# changelog

author: Brian Lin <blin@cs.wisc.edu> - 5.0.0-1
changelog:
  - Add Python 3 and EL8 support (HTCondor-13)
  - Whole node jobs (HTCondor batch systems only) now make use of GPUs (HTCONDOR-103)
  - Added `USE_CE_HOME_DIR` configuration variable (default: `False`) to allow users to enable setting `$HOME` in the
    routed job's environment based on the HTCondor-CE user's home directory
  - HTCondor-CE Central Collectors now prefer GSI over SSL authentication (HTCONDOR-237)
  - HTCondor-CE registry now validates the value of submitted client codes (HTCONDOR-241)
  - Automatically remove CE jobs that exceed their `maxWalltime` (if defined) or the configuration value of
    `ROUTED_JOB_MAX_TIME` (default: 4320 sec/72 hrs)
  - Remove circular HTCondor-CE View configuration definition (HTCONDOR-161)
  - Replace htcondor-ce package requirement with python2-condor for htcondor-ce-bdii


author: Mark Coatsworth <coatsworth@cs.wisc.edu> - 5.1.0-1
changelog:
  - Fix an issue where the CE removed running jobs prematurely (HTCONDOR-350)
  - Add optional job router transform syntax (HTCONDOR-243)
  - Add username and X.509 accounting group mapfiles for use by job router transforms (HTCONDOR-187)
  - Replace custom mappings in condor_mapfile with /etc/condor-ce/mapfiles.d/ (HTCONDOR-244)
  - Require regular expressions in the second field of the unified mapfile be enclosed by '/'(HTCONDOR-244)
  - Update maxWallTime logic to accept BatchRuntime (HTCONDOR-80)
  - Append SSL to the default authentication methods list (HTCONDOR-366)
  - APEL reporting scripts now use the local HTCondor's PER_JOB_HISTORY_DIR to collect job data. (HTCONDOR-293)
  - Use the `GlobalJobID` attribute as the APEL record `lrmsID` (#426)
  - Update HTCondor-CE registry app to Python 3 (HTCONDOR-307)
  - Enable SSL authentication by default for `READ`/`WRITE` authorization levels (HTCONDOR-366)
  - Downgrade errors in the configuration verification startup script to support routes written in the transform syntax (#465)
  - Allow required directories to be owned by non-`condor` groups (#451)
  - Fix an issue with an overly aggressive default `SYSTEM_PERIODIC_REMOVE` (HTCONDOR-350)
  - Fix incorrect path to Python 3 Collector plugin (HTCONDOR-400)
  - Fix faulty validation of `JOB_ROUTER_ROUTE_NAMES` and `JOB_ROUTER_ENTRIES` in the startup script (HTCONDOR-406)
  - Fix various Python 3 incompatibilities (#460)


author: Brian Lin <blin@cs.wisc.edu> - 5.1.1-1
changelog:
  - Improve restart time of HTCondor-CE View (HTCONDOR-420)
  - Fix bug that caused HTCondor-CE to ignore incoming BatchRuntime requests (#480)
  - Fix blahp packaging requirement (HTCONDOR-504)


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.2-1
changelog:
  - Fixed the default memory and CPU requests when using job router transforms
  - Apply default MaxJobs and MaxJobsIdle when using job router transforms
  - Improved SciTokens support in submission tools
  - Fixed --debug flag in condor_ce_run
  - Update configuration verification script to handle job router transforms
  - Corrected ownership of the HTCondor PER_JOBS_HISTORY_DIR
  - Fix bug passing maximum wall time requests to the local batch system


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.3-1
changelog:
  - The HTCondor-CE central collector requires SSL credentials from client CEs
  - Fix BDII crash if an HTCondor Access Point is not available
  - Fix formatting of APEL records that contain huge values
  - HTCondor-CE client mapfiles are not installed on the central collector


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.4-1
changelog:
  - Fix whole node job glidein CPUs and GPUs expressions that caused held jobs
  - Fix bug where default CERequirements were being ignored
  - Pass whole node request from GlideinWMS to the batch system
  - Since CentOS 8 has reached end of life, we build and test on Rocky Linux 8


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.5-1
changelog:
  - Rename AuthToken attributes in the routed job to better support accounting
  - Prevent GSI environment from pointing the job to the wrong certificates
  - Fix issue where HTCondor-CE would need port 9618 open to start up


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.6-1
changelog:
  - HTCondor-CE now uses the C++ Collector plugin for payload job traceability
  - Fix HTCondor-CE mapfiles to be compliant with PCRE2 and HTCondor 9.10.0+
  - Add support for multiple APEL accounting scaling factors
  - Suppress spurious log message about a missing negotiator
  - Fix crash in HTCondor-CE View


author: Tim Theisen <tim@cs.wisc.edu> - 6.0.0-1
changelog:
  - Align HTCondor-CE security configuration with HTCondor defaults
  - Add example configuration on how to ban users
  - Add condor_ce_transform_ads command
  - Improve essential directory checking and creation at startup


author: Dave Dykstra <dwd@fnal.gov> - 2.1-1
changelog:
  - Merge LIGO changes to debian packaging
  - Move packaging/debian to debian and packaging/redhat to rpm, to work
    better with OBS and new OSG github packaging standard


author: Dave Dykstra <dwd@fnal.gov> - 2.2-1
changelog:
  - Just change the version number because the OSG github-source for
    reading spec files doesn't work with dash release tags.


