors on c++11
  - Update to jwt-cpp-0.4.0 vendor
  - Change scitoken profile name to match spec, scitoken:2.0


author: Dave Dykstra <dwd@fnal.gov> - 0.6.3-1
changelog:
  - Add support for building Debian packages on the OpenSUSE Build System
  - Add patch to jwt-cpp to update its picojson dependency in order to
    enable it to compile on Debian 11 and Ubuntu 21.04
  - Fix el7 build by requiring epel-rpm-macros


author: Derek Weitzel <dweitzel@unl.edu> - 0.7.0-1
changelog:
  - Changes from static analysis
  - If only one key is available, do not error on no kid
  - Support at+jwt profile


author: Dave Dykstra <dwd@fnal.gov> 3.5.28-2.1
changelog:
  - Upgrade to 3.5.28-2 tarball with the following release notes:
   - Set umask and PATH in fn-local-squid.sh because /etc/init.d/functions
     used to set them.  This fixes problems with log rotation from cron.
   - Invoke /etc/init.d/functions from /etc/init.d/frontier-squid if it
     exists, because that is how systemd-based systems invoke systemctl
     to keep track of the service.  If it does not exist, set the PATH.


author: Dave Dykstra <dwd@fnal.gov> 4.3-1.1
changelog:
  - Upgrade to 4.3-1 tarball with the following release notes:
   - Major update to squid-4.3.
   - Removed patch for bug 4616 (patch was already applied in 4.3).
   - Replaced patch for bug 3952 with new --foreground option.
   - Ported patch for bug 7 forward.
  - Compile with devtoolset-2-toolchain on el6, in order to use c++11
  - Add PAM basic authentication module
  - Disable security-cert-validators to avoid perl Crypt::OpenSSL:X509
    dependency


author: Dave Dykstra <dwd@fnal.gov> 4.4-1.1
changelog:
  - Upgrade to 4.4-1 tarball with the following release notes:
   - Update to squid-4.4 with release notes at
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00086.html
     including one fairly significant security fix for a potential denial
     of service due to memory leaks on rejected SNMP queries.
   - If different squid services have different numbers of workers (for
      example by using setserviceoption on "workers") then use the biggest
      number when creating cache and log directories.


author: Dave Dykstra <dwd@fnal.gov> 4.6-1.1
changelog:
  - Upgrade to 4.6-1 tarball with the following release notes:
   - Update to squid-4.6 with release notes at
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00090.html
     squid-4.5 release notes are at
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00089.html
   - If a rotate is blocked because processing awstats logs is running long,
     do the rotate during the next rotateiflarge cron instead.


author: Dave Dykstra <dwd@fnal.gov> 0.2-1
changelog:
  - Allow for missing xdg-open
  - Add some missing "Exception as e" clauses
  - Create configdir if missing when needed
  - Change from jwt pip package to pyjwt, and disable verify_aud


author: Dave Dykstra <dwd@fnal.gov> 0.3-1
changelog:
  - Avoid including standard system libraries with pyinstaller
  - Increase timeout on web browser interaction to 5 minutes
  - Set up the interrupt signal to kill the program
  - Add BuildRequires for openssl-devel and swig
  - Remove confusing code for setting default cafile on RHEL and make setting
     the Debian default more clear


author: Dave Dykstra <dwd@fnal.gov> 0.4-1
changelog:
  - Support the new poll api in addition to the old device_wait api when
    waiting for authorization response
  - Use colon as separator in default secret path instead of hyphen
  - Add --scopes and --audience options
  - Implement the --minsecs option (was present before but didn't work)
  - Stop reading old bearer token and remove use of jwt package


author: Dave Dykstra <dwd@fnal.gov> 1.0-1
changelog:
  - Add --credkey option.
  - Add --vaultalias option.
  - Add --nokerberos and --kerbpath options.
  - Change the name of the --vaultrole option to --role; the short name -r
     remains unchanged.
  - Fill out the man page and add a html version of it to the source,
     generated by a Makefile.


