# changelog

author: Dave Dykstra <dwd@fnal.gov> 4.13-1.1
changelog:
  - Upgrade to 4.13-1 tarball with the following release notes:
   - Update to squid-4.13 with release announcement at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00117.html
      It includes a couple of relevant security advisories related to
      cache poisoning.
   - Remove patch for bug 5051 since it is included in the 4.13 release.
  - Remove the recursion on the restorecon for SELinux in the %post install
      step, to avoid taking a long time when going through a large cache.


author: Dave Dykstra <dwd@fnal.gov> 4.13-2.1
changelog:
  - Upgrade to 4.13-2 tarball with the following release note:
   - Move temporary logrotate config file to the log directory, to keep
     SELinux on CentOS8 happy.


author: Dave Dykstra <dwd@fnal.gov> 4.13-3.1
changelog:
  - Upgrade to 4.13-3 tarball with the following release notes:
   - Change log rotates to no longer use reconfigure signal but to instead
      set logfile_rotate to zero and use the rotate signal.  This is much
      lighter weight and works around squid bug #5113.  Administrators can
      still set logfile_rotate to non-default values, but it is used only
      by fn-local-squid.sh and overridden for squid.
   - With multiple squid services, send the rotate signal only once to each
      squid.
   - Add timestamps to squidcron.log for the beginning and end of rotation.
  - Remove el6 support


author: Dave Dykstra <dwd@fnal.gov> 4.13-4.1
changelog:
  - Increase shoal-agent version to 1.0.0.
  - Upgrade to 4.13-4 tarball with the following release notes:
   - Add Compute Canada stratum 1s to MAJOR_CVMFS
   - Add any parameters passed in by $SQUID_START_ARGS to the starting of
      squid.  This is set to --foreground by the OSG frontier-squid docker
      container.


author: Dave Dykstra <dwd@fnal.gov> 4.13-5.1
changelog:
  - Upgrade to 4.13-5 tarball with the following release notes:
   - Use /bin/bash instead of $SHELL in fn-local-squid.sh because $SHELL
      is sometimes set to /bin/nologin (in particular when the squid user
      directly invokes fn-local-squid.sh).  This affected cleaning out old
      cache files and starting shoal.
   - Do not attempt to set net.core.somaxconn higher than the kernel
      maximum of 65335.


author: Dave Dykstra <dwd@fnal.gov> 4.13-5.2
changelog:
  - Fix bad permissions on one of the shoal-agent dependency directories.
    Only caused a problem when rebuilding from src rpm.


author: Dave Dykstra <dwd@fnal.gov> 4.15-1.1
changelog:
  - Upgrade to 4.15-1 tarball with the following release notes:
   - Update to squid-4.15 with release announcement at
       http://lists.squid-cache.org/pipermail/squid-announce/2021-May/000127.html
      The update includes security fixes, and at least one (SQUID-2020:11)
      is relevant because it enables someone that is allowed by access
      controls to use squid for some purpose to bypass any other access
      controls and use it for any purpose.  That one can be worked around
      with "uri_whitespace deny", but other denial of service vulnerabilities
      fixed in this version have no workaround.
   - Set "uri_whitespace deny" by default to avoid any other related
      vulnerabilities in the future.
   - Exit with an error if either of the two required logfile_rotate entries
      are not in squid.conf.  This is for the protection of who are using
      SQUID_CUSTOMIZE=false and have not properly merged the changes from
      squid.conf.frontierdefault.
   - Update the customhelps.awk function setoption() to work correctly
      after a setoptionparameter().
   - Allow cache_dir null type which means no disk cache, for systems that
      have very large cache_mem and maximum_object_size_in_memory.


author: Dave Dykstra <dwd@fnal.gov> 4.15-1.2
changelog:
  - Filter out unneeded python3 dependency added by rpm's automatic
    dependency generation, by overriding /usr/lib/rpm/find-requires macro.


author: Dave Dykstra <dwd@fnal.gov> 0.3-1
changelog:
  - Rename make-downloads to make-source-tarball and make it have more
    in common with the vault-rpm build


author: Dave Dykstra <dwd@fnal.gov> 0.5-1
changelog:
  - Always reconfigure everything when systemd service is started, just don't
    disable/reenable oauthapp because that wipes out stored secrets.
  - Support multiple roles per issuer.