author: Dave Dykstra <dwd@fnal.gov> - 2.3-1
changelog:
  - Change the changelog date on version 2.0.3 from Feb 28 2017 to
    May 28 2017 because osg-build complained about non-descending order
    of the dates.
  - Change the rpm/rpmbuild-cvmfs-config-osg development test script 
    to read from rpm instead of packaging/redhat.


author: Dave Dykstra <dwd@fnal.gov> - 2.4-1
changelog:
  - Change the server urls for the config-osg repository to use openhtc.io
    aliases when the proxy url can use DIRECT.


author: Dave Dykstra <dwd@fnal.gov> - 2.4-4
changelog:
  - Skipped release 2.4-2 and 2.4-3 to make consistent with cvmfs-config-egi.
  - Change Conflicts: cvmfs-config-default to Obsoletes: to make it
    easier to replace. Add Conflicts: cvmfs-config-egi because it
    is mutually exclusive.


author: Dave Dykstra <dwd@fnal.gov> - 2.5-1
changelog:
  - Update the configuration for the config repo to apply all the logic
    from the config repo's default.conf and common.conf.  That is, support
    USE_CVMFS_CDN and CVMFS_CLIENT_PROFILE and set default CVMFS_PAC_URLS
    covering the WLCG Web Proxy Auto Discovery.
  - Reverse the order of the fallback proxies because of the bug in 
    https://sft.its.cern.ch/jira/browse/CVM-1920


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.10-1
changelog:
  - Fixes for security issues
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0001
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0002
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0003


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.11-1
changelog:
  - The Job Router can now create an IDTOKEN for use by the job
  - Fix bug where a self-checkpointing job may erroneously be held
  - Fix bug where the Job Router could erroneously substitute a default value
  - Fix bug where a file transfer error may identify the wrong file
  - Fix bug where condor_ssh_to_job may fail to connect


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.12-1
changelog:
  - Fix bug in parallel universe that could cause the schedd to crash
  - Fix rare crash where a daemon tries to use a discarded security session


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.13-1
changelog:
  - Schedd and startd cron jobs can now log output upon non-zero exit
  - condor_config_val now produces correct syntax for multi-line values
  - The condor_run tool now reports submit errors and warnings to the terminal
  - Fix issue where Kerberos authentication would fail within DAGMan
  - Fix HTCondor startup failure with certain complex network configurations


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.14-1
changelog:
  - SciToken mapping failures are now recorded in the daemon logs
  - Fix bug that stopped file transfers when output and error are the same
  - Ensure that the Python bindings version matches the installed HTCondor
  - $(OPSYSANDVER) now expand properly in job transforms
  - Fix bug where context managed Python htcondor.SecMan sessions would crash
  - Fix bug where remote CPU times would rarely be set to zero


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.16-1
changelog:
  - Singularity now mounts /tmp and /var/tmp under the scratch directory
  - Fix bug where Singularity jobs go on hold at the first checkpoint
  - Fix bug where gridmanger deletes the X.509 proxy file instead of the copy
  - Fix file descriptor leak when using SciTokens for authentication


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.17-1
changelog:
  - Fix file descriptor leak when schedd fails to launch scheduler jobs
  - Fix failure to forward batch grid universe job's refreshed X.509 proxy
  - Fix DAGMan failure when the DONE keyword appeared in the JOB line
  - Fix HTCondor's handling of extremely large UIDs on Linux
  - Fix bug where OAUTH tokens lose their scope and audience upon refresh
  - Support for Apptainer in addition to Singularity


author: Dennis Box <dbox@fnal.gov> - 3.7.5
changelog:
  - Glideinwms v3.7.5
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_7_5/history.html
  - Release candidates 3.7.5-01.rc1 to  3.7.5-06.rc6


author: Bruno Coimbra <coimbra@fnal.gov> - 3.9.3
changelog:
  - Glideinwms v3.9.3
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_9_3/history.html
  - Release candidates 3.9.3-01.rc1


author: Dennis Box <dbox@fnal.gov> - 3.7.6
changelog:
  - Glideinwms v3.7.5
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_7_6/history.html
  - Release candidates 3.7.5-01.rc1 to  3.7.5-01.rc2


author: Bruno Coimbra <coimbra@fnal.gov> - 3.9.4
changelog:
  - Glideinwms v3.9.4
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_9_4/history.html
  - Release candidates 3.9.4-01.rc1 to 3.9.4-01.rc5


author: Bruno Coimbra <coimbra@fnal.gov> - 3.9.5
changelog:
  - Glideinwms v3.9.5
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_9_5/history.html
  - Release candidates 3.9.5-01.rc1 to 3.9.5-03.rc3