author: Diego Davila <didavila@ucsd.edu> - 1.7.7-3
changelog:
  - Removig patches: dont_link and find_libXrdSec
  - Making sure upcoming version is higher than testing


author: Dave Dykstra <dwd@fnal.gov> 3.5.27-5.2
changelog:
  - Add %verify (not user group) to the %ghost statements for cache dir
    and log dir, and add %verify (not user group mode) on squid.conf and
    squid.conf.old.  Without those, rpm -V complains on el7 only, not el6.


author: Dave Dykstra <dwd@fnal.gov> 3.5.28-1.1
changelog:
  - Upgrade to 3.5.28-1 tarball with the following release notes:
   - Update to squid-3.5.28.  Here is the release announcement:
      https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00083.html
      Removed patches for advisories SQUID-2018_1 and SQUID-2018_2 and
      for bug 4767 because fixes are included in the release.
   - Remove including /etc/init.d/functions from fn-local-squid.sh and from
     /etc/init.d/frontier-squid.  It wasn't being used and isn't in some
     docker containers such as slc6-lite.
   - If there are *.log.0.gz files in the presence of awstats, remove
     them before rotating.  They prevented rotation from working on el7.
  - When creating an account for running squid under, use a home directory of
     /var/lib/squid instead of defaulting to /home/${FRONTIER_USER:-squid}.
     The old default doesn't work on systems with automounted /home.


author: Dave Dykstra <dwd@fnal.gov> 0.6-1
changelog:
  - Update vault-plugin-secrets-oauthapp to version 1.10.1, including
      applying a bug fix for broken minimum_seconds option
  - Disable periodic refresh of credentials; make it be only on demand
  - Require at least vault-1.7.0


author: Dave Dykstra <dwd@fnal.gov> 0.7-1
changelog:
  - Update to vault-plugin-secrets-oauthapp version 2.0.0
  - Update to final version of PR for periodic refresh of credentials
  - Move the 'PartOf' rule in htvault-config.service to the correct section.
  - Prevent vault DB initialization failure from blocking future attempts.
  - Change to have vault listen on all interfaces with tls for port 8200,
    and to use port 8202 for non-tls localhost access.


author: Dave Dykstra <dwd@fnal.gov> 1.0-1
changelog:
  - Convert to using yaml files instead of shell variables to configure.
  - Only update the vault configuration for things that have changed in
    the configuration, and include removing things that have been removed.
  - Keep secrets off command line to hide them from 'ps'.
  - Require at least vault-1.7.1


author: Dave Dykstra <dwd@fnal.gov> 1.1-1
changelog:
  - Correctly disable secret oauth module instead of incorrect auth module
    when something changes requiring clearing out of old secrets.
  - Allow dashes in names by converting them in bash variables to
    underscores, and reject any other non-alphanumeric or underscore in
    names.
  - Fix bug in RFC8693 token exchange pull request to puppetlabs plugin
    which caused comma-separated scopes to get sent to the token issuer
    instead of space-separated scopes.


author: Brian Lin <blin@cs.wisc.edu> - 1.4-1
changelog:
  - Add support to GLOBUS_GFS_CMD_SITE_RDEL
  - Add GRIDFTP_APPEND_XROOTD_CGI hook (environment variable) to support Xrootd space token.
  - Renamed xrootd-dsi packaging to reflect upstream


author: Brian Lin <blin@cs.wisc.edu> - 1:1.4-2
changelog:
  - Added architecture-specific provides for xrootd-dsi
  - Refer to gridftp-dsi-posix paths in globus-gridftp-server-plugin


author: Jason Patton <jpatton@cs.wisc.edu> - 0.8-1
changelog:
  - Python 3 compatibility
  - Credmon subprocess returns on parent exit
  - condor_who now reports credmon as Ready
  - Local issuer no longer refreshes tokens every loop


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.8.1-1.2
changelog:
  - Fix Python 3 bytes/str issue
    Added patch Open-temp-file-as-bytes-for-atomic_output-to-fix-str.patch