author: Dave Dykstra <dwd@fnal.gov> 0.6-1
changelog:
  - Update vault-plugin-secrets-oauthapp to version 1.10.1, including
      applying a bug fix for broken minimum_seconds option
  - Disable periodic refresh of credentials; make it be only on demand
  - Require at least vault-1.7.0


author: Dave Dykstra <dwd@fnal.gov> 0.7-1
changelog:
  - Update to vault-plugin-secrets-oauthapp version 2.0.0
  - Update to final version of PR for periodic refresh of credentials
  - Move the 'PartOf' rule in htvault-config.service to the correct section.
  - Prevent vault DB initialization failure from blocking future attempts.
  - Change to have vault listen on all interfaces with tls for port 8200,
    and to use port 8202 for non-tls localhost access.


author: Dave Dykstra <dwd@fnal.gov> 1.0-1
changelog:
  - Convert to using yaml files instead of shell variables to configure.
  - Only update the vault configuration for things that have changed in
    the configuration, and include removing things that have been removed.
  - Keep secrets off command line to hide them from 'ps'.
  - Require at least vault-1.7.1


author: Dave Dykstra <dwd@fnal.gov> 1.1-1
changelog:
  - Correctly disable secret oauth module instead of incorrect auth module
    when something changes requiring clearing out of old secrets.
  - Allow dashes in names by converting them in bash variables to
    underscores, and reject any other non-alphanumeric or underscore in
    names.
  - Fix bug in RFC8693 token exchange pull request to puppetlabs plugin
    which caused comma-separated scopes to get sent to the token issuer
    instead of space-separated scopes.


author: Edgar Fajardo <emfajard@ucsd.edu> 3.3-8
changelog:
  - Drop the setup.sh script no longer necessary in 3.4 (SOFTWARE-2676)
  - Drop the glexec subpackages since glexec is dropped in 3.4


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.4.3-1.2
changelog:
  - Add patch to backport https://github.com/xrootd/xrootd/pull/1644 ("Populate XrdSciTokens with more detailed log messages")


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.5.1-1.3
changelog:
  - Add logging patch (https://github.com/xrootd/xrootd/pull/1819)
  - Add patch reverting https://github.com/xrootd/xrootd/pull/1801


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.5.1-1.4
changelog:
  - Drop patch reverting https://github.com/xrootd/xrootd/pull/1801;
    instead add 1826-HTTP-TPC-PULL.patch which should fix the issue


author: Edgar Fajardo <efajardo@cern.ch> 1.1.0-1
changelog:
  Updated to the 1.1.0 release. It could not be a pass through build since the dist was missing in the Release entry in the spec file


author: Tim Theisen <tim@cs.wisc.edu> - 1.104-1
changelog:
  - Update to IGTF 1.114 (SOFTWARE-4965)
  - SOFTWARE-4965: Remove expired Let's Encrypt ROOT CA X3
  - SOFTWARE-4965: Remove expired Let's Encrypt ROOT CA X4


author: Dave Dykstra <dwd@fnal.gov> 0.2-1
changelog:
  - Allow for missing xdg-open
  - Add some missing "Exception as e" clauses
  - Create configdir if missing when needed
  - Change from jwt pip package to pyjwt, and disable verify_aud


author: Dave Dykstra <dwd@fnal.gov> 0.3-1
changelog:
  - Avoid including standard system libraries with pyinstaller
  - Increase timeout on web browser interaction to 5 minutes
  - Set up the interrupt signal to kill the program
  - Add BuildRequires for openssl-devel and swig
  - Remove confusing code for setting default cafile on RHEL and make setting
     the Debian default more clear


author: Dave Dykstra <dwd@fnal.gov> 0.4-1
changelog:
  - Support the new poll api in addition to the old device_wait api when
    waiting for authorization response
  - Use colon as separator in default secret path instead of hyphen
  - Add --scopes and --audience options
  - Implement the --minsecs option (was present before but didn't work)
  - Stop reading old bearer token and remove use of jwt package


author: Dave Dykstra <dwd@fnal.gov> 1.0-1
changelog:
  - Add --credkey option.
  - Add --vaultalias option.
  - Add --nokerberos and --kerbpath options.
  - Change the name of the --vaultrole option to --role; the short name -r
     remains unchanged.
  - Fill out the man page and add a html version of it to the source,
     generated by a Makefile.