author: Marco Mambelli <marcom@fnal.gov> - 3.9.6
changelog:
  - Glideinwms v3.9.6
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_9_6/history.html
  - Release candidates 3.9.6-01.rc1 to 3.9.6-06.rc6


author: Marco Mambelli <marcom@fnal.gov> - 3.10.0
changelog:
  - Glideinwms v3.10.0
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_0/history.html
  - Release candidates 3.10.0-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.1
changelog:
  - Glideinwms v3.10.1
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_1/history.html
  - Release candidates 3.10.1-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.2
changelog:
  - Glideinwms v3.10.2
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_2/history.html
  - Release candidates 3.10.2-01.rc1 to 3.10.2-02.rc2


author: Carl Edquist <edquist@cs.wisc.edu> - 2.6.3-1
changelog:
  - Restore ProbeConfig symlinks, and other dcache-transfer fixes (SOFTWARE-5241)
  - Replace default_prefix with _datadir; drop relocatable Prefixes


author: Carl Edquist <edquist@cs.wisc.edu> - 2.7.0-1
changelog:
  - Prefer CpusProvisioned over RequestCpus if set (SOFTWARE-5246)
  - Prefer MachineAttrGLIDEIN_ResourceName0 for ResourceName calculation;
  - Include GLIDEIN_ResourceName in SYSTEM_JOB_MACHINE_ATTRS (SOFTWARE-5249)


author: Brian Lin <blin@cs.wisc.edu.> - 2.8.4-1
changelog:
  - HTCondor AP and CE probes now drop privileges to the 'condor' user
    if run as 'root' (SOFTWARE-5531)
  - Improve logging and failure modes when encountering unwriteable
    directories (SOFTWARE-5531)


author: Dave Dykstra <dwd@fnal.gov> - 2.10.0-1.1
changelog:
  - Re-apply fix for el8 pacparser build error by requiring python3, from
    https://github.com/cvmfs/cvmfs/pull/2986


author: Brian Lin <blin@cs.wisc.edu> - 5.5.1-1.11
changelog:
  - Further updates to the redirector hostname patch (SOFTWARE-5418.redirector-hostnames.patch) (SOFTWARE-5418)
  - Drop 1868-env-hostname-override.patch, it is included in the above patch.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.5.1-1.13
changelog:
  - Replace SOFTWARE-5418.redirector-hostnames.patch with an updated 1868-env-hostname-override.patch (SOFTWARE-5414/SOFTWARE-5418)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.5.3-1.2
changelog:
  - Update to 5.5.3-1 from upstream and merge OSG patches (SOFTWARE-5436):
    - Drop 1826-HTTP-TPC-PULL.patch (upstreamed)
    - Drop voms-mapfile-handle-missing-role.patch (upstreamed)
  - Add 1918-Fix-direct-read-for-PFC.patch
  - Add 1920-XrdHttp-Fix-byte-range-requests.patch
  - Disable compat build on EL9


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.5.4-1.1
changelog:
  - Update to 5.5.4-1 from upstream and merge OSG changes (SOFTWARE-5539)
    - Drop 1918-Fix-direct-read-for-PFC.patch (upstreamed)
    - Drop 1920-XrdHttp-Fix-byte-range-requests.patch (upstreamed)


author: Dave Dykstra <dwd@fnal.gov> - 1.0-1
changelog:
  - Use the same root / $CWD as the target process.  Without this, the
    authz process may utilize the incorrect file for target processes
    that are in a chroot or provide a relative path for the X509 proxy.


author: Dave Dykstra <dwd@fnal.gov> - 2.2-1
changelog:
  - Prevent exiting after the first token authentication
  - Close token file descriptor after use
  - Enable token debug messages
  - Implement WLCG bearer token discovery standard
  - Add libscitokens-dev build dependency on debian


author: Derek Weitzel <dweitzel@unl.edu> - 2.0.0-1
changelog:
  - Add checksum library that saves to extended attributes
  - Add multiuser.checksumonwrite option to turn on checksumming the file while it is being written.


author: Carl Edquist <edquist@cs.wisc.edu> - 2.0.4-1
changelog:
  - Initialize crc32
  - Fix assert in el8 due to vector reserve
  - Reorder variables to address compiler warning/error


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.1.1-1
changelog:
  - Relax hostname validation in 40-siteinfo.ini (failing to resolve is now a warning) (SOFTWARE-3953)
  - No longer make resource_group mandatory for CEs in 40-siteinfo.ini (SOFTWARE-3949)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.11.0-1
changelog:
  - Add Pilot entries (SOFTWARE-4177)
  - Don't try to resolve Squid on the CE (SOFTWARE-4362)
  - Ignore all fetch-crl errors, but warn if no CRLs exist (SOFTWARE-4364)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.0.0-1
changelog:
  - Drop lcmaps-db-templates dependency (SOFTWARE-4503)
  - Turn osg-configure-misc into a dummy package (SOFTWARE-4507)
  - Rename 30-gip.ini to 31-cluster.ini and osg-configure-gip to osg-configure-cluster (SOFTWARE-4485)
  - Deprecate RSV  (SOFTWARE-4511)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.1.0-0.15
changelog:
  - Depend on /usr/bin/condor_remote_cluster instead of condor-bosco (SOFTWARE-4973)
  - Split libs into separate RPM
  - Add osg-ce-attributes-generator (SOFTWARE-4895)
  - Don't require base osg-configure package in osg-configure-siteinfo and osg-configure-cluster
    because they can also be used by osg-ce-attributes-generator
  - Advertise batch system used by bosco (SOFTWARE-3720)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 2.1.0-0.14.rc2.4
changelog:
  - Fix voms_install_db cert parsing to deal with OpenSSL 1.1+ format and "Let's Encrypt" (SOFTWARE-4882)
    - Add 4882-voms_install_db-cert-parsing.patch