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.7.1-1.5
changelog:
  - Document the options to toggle between considering the first VOMS FQAN or
    considering all of them. (SOFTWARE-2932)


author: Dave Dykstra <dwd@fnal.gov> - 1.7.1-1.6
changelog:
  - Look up lcmaps_is_set_to_verify_voms_attributes symbol instead of
    always calling it, because the symbol isn't available when used by
    llrun. (SOFTWARE-3255)


author: Brian Bockelman <brian.bockelman@cern.ch> - 1.7.0-1
changelog:
  - Add key=value config syntax.
  - Prior config syntax no longer requires a minimum of three arguments.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 6.0.0-1
changelog:
  - Update to 6.0.0.  This release adds Python 3 support and changes the
    statistics collector to collector.atlas-ml.org


author: Edgar Fajardo <emfajard@ucsd.edu> 3.3-8
changelog:
  - Drop the setup.sh script no longer necessary in 3.4 (SOFTWARE-2676)
  - Drop the glexec subpackages since glexec is dropped in 3.4


author: Brian Lin <blin@cs.wisc.edu> - 3.0.0-1
changelog:
  - Remove tools and libraries designed for use with OIM
  - Add an option to request CSRs (SOFTWARE-3228)


author: Iryna Shcherbina <ishcherb@redhat.com> - 1.5.3-3
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Carl George <carl@george.computer> - 1.6.1-1
changelog:
  - Latest upstream
  - Add patch0 to remove pytest-{cov,runner} deps
  - Share doc and license dir between subpackages
  - Enable EPEL PY3 build


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.11-1
changelog:
  - Generalize cvmfsexec-osg-wrapper (SOFTWARE-4722)
  - Have make-cvmfsexec-tarball generate a multiplatform tarball


author: Brian Lin <blin@cs.wisc.edu> - 1.18.32.bosco-1
changelog:
  - Fix bug that broke shell parsing of `*_binpath` config values
  - Set default bin paths to `/usr/bin` to remove the overhead of `which` for each PBS, LSF, and SGE call.


author: Brian Lin <blin@cs.wisc.edu> - 1.18.33.bosco-1
changelog:
  - Fix bug that caused jobs submitted to PBS batch systems to be held
    with "Error parsing classad or job not found" (SOFTWARE-2875)
  - Fix parsing of time fields for slurm jobs (SOFTWARE-2871)


author: Brian Lin <blin@cs.wisc.edu> - 1.18.34.bosco-1
changelog:
  - Fix memory usage parsing for SLURM and PBS (SOFTWARE-2929)
  - Fix UnicodeDecodeError when reading blah.config (SOFTWARE-2953)


author: Brian Lin <blin@cs.wisc.edu> - 1.18.36.bosco-1
changelog:
  - Verify input file existence before submission (SOFTWARE-3154)
  - Save debugging dirs if job submission fails (SOFTWARE-2827)


author: Derek Weitzel <dweitzel@cse.unl.edu> - 1.5.0-1
changelog:
  - Include tests in distribution
  - Bump pyjwt version
  - Add test run with minimum dependencies
  - Run continuous integration on macOS and windows
  - Check verified claims for issuer in SciToken.serialize
  - Add base SciTokensException class
  - Remove verify=False keyword from calls to decode()
  - Print package list in CI jobs
  - Use python3_pkgversion macro in RPM package names
  - Move package version declaration into 'scitokens' module
  - Fix deprecation warning from cryptography.utils.int_from_bytes


author: Dave Dykstra <dwd@fnal.gov> 1.3-1
changelog:
  - Add --kerbprincipal option
  - Change the default kerbpath to include issuer and role
  - Limit oidc polling to 2 minutes
  - Disable oidc authenticatio when running in the background, that is, when
      none of stdin, stdout, or stderr are on a tty
  - Document that audience can be a comma or space separated list
  - Updated pip-installed dependent packages to latest versions


author: Dave Dykstra <dwd@fnal.gov> 4.13-1.1
changelog:
  - Upgrade to 4.13-1 tarball with the following release notes:
   - Update to squid-4.13 with release announcement at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00117.html
      It includes a couple of relevant security advisories related to
      cache poisoning.
   - Remove patch for bug 5051 since it is included in the 4.13 release.
  - Remove the recursion on the restorecon for SELinux in the %post install
      step, to avoid taking a long time when going through a large cache.