author: Dave Dykstra <dwd@fnal.gov> 1.1-1
changelog:
  - Integrate with htcondor, including these changes:
   - Change --authpath option name to --oidcpath.
   - Add --noidc option.
   - Add --vaulttokenttl option.
   - Make --vaulttokenfile default to /dev/stdout if the ttl is more than
      a million seconds, and also require it to start with /dev/std or
      /dev/fd if the ttl is more than a million seconds.
   - Add --vaulttokeninfile option.
   - Add --nobearertoken option.
   - Add --showbearerurl option.
   - Send progress output to stderr if --vaulttokenfile is /dev/stdout or
       --showbearerurl option is enabled.
  - Use a separate version number for the python library downloads tarball.


author: Brian Lin <blin@cs.wisc.edu> - 0.8.1-1
changelog:
  - Add the --pw-store option to the invocation of oidc-add and add a default
    scope of blank if no scopes are configured.  These are needed for the
    CILogon issuer (SOFTWARE-4983).


author: Dave Dykstra <dwd@fnal.gov> - 2.10.0-1.1
changelog:
  - Re-apply fix for el8 pacparser build error by requiring python3, from
    https://github.com/cvmfs/cvmfs/pull/2986


author: Dave Dykstra <dwd@fnal.gov> - 1.0-1
changelog:
  - Use the same root / $CWD as the target process.  Without this, the
    authz process may utilize the incorrect file for target processes
    that are in a chroot or provide a relative path for the X509 proxy.


author: Dave Dykstra <dwd@fnal.gov> - 2.2-1
changelog:
  - Prevent exiting after the first token authentication
  - Close token file descriptor after use
  - Enable token debug messages
  - Implement WLCG bearer token discovery standard
  - Add libscitokens-dev build dependency on debian


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.4.1-0.rc2.osg
changelog:
  - Update to 5.4.1rc2 and merge OSG changes (SOFTWARE-4998, SOFTWARE-4999)
  - Update SOFTWARE-4870.voms-mapfile.patch


author: Brian Lin <blin@cs.wisc.edu> - 1.5.3-1
changelog:
  - Add default values for the number of blocks and threads used for
    writing in parallel
  - Add new ATLAS XCache default values for the write queue, block size,
    and the number of prefetch blocks
  - Disable additional ATLAS debugging by default


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.0.0-1
changelog:
  - Drop lcmaps config; use XrdVoms instead (from osg-xrootd 3.6)
  - Add overrides for xrootd-privileged@stash-origin-auth, and add
    cmsd-multiuser@.service for running an auth stash-origin with multiuser (SOFTWARE-4792)
  - Append contents of /run/stash-origin/Authfile.local and /run/stash-origin-auth/Authfile.local
    to generated /run/stash-origin/Authfile and /run/stash-origin-auth/Authfile,
    respectively


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.0.0-2
changelog:
  - Fix Python 3 bytes/str conversion errors (SOFTWARE-5019)
  - Always use Python 3 scripts; update dependencies for xcache-consistency-check
  - Fix xrootd_cache_stats.py library location issues (SOFTWARE-5019)


author: Carl Edquist <edquist@cs.wisc.edu> - 3.6-1
changelog:
  - Release for OSG 3.6 / XRootD 5 (SOFTWARE-4495)
  - Drop xrootd-lcmaps & vo-client-lcmaps-voms requirements


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.6-4
changelog:
  - Fix vomsxrd in http (SOFTWARE-4495)
  - Add missing authentication plugin packages
  - Add SciTokens config