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 2.1.0-0.14.rc2.5
changelog:
  - Increase default key size to 2048 bits in voms-proxy-direct (SOFTWARE-4889)
    - Add Set-default-key-size-to-2048-bits-in-voms-proxy-dire.patch


author: Edgar Fajardo <efajardo@cern.ch> 1.1.0-1
changelog:
  Updated to the 1.1.0 release. It could not be a pass through build since the dist was missing in the Release entry in the spec file


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.6-8
changelog:
  - Add sample scitokens.conf file (SOFTWARE-4790)
    based on https://github.com/xrootd/xrootd/blob/v5.3.2/src/XrdSciTokens/configs/scitokens.cfg
  - Rename *-osg-vomsxrd.cfg to *-osg-xrdvoms.cfg (SOFTWARE-4495)
  - Change XrdVoms config to fall back to using a hash of the user's DN as the username if the DN can't be found in the mapfile (SOFTWARE-4495)
  - Replace deprecated http.* config with tls.* (SOFTWARE-4495)
  - Require TLS when using SciTokens
  - Move 50-osg-scitokens.cfg to osg-xrootd-standalone to avoid conflict with xcache packaging
  - Move scitokens.conf to osg-xrootd-standalone and mark it %config(noreplace)
  - Move xrootd-scitokens requirement to osg-xrootd-standalone since we don't distribute config for it in the base package


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.6-12
changelog:
  - Set grid-mapfile location (http.gridmap and -gridmap in sec.protocol gsi)
    to the standard location (SOFTWARE-4937)


author: Diego Davila <didavila@ucsd.edu> 3.6-14
changelog:
  - Configure Xrootd to send caching monitoring data (SOFTWARE-5026)
  - Make the ShovelerHostPort variable to use as the monitoring collector if there is a shoveler


author: Tim Theisen <tim@cs.wisc.edu> - 1.104-1
changelog:
  - Update to IGTF 1.114 (SOFTWARE-4965)
  - SOFTWARE-4965: Remove expired Let's Encrypt ROOT CA X3
  - SOFTWARE-4965: Remove expired Let's Encrypt ROOT CA X4


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 6.0.0-1
changelog:
  - Update to 6.0.0.  This release adds Python 3 support and changes the
    statistics collector to collector.atlas-ml.org


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 6.1.0-1
changelog:
  - Update to 6.1.0.  This release changes the behavior of stashcp to use
    multiple caches and never go back to the origin.  (SOFTWARE-4255)


author: Diego Davila <didavila@ucsd.edu> - v1.2-1
changelog:
  - Building against Xrootd 5.0 (SOFTWARE-3923)
  - Adding patch: link_to_lXrdPfc5.patch 
  - Bumping version 1.2-1


author: Diego Davila <didavila@ucsd.edu> - v1.2-3.1
changelog:
  - Removing patch: link_to_lXrdPfc5.patch 
  - Adding patch: dont_link.patch that removes the linking against libXrdFileCache-4


author: Diego Davila <didavila@ucsd.edu> - v1.2-3.3
changelog:
  - building against xrootd-5.0.0-1 (SOFTWARE-3923)
  - updating xrootd_current_major and xrootd_next_major to 5 and 6 respectively


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.2.1-1
changelog:
  - Allow specifying the xrootd instance (e.g. stash-cache, stash-origin-auth) to
    authfile-update (SOFTWARE-5028)
  - Split stash-origin's "originexport" var into "PublicOriginExport" and
    "AuthOriginExport" (SOFTWARE-5303)
  - Append contents of a "scitokens.conf.local" file to generated scitokens.conf (SOFTWARE-5315)
  - Includes Fri Sep 02 2022 Carl Edquist <edquist@cs.wisc.edu>:
      - Generate authfile even if origin serves no public data (SOFTWARE-5028)
      - Refactor stash-authfile systemd files