author: Dave Dykstra <dwd@fnal.gov> 4.15-1.2
changelog:
  - Filter out unneeded python3 dependency added by rpm's automatic
    dependency generation, by overriding /usr/lib/rpm/redhat/find-requires macro.


author: Brian Lin <blin@cs.wisc.edu> - 1.7.0-1
changelog:
  - Reference test files using relative paths
  - Use shutil.move instead of os.rename
  - Add error message for when SciToken.discover doesn't find a token
  - SciToken.serialize: fix str/bytes mismatch
  - Add rpmbuild github actions workflow
  - Update the bogus url used in the tests
  - Fix bug decoding a token with no audience
  - Use unittest.mock to check UnableToCreateCache
  - Add obsoletes for smoother Yum updates on EL7
  - Update algorithm used to test UnsupportedKeyException
  - Run test suite using pytest during rpmbuild
  - Update pyjwt version in requirements.txt
  - small typo fix in readme
  - Default cached public keys set to 4 days


author: Dave Dykstra <dwd@fnal.gov> 1.0-1
changelog:
  - Add --credkey option.
   - Add --vaultalias option.
   - Add --nokerberos and --kerbpath options.
   - Change the name of the --vaultrole option to --role; the short name -r
      remains unchanged.
   - Fill out the man page and add a html version of it to the source,
      generated by a Makefile.


author: Dave Dykstra <dwd@fnal.gov> 3.5.27-5.1
changelog:
  - Upgrade to 3.5.27-5 tarball with the following release note:
   - Avoid a reverse DNS lookup for every client connection by using the
     workaround in https://bugs.squid-cache.org/show_bug.cgi?id=4575,
     which is to override the defaults for url_rewrite_extras and
     store_id_extras.


author: Dave Dykstra <dwd@fnal.gov> 1.3-1
changelog:
  - Added license in COPYING file
  - Updated to vault-plugin-secrets-oauthapp-2.1.0
  - Updated the token exchange PR for vault-plugin-secrets-oauthapp to
      accept comma-separated lists of audiences
  - Added audit log at /var/log/htvault-config/auditlog
  - Enabled delayed log compression and daily logs instead of weekly
  - Add support for moving the master in a high-availability cluster from
    one machine to another and for changing the name of either peer
  - If 'name' is missing from a yaml list, give a helpful error message 
    instead of causing a python crash
  - Limit vault token policies for oidc and kerberos to a single role
    and issuer.  To use these limited policies for kerberos requires
    htgettoken >= 1.3 so for now the coarse-grained kerberos is still
    supported as well but it will be removed later.
  - Remove the default policy from vault tokens.


author: Dave Dykstra <dwd@fnal.gov> 1.4-1
changelog:
  - Updated the token exchange PR for vault-plugin-secrets-oauthapp to
      send the client secret in the initial authorization request in the
      device flow
  - Updated to vault-plugin-secrets-oauthapp-2.2.0


author: Dave Dykstra <dwd@fnal.gov> 1.5-1
changelog:
  - Require at least vault version 1.8.2
  - Update to vault-plugin-auth-jwt to the master branch at the time of the
    0.10.1 tag of the release-1.8 branch
  - Update to vault-plugin-secrets-oauthapp 3.0.0-beta.3 and use its new
    feature of combining all providers in a single plugin process
  - Include vault-plugin-secrets-oauthapp PR #64 which enables a default
    "legacy" server so older versions of htgettoken can still work.
  - Reconfigure kerberos if the service name changes.
  - Add a "kerbservice" issuers keyword to select non-default kerberos service
    for a particular issuer
  - Immediately fail with a clear message if there's a duplicate name in a
    configuration list
  - Allow vault tokens to read auth/token/lookup-self so clients can look up
    the remaining time to live on the tokens