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.6-8
changelog:
  - Add sample scitokens.conf file (SOFTWARE-4790)
    based on https://github.com/xrootd/xrootd/blob/v5.3.2/src/XrdSciTokens/configs/scitokens.cfg
  - Rename *-osg-vomsxrd.cfg to *-osg-xrdvoms.cfg (SOFTWARE-4495)
  - Change XrdVoms config to fall back to using a hash of the user's DN as the username if the DN can't be found in the mapfile (SOFTWARE-4495)
  - Replace deprecated http.* config with tls.* (SOFTWARE-4495)
  - Require TLS when using SciTokens
  - Move 50-osg-scitokens.cfg to osg-xrootd-standalone to avoid conflict with xcache packaging
  - Move scitokens.conf to osg-xrootd-standalone and mark it %config(noreplace)
  - Move xrootd-scitokens requirement to osg-xrootd-standalone since we don't distribute config for it in the base package


author: Brian Lin <blin@cs.wisc.edu> - 5.0.0-1
changelog:
  - Add Python 3 and EL8 support (HTCondor-13)
  - Whole node jobs (HTCondor batch systems only) now make use of GPUs (HTCONDOR-103)
  - Added `USE_CE_HOME_DIR` configuration variable (default: `False`) to allow users to enable setting `$HOME` in the
    routed job's environment based on the HTCondor-CE user's home directory
  - HTCondor-CE Central Collectors now prefer GSI over SSL authentication (HTCONDOR-237)
  - HTCondor-CE registry now validates the value of submitted client codes (HTCONDOR-241)
  - Automatically remove CE jobs that exceed their `maxWalltime` (if defined) or the configuration value of
    `ROUTED_JOB_MAX_TIME` (default: 4320 sec/72 hrs)
  - Remove circular HTCondor-CE View configuration definition (HTCONDOR-161)
  - Replace htcondor-ce package requirement with python2-condor for htcondor-ce-bdii


author: Mark Coatsworth <coatsworth@cs.wisc.edu> - 5.1.0-1
changelog:
  - Fix an issue where the CE removed running jobs prematurely (HTCONDOR-350)
  - Add optional job router transform syntax (HTCONDOR-243)
  - Add username and X.509 accounting group mapfiles for use by job router transforms (HTCONDOR-187)
  - Replace custom mappings in condor_mapfile with /etc/condor-ce/mapfiles.d/ (HTCONDOR-244)
  - Require regular expressions in the second field of the unified mapfile be enclosed by '/'(HTCONDOR-244)
  - Update maxWallTime logic to accept BatchRuntime (HTCONDOR-80)
  - Append SSL to the default authentication methods list (HTCONDOR-366)
  - APEL reporting scripts now use the local HTCondor's PER_JOB_HISTORY_DIR to collect job data. (HTCONDOR-293)
  - Use the `GlobalJobID` attribute as the APEL record `lrmsID` (#426)
  - Update HTCondor-CE registry app to Python 3 (HTCONDOR-307)
  - Enable SSL authentication by default for `READ`/`WRITE` authorization levels (HTCONDOR-366)
  - Downgrade errors in the configuration verification startup script to support routes written in the transform syntax (#465)
  - Allow required directories to be owned by non-`condor` groups (#451)
  - Fix an issue with an overly aggressive default `SYSTEM_PERIODIC_REMOVE` (HTCONDOR-350)
  - Fix incorrect path to Python 3 Collector plugin (HTCONDOR-400)
  - Fix faulty validation of `JOB_ROUTER_ROUTE_NAMES` and `JOB_ROUTER_ENTRIES` in the startup script (HTCONDOR-406)
  - Fix various Python 3 incompatibilities (#460)


author: Brian Lin <blin@cs.wisc.edu> - 5.1.1-1
changelog:
  - Improve restart time of HTCondor-CE View (HTCONDOR-420)
  - Fix bug that caused HTCondor-CE to ignore incoming BatchRuntime requests (#480)
  - Fix blahp packaging requirement (HTCONDOR-504)


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.2-1
changelog:
  - Fixed the default memory and CPU requests when using job router transforms
  - Apply default MaxJobs and MaxJobsIdle when using job router transforms
  - Improved SciTokens support in submission tools
  - Fixed --debug flag in condor_ce_run
  - Update configuration verification script to handle job router transforms
  - Corrected ownership of the HTCondor PER_JOBS_HISTORY_DIR
  - Fix bug passing maximum wall time requests to the local batch system