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.4.0-2
changelog:
  - Add python3-condor and python3-xrootd build dependencies so we don't build RPMs for repos
    which they can't be installed from.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.5.0-1
changelog:
  - Have the authfile updater get a grid-mapfile from Topology for
    stash-cache-auth and stash-origin-auth (SOFTWARE-5467)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 6.9.2-2
changelog:
  - Take new 10-stash-plugin.conf file from upstream (SOFTWARE-5350)
    (replace 10-stash-plugin.config with it, for consistency with upstream)


author: Mats Rynge <rynge@isi.edu> 1.7-1
changelog:
  - Moved to the new ospool.osg-htc.org central managers in high
    availability setup
  - Removed pre-9.0 HTCondor config - this is no longer
    supported by the OSPool (IDTOKENS only)
  - Change the VO override to the lowercase "osg" (SOFTWARE-4905)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.8-1
changelog:
  - Include the package version in the schedd classad (SOFTWARE-5105)
  - Disable .sif images on 3.x kernels (OSPOOL-18)
  - Improve OS_VERSION handling
  - Drop Map* ProbeConfig overrides (SOFTWARE-5042)


author: Diego Davila <didavila@ucsd.edu> - 1.5.2-6
changelog:
  - Build for el8 (software-4257)
  - Adding patch: buff_size.patch to avoid compiling error
  - Adding if around libXrdCmsTfc.so.* in the 'files' section


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.6-1
changelog:
  - Have update-all-remote-wn-ce run updaters with a timeout (SOFTWARE-4081)
  - If one update fails, keep going with the other updates instead of bailing out


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.8-1
changelog:
  - Download osg-ca-manage from GitHub instead of using a tarball client for fetching CAs (SOFTWARE-4242)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.11-1
changelog:
  - Generalize cvmfsexec-osg-wrapper (SOFTWARE-4722)
  - Have make-cvmfsexec-tarball generate a multiplatform tarball


author: Carl Edquist <edquist@cs.wisc.edu> - 1.0-1
changelog:
  - Release hosted-ce-tools 1.0 (SOFTWARE-5130)
  - Convert scripts to python3 (SOFTWARE-5131)
  - Timeout rsync in update-remote-wn-client (SOFTWARE-4670)
  - Dereference hardlinks when extracting tarball (SOFTWARE-5254)


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Fix bug that caused the proxy to be stored into MyProxy under the DN
    of a previous certificate (if it existed but could not be reused)
    rather than the newly generated one.


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Fix typo in the variable name added in the last version.  This was
    not noticed because it was caught in an exception and caused it to
    always behave as if a previous proxy stored in myproxy could not be
    used.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Make source code completely compatible with python3
  - Fix check for more than 5 proxy levels to apply when verbose option
    is not set


author: Dave Dykstra <dwd@fnal.gov> 1.19-1
changelog:
  - Add setup.py for making a standard python installation
  - Use ssl.get_default_verify_paths() to find default CA paths, when possible
  - Make --listinstitutions compatible with python3


author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Add make sources target for koji build
  - Add make srpm target for copr build
  - Support port numbers in https urls
  - Return all received cookies in the final getcert step
  - Add sending Server Name Indication on https connections


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 4.2.3-1.1
changelog:
  - Update to 4.2.3-1 from upstream (SOFTWARE-4885)
  - Add Check-for-DT_REG-macro.patch to avoid compile error on EL7 due to missing DT_REG macro


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.0.1-1.1
changelog:
  - Build for OSG; add setuptools_scm build dependency (SOFTWARE-4877)
    Ignore byte-compile errors: they fail on Python 2 code in the examples


author: Brian Lin <blin@cs.wisc.edu> 2.0.0-1
changelog:
  - Add GPU support (#12)
  - Improve multi-node support for Slurm (HTCONDOR-166)
  - More efficient status queries for Slurm (HTCONDOR-104)
  - More robust job ID extraction from SLurm (HTCONDOR-259)
  - Better interfacing with PBS and Slurm
  - More Python 3 fixes for PBS and Slurm scripts
  - Convert LSF script to Python 3 (HTCONDOR-333, #34)
  - Add Debian build files


author: Tim Theisen <tim@cs.wisc.edu> 2.0.1-1
changelog:
  - Convert to pure Python 3 (no Python 2 compatibility)
  - Restore blah_libexec_directory to the blah.config file


author: Tim Theisen <tim@cs.wisc.edu> 2.1.0-1
changelog:
  - Fix bug where GPU request was not passed onto the batch script
  - Fix problem where proxy symlinks were not cleaned up by not creating them
  - Fix bug where output files are overwritten if no transfer output remap
  - Added support for passing in extra submit arguments from the job ad


author: Tim Theisen <tim@cs.wisc.edu> 2.1.1-1
changelog:
  - Add Python 2 support back for Enterprise Linux 7
  - Allow the user to override system configuration files
  - Enable flexible configuration via a configuration directory
  - Fix Slurm resource usage reporting


author: Tim Theisen <tim@cs.wisc.edu> 2.1.4-1
changelog:
  - Report AllocCPUS of Slurm jobs in status result
  - Disable email notifications for blahp->condor jobs


author: Jeny Teheran <jteheran@fnal.gov> - 3.2.0
changelog:
  - Change -f/--hostfile to -F/--hostfile
  - Change -T/--test to -t/--test
  - Switch argparsing to ArgumentParser
  - Validate if filepath exists and can be read at the ArgumentParser
  - Stop wrapping text messages
  - Include the program name in error messages
  - Show message per certificate when request or retrieval fails
  - Increased the number of retries for certificate retrieval


author: Jeny Teheran <jteheran@fnal.gov> - 3.2.1
changelog:
  - Add man page for osg-incommon-cert-request
  - Add .html version of man page for osg-incommon-cert-request


author: Jeny Teheran <jteheran@fnal.gov> - 3.2.2
changelog:
  - Fix format error for message when retrieval times out
  - Increased the wait time between retrieval attempts
  - Improve formatting of osg-incommon-cert-request man page


author: Dave Dykstra <dwd@fnal.gov> - 3.3.0
changelog:
  - Bump to new middle version number because of the new -O/--orgid option.
  - Slightly reorganize the man page documentation of the new option.