author: Dave Dykstra <dwd@fnal.gov> 1.7-1
changelog:
  - Require at least vault version 1.8.4
  - Remove support for coarse-grained kerberos; requires htgettoken >= 1.3
  - Use /etc/krb5-<name>.keytab if it exists even for the first defined
    kerberos service, in preference to /etc/krb5.keytab.
  - Update to vault-plugin-secrets-oauthapp 3.0.0
  - Update to vault-plugin-auth-jwt 0.11.1


author: Dave Dykstra <dwd@fnal.gov> 1.8-1
changelog:
  - Restore part of the setup of kerberos; too much was taken out in 1.7
  - When an issuer is deleted, clean out the policies and kerberos modules
    related to its roles
  - Make policy names more consistent with module names


author: Dave Dykstra <dwd@fnal.gov> 1.10-1
changelog:
  - Fix problem that /etc/krb5-<name>.keytab was preferred for first service
    only when the kerbservice was explicitly defined for an issuer.  Now it
    also works for default first kerberos service.


author: Dave Dykstra <dwd@fnal.gov> 1.5-1
changelog:
  - Require at least vault version 1.8.2
  - Update to vault-plugin-auth-jwt to the master branch at the time of the
      0.10.1 tag of the release-1.8 branch
  - Update to vault-plugin-secrets-oauthapp 3.0.0-beta.3 and use its new
    feature of combining all providers in a single plugin process
  - Include vault-plugin-secrets-oauthapp PR #64 which enables a default
    "legacy" server so older versions of htgettoken can still work.
  - Reconfigure kerberos if the service name changes.
  - Add a "kerbservice" issuers keyword to select non-default kerberos service
    for a particular issuer
  - Immediately fail with a clear message if there's a duplicate name in a
    configuration list
  - Allow vault tokens to read auth/token/lookup-self so clients can look up
    the remaining time to live on the tokens


author: Dave Dykstra <dwd@fnal.gov> 4.12-2.1
changelog:
  - Upgrade to 4.12-2 tarball with the following release notes (from 4.12-1
     and 4.12-2):
   - Update to squid-4.12 with release announcement at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00114.html
      It includes a couple of security advisories, but the are on
      features that as far as I know are not used by frontier-squid users.
   - Remove patches for bug #5030 and #5041 which are included in 4.12
   - Slightly update patch for bug #5051 as recommended by squid consultant
   - Note that an additional, more relevant squid advisory fixed in 4.12 was
      published late:
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00116.html
   - Support the "stdio:" prefix for access_log


author: Dave Dykstra <dwd@fnal.gov> - 2.5-1
changelog:
  - Update the configuration for the config repo to apply all the logic
    from the config repo's default.conf and common.conf.  That is, support
    USE_CVMFS_CDN and CVMFS_CLIENT_PROFILE and set default CVMFS_PAC_URLS
    covering the WLCG Web Proxy Auto Discovery.
  - Reverse the order of the fallback proxies because of the bug in 
    https://sft.its.cern.ch/jira/browse/CVM-1920


author: Edgar Fajardo <efajardo@cern.ch> 1.1.0-1
changelog:
  Updated to the 1.1.0 release. It could not be a pass through build since the dist was missing in the Release entry in the spec file


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.5.4-25.4
changelog:
  - Add patch to enable ordered data (SOFTWARE-2436)
    - Adds dependency on globus-ftp-control >= 7.7
    - Adds build dependency on globus-gridftp-server >= 11


author: Edgar Fajardo <efajardo@cern.ch> - 4.0.2-7
changelog:
  - Addded the obsoletes part to the doc subpackage so a clean upgrade is done in cases users had older versions


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6.0-1
changelog:
  - Query multiple python executables, not just `which python` (which may not exist on EL8) (SOFTWARE-4146)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 6.1.0-1
changelog:
  - Update to 6.1.0.  This release changes the behavior of stashcp to use
    multiple caches and never go back to the origin.  (SOFTWARE-4255)


author: Derek Weitzel <dweitzel@cse.unl.edu> - 0.3.2-2
changelog:
  - Update packaging to not include 2 scripts for the admin-create*
  - Include the correct package for python-jwt dependency