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.3-1
changelog:
  - The HTCondor-CE central collector requires SSL credentials from client CEs
  - Fix BDII crash if an HTCondor Access Point is not available
  - Fix formatting of APEL records that contain huge values
  - HTCondor-CE client mapfiles are not installed on the central collector


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.4-1
changelog:
  - Fix whole node job glidein CPUs and GPUs expressions that caused held jobs
  - Fix bug where default CERequirements were being ignored
  - Pass whole node request from GlideinWMS to the batch system
  - Since CentOS 8 has reached end of life, we build and test on Rocky Linux 8


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.5-1
changelog:
  - Rename AuthToken attributes in the routed job to better support accounting
  - Prevent GSI environment from pointing the job to the wrong certificates
  - Fix issue where HTCondor-CE would need port 9618 open to start up


author: Tim Theisen <tim@cs.wisc.edu> - 5.1.6-1
changelog:
  - HTCondor-CE now uses the C++ Collector plugin for payload job traceability
  - Fix HTCondor-CE mapfiles to be compliant with PCRE2 and HTCondor 9.10.0+
  - Add support for multiple APEL accounting scaling factors
  - Suppress spurious log message about a missing negotiator
  - Fix crash in HTCondor-CE View


author: Tim Theisen <tim@cs.wisc.edu> - 6.0.0-1
changelog:
  - Align HTCondor-CE security configuration with HTCondor defaults
  - Add example configuration on how to ban users
  - Add condor_ce_transform_ads command
  - Improve essential directory checking and creation at startup


author: Dave Dykstra <dwd@fnal.gov> 1.5-1
changelog:
  - Require at least vault version 1.8.2
  - Update to vault-plugin-auth-jwt to the master branch at the time of the
    0.10.1 tag of the release-1.8 branch
  - Update to vault-plugin-secrets-oauthapp 3.0.0-beta.3 and use its new
    feature of combining all providers in a single plugin process
  - Include vault-plugin-secrets-oauthapp PR #64 which enables a default
    "legacy" server so older versions of htgettoken can still work.
  - Reconfigure kerberos if the service name changes.
  - Add a "kerbservice" issuers keyword to select non-default kerberos service
    for a particular issuer
  - Immediately fail with a clear message if there's a duplicate name in a
    configuration list
  - Allow vault tokens to read auth/token/lookup-self so clients can look up
    the remaining time to live on the tokens


author: Dave Dykstra <dwd@fnal.gov> 1.7-1
changelog:
  - Require at least vault version 1.8.4
  - Remove support for coarse-grained kerberos; requires htgettoken >= 1.3
  - Use /etc/krb5-<name>.keytab if it exists even for the first defined
    kerberos service, in preference to /etc/krb5.keytab.
  - Update to vault-plugin-secrets-oauthapp 3.0.0
  - Update to vault-plugin-auth-jwt 0.11.1


author: Dave Dykstra <dwd@fnal.gov> 1.8-1
changelog:
  - Restore part of the setup of kerberos; too much was taken out in 1.7
  - When an issuer is deleted, clean out the policies and kerberos modules
    related to its roles
  - Make policy names more consistent with module names


author: Dave Dykstra <dwd@fnal.gov> 1.10-1
changelog:
  - Fix problem that /etc/krb5-<name>.keytab was preferred for first service
    only when the kerbservice was explicitly defined for an issuer.  Now it
    also works for default first kerberos service.


author: Dave Dykstra <dwd@fnal.gov> 1.12-1
changelog:
  - Require vault-1.10.0 and update vault-plugin-auth-jwt to version 0.12.1
    and vault-plugin-auth-ssh to version 0.1.1.


author: Dave Dykstra <dwd@fnal.gov> 1.13-1
changelog:
  - Remove support for old-style per issuer/role secret plugins.  Requires
    htgettoken >= 1.7.
  - Add ability to delete a previously defined configuration by using
    a keyword "delete:" under the configuration name and setting it to
    any value.
  - Update vault-plugin-auth-jwt to the latest commit (because the patches
    had been rebased on it).


author: Dave Dykstra <dwd@fnal.gov> 1.14-1
changelog:
  - Add auditlog configuration option.  As part of that, disable the
    vault systemd ProtectFull and ProtectHome options.
  - Require vault >= 1.12.1.
  - Update the vault-plugin-auth-jwt to the latest upstream commit.
  - Include gox in the source tarball.