author: Dave Dykstra <dwd@fnal.gov> 1.11.1-1
changelog:
  - Update to upstream 1.11.1, which includes a fix to avoid denial of
    service on HA installation.
  - Remove $GOPATH/mod/*.* from the source tarball, leaving just
    $GOPATH/mod/cache/download.  That saves about 300M while still
    allowing offline builds.


author: Derek Weitzel <dweitzel@cse.unl.edu> - 1.3.1-1
changelog:
  - Fix dependency change of behavior in PyJWT
  - Add lifetime argument to scitokens-admin-create-token


author: Derek Weitzel <dweitzel@cse.unl.edu> - 1.5.0-1
changelog:
  - Include tests in distribution
  - Bump pyjwt version
  - Add test run with minimum dependencies
  - Run continuous integration on macOS and windows
  - Check verified claims for issuer in SciToken.serialize
  - Add base SciTokensException class
  - Remove verify=False keyword from calls to decode()
  - Print package list in CI jobs
  - Use python3_pkgversion macro in RPM package names
  - Move package version declaration into 'scitokens' module
  - Fix deprecation warning from cryptography.utils.int_from_bytes


author: Brian Lin <blin@cs.wisc.edu> - 1.7.0-1
changelog:
  - Reference test files using relative paths
  - Use shutil.move instead of os.rename
  - Add error message for when SciToken.discover doesn't find a token
  - SciToken.serialize: fix str/bytes mismatch
  - Add rpmbuild github actions workflow
  - Update the bogus url used in the tests
  - Fix bug decoding a token with no audience
  - Use unittest.mock to check UnableToCreateCache
  - Add obsoletes for smoother Yum updates on EL7
  - Update algorithm used to test UnsupportedKeyException
  - Run test suite using pytest during rpmbuild
  - Update pyjwt version in requirements.txt
  - small typo fix in readme
  - Default cached public keys set to 4 days


author: Carl Edquist <edquist@cs.wisc.edu> - 1.7.4-1
changelog:
  - bugfix release v1.7.4 (SOFTWARE-5446)
  - Attempt to fix codacy in github actions #159
  - Add pyproject.toml file for PEP 517 builds #162
  - Install requires setuptools #163
  - Add configuration for readthedocs #165
  - Add links to readthedocs in some places #166
  - Run pip list installed to show packages #168
  - Remove aud enforcement from deserialize function #167


author: Brian Lin <blin@cs.wisc.edu> 1.1.6-1
changelog:
  - Change software.grid.iu.edu to repo.grid.iu.edu in osg-ca-scripts (SOFTWARE-2666)
  - Remove unsupported compat links for old OpenSSL hashes
  - Added `ITB` options back to help text


author: Carl Edquist <edquist@cs.wisc.edu> - 3.5-5
changelog:
  - Add SCHEDD_CRON_GRATIA_ARGS to 51-gratia.conf (SOFTWARE-3973)
  - Move 51-gratia.conf to bosco subpackage


author: Brian Lin <blin@cs.wisc.edu> - 3.6-1
changelog:
  - Remove stale provides/obsoletes (SOFTWARE-4469)
  - Use gratia-probe-htcondor-ce across all batch systems (SOFTWARE-3819, SOFTWARE-4469)
  - Drop LCMAPS requirements (SOFTWARE-4469)
  - Remove Gratia-specific configurations (SOFTWARE-4490)


author: Brian Lin <blin@cs.wisc.edu> - 3.6-5
changelog:
  - Add OSG release series SchedD attribute (SOFTWARE-4984)
  - Remove upstreamed blahpd location configuration (SOFTWARE-4984)


author: Dave Dykstra <dwd@fnal.gov> 1.9-1
changelog:
  - Add support for ssh-agent authentication, including the --sshpath, 
    --nossh and --registerssh options.  Add the paramiko package to the
    included library packages.
  - Remove "/login" from --kerbpath.


author: Dave Dykstra <dwd@fnal.gov> 1.10-1
changelog:
  - Write out vault tokens after kerberos or ssh authentication only
    if they can successfully be used to read a bearer token
  - Change the oidc authentication prompt to say to "copy/paste into any web
    browser" instead of "open URL manually"
  - Update python dependencies to current versions in pip


author: Dave Dykstra <dwd@fnal.gov> 1.13-1
changelog:
  - Disable kerberos reverse DNS lookup in order to work when the vault
    server is using a DNS alias.
  - Intelligently handle multiple IP addresses in a DNS name, timing out
    connection attempts after 5 seconds and not reusing addresses that
    failed to connect.  Tries IPv4 before IPv6.
  - Update python dependencies to current versions in pip.


author: Dave Dykstra <dwd@fnal.gov> 1.13-2
changelog:
  - Suppress python warnings in order to avoid CryptographyDeprecationWarning
    about python3.6 being deprecated.


author: Dave Dykstra <dwd@fnal.gov> 1.14-1
changelog:
  - Support wildcard host certs for all https connections.  They used to be
    supported for everything but the --vaultalias option but that support 
    was broken in version 1.13.


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Revert to prior method for allowing --vaultalias as an alternate name
    for matching the host cert.  It doesn't support wildcard certs, but it
    permits allowing either the original host name or the alias and avoids
    needing separate alias options for kerberos and https.


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Fix httokendecode -H functionality to only attempt to convert a parsed word
    if it is entirely numeric, not if it just contains one digit.  At the same
    time, rewrite the functionality in native bash instead of using grep and sed.
  - Add htdestroytoken command.
  - Add a symlink htdecodetoken pointing to httokendecode.


author: Dave Dykstra <dwd@fnal.gov> 1.17-1
changelog:
  - Fix the usage of getaddrinfo, which caused a fatal error on python3.9
    on Mac.
  - Make --showbearerurl work properly in combination with --nobearertoken.
  - Change the httokendecode error message for a missing token file to
    stderr instead of stdin.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.6-9
changelog:
  - Replace RPM-GPG-KEY-OSG-3 with something that's accepted by rpm on both EL7 and EL9 (SOFTWARE-5408)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4-1
changelog:
  - Remove osg-release requirement; ignore missing compat packages; only try to
    update packages that are installed (SOFTWARE-2146)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6-1
changelog:
  - Replace references to OSG Twiki with links to current docs (SOFTWARE-3083)
  - Replace help email (SOFTWARE-3015)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.1-1
changelog:
  - Use --location argument to specify destination; use /etc or $OSG_LOCATION/etc if not specified (SOFTWARE-2527)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.3.0-1
changelog:
  - Add osg-release requirement
  - Allow taking osg repo definition from osg-release installed in a tarball client (SOFTWARE-2527)


author: Brian Lin <blin@cs.wisc.edu> - 0.8.1-1
changelog:
  - Add the --pw-store option to the invocation of oidc-add and add a default
    scope of blank if no scopes are configured.  These are needed for the
    CILogon issuer (SOFTWARE-4983).


author: Carl Edquist <edquist@cs.wisc.edu> - 0.8.2-1
changelog:
  - Increase renewal frequency to ensure continual validity (SOFTWARE-5137)
  - Fix password file handling for restricted permissions in setup script (#17)
  - Use newer --pw-file option for oidc-add (SOFTWARE-5050)
  - Bump version requirement for oidc-agent package (SOFTWARE-5050)


author: Dave Dykstra <dwd@fnal.gov> 4.15-2.1
changelog:
  - Upgrade to 4.15-2 tarball with the following release notes:
   - Fix SQUID_COMPRESS_LOGS=false, which was broken since 4.13-3.  Change
      it to also use the external logrotate command instead of the squid
      builtin log rotation.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 4.17-1.1
changelog:
  - Upgrade to 4.17-1 tarball with the following release notes:
   - Update to squid-4.17.  Includes squid-4.16 with release announcement at
       http://lists.squid-cache.org/pipermail/squid-announce/2021-July/000134.html
      and squid-4.17 with release announcement at
       http://lists.squid-cache.org/pipermail/squid-announce/2021-October/000137.html
      The latter includes a security fix, but it is to code disabled in
      frontier-squid.
  - Avoid including standard system libraries with pyinstaller.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 4.17-2.1
changelog:
  - Upgrade to 4.17-2 tarball with the following release notes:
   - Add sites sampacs*.if.usp.br and cvmfs-*.hpc.swin.edu.au to MAJOR_CVMFS in
       squid/files/postinstall/squid.conf.proto.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.1
changelog:
  - Upgrade to 5.7-1 tarball with the following release notes:
   - Update to squid-5.7 with release notes at https://wiki.squid-cache.org/Squid-5 and
      http://www.squid-cache.org/Versions/v5/RELEASENOTES.html.
      Most important new feature in 5.7:
      - "Happy Eyeballs" feature uses the first destination IP address that responds
         from DNS, whether it is IPv4 (A records) or IPv6 (AAAA records). A consequence
         of this feature is that the dns_v4_first directive is no longer supported.
   - Add sites cvmfs-stratum-one.cc.kek.jp and cvmfs*.sdcc.bnl.gov
      to MAJOR_CVMFS in squid/files/postinstall/squid.conf.proto.
   - Remove obsolete frontier*.racf.bnl.gov from ATLAS_FRONTIER
      in squid/files/postinstall/squid.conf.proto.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.2
changelog:
  - Add pretrans scriplet to this spec file to fix problem with squid-4 to
     squid-5 upgrade where a link becomes a directory.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.3
changelog:
  - Complete the fix from 5.7-1.2. An additional work-around was needed
     for the squid-4 to squid-5 upgrade to change a directory that was generating
     yum transaction errors into a link, which silenced the errors.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.8-1.1
changelog:
  - Update to squid-5.8 with release notes at
      https://www.squid-cache.org/Versions/v5/squid-5.8-RELEASENOTES.html and announcement at
      http://lists.squid-cache.org/pipermail/squid-announce/2023-February/000145.html
      Most important new features in 5.8:
      - A predefined ACL named "to_linklocal" which matches traffic attempting to access
       link-local network services has been added. It is set to "deny" in
       squid/files/postinstall/squid.conf.proto.
      - Bug fixed where cache manager API erroneously returns "mgr_index" instead of requested
       data.
   - Add support for rpmbuild on el9
   - Add object-*.cloud to the computecanada portion of MAJOR_CVMFS in
      squid/files/postinstall/squid.conf.proto.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.8-2.1
changelog:
  - For EL9, in this spec file replace calls to obsolete "service" and add new package
     requirements.