author: Brian Lin <blin@cs.wisc.edu> - 3.5-2
changelog:
  - Add Blahp location and Gratia cleanup configuration (SOFTWARE-3813)
  - Remove deprecated and 32-bit requirements
  - Add Ansible requirement (SOFTWARE-3813)
  - Add tools that automatically update WN tarball, CAs, and CRLs on the
  remote head node (SOFTWARE-3582)


author: Carl Edquist <edquist@cs.wisc.edu> - 3.5-3
changelog:
  - Add schedd cron config for gratia probe (SOFTWARE-3841)
  - Drop ansible requirement (SOFTWARE-3920)


author: Carl Edquist <edquist@cs.wisc.edu> - 3.5-5
changelog:
  - Add SCHEDD_CRON_GRATIA_ARGS to 51-gratia.conf (SOFTWARE-3973)
  - Move 51-gratia.conf to bosco subpackage


author: Brian Lin <blin@cs.wisc.edu> - 3.6-1
changelog:
  - Remove stale provides/obsoletes (SOFTWARE-4469)
  - Use gratia-probe-htcondor-ce across all batch systems (SOFTWARE-3819, SOFTWARE-4469)
  - Drop LCMAPS requirements (SOFTWARE-4469)
  - Remove Gratia-specific configurations (SOFTWARE-4490)


author: Brian Lin <blin@cs.wisc.edu> - 3.6-5
changelog:
  - Add OSG release series SchedD attribute (SOFTWARE-4984)
  - Remove upstreamed blahpd location configuration (SOFTWARE-4984)


author: Carl Edquist <edquist@cs.wisc.edu> - 0.8.2-1
changelog:
  - Increase renewal frequency to ensure continual validity (SOFTWARE-5137)
  - Fix password file handling for restricted permissions in setup script (#17)
  - Use newer --pw-file option for oidc-add (SOFTWARE-5050)
  - Bump version requirement for oidc-agent package (SOFTWARE-5050)


author: Brian Lin <blin@cs.wisc.edu> - 113-1
changelog:
  - Add new CLAS12/EIC VO certificates (SOFTWARE-4666)
  - Retire old CLAS12/EIC VO certificates (SOFTWARE-4666)
  - Disable new ATLAS/CMS IAM endpoints (SOFTWARE-4666)


author: Brian Lin <blin@cs.wisc.edu> - 114-1
changelog:
  - Fix typo in CLAS12 and EIC VOMS certificate issuers (SOFTWARE-4701)
  - Add LSC files for CERN VO IAM endpoints (SOFTWARE-4595, SOFTWARE-4576, SOFTWARE-4695)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.2.1-1
changelog:
  - Allow specifying the xrootd instance (e.g. stash-cache, stash-origin-auth) to
    authfile-update (SOFTWARE-5028)
  - Split stash-origin's "originexport" var into "PublicOriginExport" and
    "AuthOriginExport" (SOFTWARE-5303)
  - Append contents of a "scitokens.conf.local" file to generated scitokens.conf (SOFTWARE-5315)
  - Includes Fri Sep 02 2022 Carl Edquist <edquist@cs.wisc.edu>:
      - Generate authfile even if origin serves no public data (SOFTWARE-5028)
      - Refactor stash-authfile systemd files


author: Dave Dykstra <dwd@fnal.gov> 1.7.1-1
changelog:
  - Update to upstream 1.7.1.  Add patch for el7 to allow go 1.15.5.
  - Stop disabling vault service on upgrade.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.4-1
changelog:
  - Add --dry-run option to update-all-remote-wn-clients script
  - Allow more characters in endpoint names in endpoints.ini


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.6-1
changelog:
  - Have update-all-remote-wn-ce run updaters with a timeout (SOFTWARE-4081)
  - If one update fails, keep going with the other updates instead of bailing out


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.8-1
changelog:
  - Download osg-ca-manage from GitHub instead of using a tarball client for fetching CAs (SOFTWARE-4242)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.11-1
changelog:
  - Generalize cvmfsexec-osg-wrapper (SOFTWARE-4722)
  - Have make-cvmfsexec-tarball generate a multiplatform tarball


author: Dave Dykstra <dwd@fnal.gov> 1.8-1
changelog:
  - If kerberos initialization fails with the default KRB5_CONFIG="", try
    again without it.  Observed to be needed at CNAF, although not for
    FNAL, CERN, or LIGO.  Don't do second try if the first error was due
    to an expired ticket, because that sometimes erroneously succeeds on
    second try.


author: Dave Dykstra <dwd@fnal.gov> 1.9-1
changelog:
  - Add support for ssh-agent authentication, including the --sshpath, 
    --nossh and --registerssh options.  Add the paramiko package to the
    included library packages.
  - Remove "/login" from --kerbpath.


author: Dave Dykstra <dwd@fnal.gov> 1.10-1
changelog:
  - Write out vault tokens after kerberos or ssh authentication only
    if they can successfully be used to read a bearer token
  - Change the oidc authentication prompt to say to "copy/paste into any web
    browser" instead of "open URL manually"
  - Update python dependencies to current versions in pip


author: Dave Dykstra <dwd@fnal.gov> 1.13-1
changelog:
  - Disable kerberos reverse DNS lookup in order to work when the vault
    server is using a DNS alias.
  - Intelligently handle multiple IP addresses in a DNS name, timing out
    connection attempts after 5 seconds and not reusing addresses that
    failed to connect.  Tries IPv4 before IPv6.
  - Update python dependencies to current versions in pip.


author: Dave Dykstra <dwd@fnal.gov> 1.13-2
changelog:
  - Suppress python warnings in order to avoid CryptographyDeprecationWarning
    about python3.6 being deprecated.


author: Dave Dykstra <dwd@fnal.gov> 1.14-1
changelog:
  - Support wildcard host certs for all https connections.  They used to be
    supported for everything but the --vaultalias option but that support 
    was broken in version 1.13.


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Revert to prior method for allowing --vaultalias as an alternate name
    for matching the host cert.  It doesn't support wildcard certs, but it
    permits allowing either the original host name or the alias and avoids
    needing separate alias options for kerberos and https.


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Fix httokendecode -H functionality to only attempt to convert a parsed word
    if it is entirely numeric, not if it just contains one digit.  At the same
    time, rewrite the functionality in native bash instead of using grep and sed.
  - Add htdestroytoken command.
  - Add a symlink htdecodetoken pointing to httokendecode.


author: Brian Lin <blin@cs.wisc.edu> - 5.5.1-1.11
changelog:
  - Further updates to the redirector hostname patch (SOFTWARE-5418.redirector-hostnames.patch) (SOFTWARE-5418)
  - Drop 1868-env-hostname-override.patch, it is included in the above patch.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.5.1-1.13
changelog:
  - Replace SOFTWARE-5418.redirector-hostnames.patch with an updated 1868-env-hostname-override.patch (SOFTWARE-5414/SOFTWARE-5418)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.5.3-1.2
changelog:
  - Update to 5.5.3-1 from upstream and merge OSG patches (SOFTWARE-5436):
    - Drop 1826-HTTP-TPC-PULL.patch (upstreamed)
    - Drop voms-mapfile-handle-missing-role.patch (upstreamed)
  - Add 1918-Fix-direct-read-for-PFC.patch
  - Add 1920-XrdHttp-Fix-byte-range-requests.patch
  - Disable compat build on EL9


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.5.4-1.1
changelog:
  - Update to 5.5.4-1 from upstream and merge OSG changes (SOFTWARE-5539)
    - Drop 1918-Fix-direct-read-for-PFC.patch (upstreamed)
    - Drop 1920-XrdHttp-Fix-byte-range-requests.patch (upstreamed)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 2.1.0-0.14.rc2.4
changelog:
  - Fix voms_install_db cert parsing to deal with OpenSSL 1.1+ format and "Let's Encrypt" (SOFTWARE-4882)
    - Add 4882-voms_install_db-cert-parsing.patch


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 2.1.0-0.14.rc2.5
changelog:
  - Increase default key size to 2048 bits in voms-proxy-direct (SOFTWARE-4889)
    - Add Set-default-key-size-to-2048-bits-in-voms-proxy-dire.patch