author: Jason Patton <jpatton@cs.wisc.edu> - 0.8-1
changelog:
  - Python 3 compatibility
  - Credmon subprocess returns on parent exit
  - condor_who now reports credmon as Ready
  - Local issuer no longer refreshes tokens every loop


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.8.1-1.2
changelog:
  - Fix Python 3 bytes/str issue
    Added patch Open-temp-file-as-bytes-for-atomic_output-to-fix-str.patch


author: Matyas Selmeci <matyas@cs.wisc.edu> 1.3.0-1
changelog:
  - Add SELinux audit logs to osg-system-profiler and URL support to
    osg-system-profiler-viewer (SOFTWARE-2275)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.4.0-1
changelog:
  - Include dump of tomcat server config (SOFTWARE-1099)
  - Create osg-profile.txt in temp dir, do not include old profiles in
    directory dumps (SOFTWARE-1773)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.1-1
changelog:
  - Drop osg-version check (SOFTWARE-2916)
  - Update instructions for getting help (SOFTWARE-2908)
  - Don't include logs for deprecated software (SOFTWARE-2905)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.3-1
changelog:
  - Drop unused files:
      - httpcert.pem
      - tomcat config
      - edg-mkgridmap.log
      - bestman2 logs


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6.0-1
changelog:
  - Query multiple python executables, not just `which python` (which may not exist on EL8) (SOFTWARE-4146)


author: Dave Dykstra <dwd@fnal.gov> 1.7-1
changelog:
  - Require at least vault version 1.8.4
  - Remove support for coarse-grained kerberos; requires htgettoken >= 1.3
  - Use /etc/krb5-<name>.keytab if it exists even for the first defined
    kerberos service, in preference to /etc/krb5.keytab.
  - Update to vault-plugin-secrets-oauthapp 3.0.0
  - Update to vault-plugin-auth-jwt 0.11.1


author: Dave Dykstra <dwd@fnal.gov> 1.8-1
changelog:
  - Restore part of the setup of kerberos; too much was taken out in 1.7
  - When an issuer is deleted, clean out the policies and kerberos modules
    related to its roles
  - Make policy names more consistent with module names


author: Dave Dykstra <dwd@fnal.gov> 1.10-1
changelog:
  - Fix problem that /etc/krb5-<name>.keytab was preferred for first service
    only when the kerbservice was explicitly defined for an issuer.  Now it
    also works for default first kerberos service.


author: Dave Dykstra <dwd@fnal.gov> 1.12-1
changelog:
  - Require vault-1.10.0 and update vault-plugin-auth-jwt to version 0.12.1
    and vault-plugin-auth-ssh to version 0.1.1.


author: Dave Dykstra <dwd@fnal.gov> 1.13-1
changelog:
  - Remove support for old-style per issuer/role secret plugins.  Requires
    htgettoken >= 1.7.
  - Add ability to delete a previously defined configuration by using
    a keyword "delete:" under the configuration name and setting it to
    any value.
  - Update vault-plugin-auth-jwt to the latest commit (because the patches
    had been rebased on it).


author: Dave Dykstra <dwd@fnal.gov> 1.14-1
changelog:
  - Add auditlog configuration option.  As part of that, disable the
    vault systemd ProtectFull and ProtectHome options.
  - Require vault >= 1.12.1.
  - Update the vault-plugin-auth-jwt to the latest upstream commit.
  - Include gox in the source tarball.


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Update vault-plugin-secrets-oauthapp to 3.1.1 which adds support for token
    exchange at a /sts path instead of /creds.  Keep applying the PR patch
    that also adds it under /creds for a transition period until htgettoken
    is updated everywhere to use the new path.
  - Update vault-plugin-auth-jwt to 0.15.2.
  - Update vault-plugin-auth-ssh to 0.3.0.
  - Require vault >= 1.13.
  - Require diffutils.
  - Fix bug where the kerberos policydomain option was ignored.