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.6-12
changelog:
  - Set grid-mapfile location (http.gridmap and -gridmap in sec.protocol gsi)
    to the standard location (SOFTWARE-4937)


author: Diego Davila <didavila@ucsd.edu> 3.6-14
changelog:
  - Configure Xrootd to send caching monitoring data (SOFTWARE-5026)
  - Make the ShovelerHostPort variable to use as the monitoring collector if there is a shoveler


author: Matyas Selmeci <matyas@cs.wisc.edu> 1.3.0-1
changelog:
  - Add SELinux audit logs to osg-system-profiler and URL support to
    osg-system-profiler-viewer (SOFTWARE-2275)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.4.0-1
changelog:
  - Include dump of tomcat server config (SOFTWARE-1099)
  - Create osg-profile.txt in temp dir, do not include old profiles in
    directory dumps (SOFTWARE-1773)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.1-1
changelog:
  - Drop osg-version check (SOFTWARE-2916)
  - Update instructions for getting help (SOFTWARE-2908)
  - Don't include logs for deprecated software (SOFTWARE-2905)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.3-1
changelog:
  - Drop unused files:
      - httpcert.pem
      - tomcat config
      - edg-mkgridmap.log
      - bestman2 logs


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6.0-1
changelog:
  - Query multiple python executables, not just `which python` (which may not exist on EL8) (SOFTWARE-4146)


author: Brian Lin <blin@cs.wisc.edu> 2.0.0-1
changelog:
  - Add GPU support (#12)
  - Improve multi-node support for Slurm (HTCONDOR-166)
  - More efficient status queries for Slurm (HTCONDOR-104)
  - More robust job ID extraction from SLurm (HTCONDOR-259)
  - Better interfacing with PBS and Slurm
  - More Python 3 fixes for PBS and Slurm scripts
  - Convert LSF script to Python 3 (HTCONDOR-333, #34)
  - Add Debian build files


author: Tim Theisen <tim@cs.wisc.edu> 2.0.1-1
changelog:
  - Convert to pure Python 3 (no Python 2 compatibility)
  - Restore blah_libexec_directory to the blah.config file


author: Tim Theisen <tim@cs.wisc.edu> 2.1.0-1
changelog:
  - Fix bug where GPU request was not passed onto the batch script
  - Fix problem where proxy symlinks were not cleaned up by not creating them
  - Fix bug where output files are overwritten if no transfer output remap
  - Added support for passing in extra submit arguments from the job ad


author: Tim Theisen <tim@cs.wisc.edu> 2.1.1-1
changelog:
  - Add Python 2 support back for Enterprise Linux 7
  - Allow the user to override system configuration files
  - Enable flexible configuration via a configuration directory
  - Fix Slurm resource usage reporting


author: Tim Theisen <tim@cs.wisc.edu> 2.1.4-1
changelog:
  - Report AllocCPUS of Slurm jobs in status result
  - Disable email notifications for blahp->condor jobs


author: Dave Dykstra <dwd@fnal.gov> 1.14-1
changelog:
  - Limit the number of proxy levels stripped off of %certsubject to 5.
    This is to catch programming errors where people call voms-proxy-init
    -noregen after every call to cigetcert, even when cigetcert determines
    that the previous proxy can be reused.


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Fix bug that caused the proxy to be stored into MyProxy under the DN
    of a previous certificate (if it existed but could not be reused)
    rather than the newly generated one.


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Fix typo in the variable name added in the last version.  This was
    not noticed because it was caught in an exception and caused it to
    always behave as if a previous proxy stored in myproxy could not be
    used.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Make source code completely compatible with python3
  - Fix check for more than 5 proxy levels to apply when verbose option
    is not set


author: Dave Dykstra <dwd@fnal.gov> 1.19-1
changelog:
  - Add setup.py for making a standard python installation
  - Use ssl.get_default_verify_paths() to find default CA paths, when possible
  - Make --listinstitutions compatible with python3


author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Add make sources target for koji build
  - Add make srpm target for copr build
  - Support port numbers in https urls
  - Return all received cookies in the final getcert step
  - Add sending Server Name Indication on https connections


author: Dave Dykstra <dwd@fnal.gov> 1.17-1
changelog:
  - Fix the usage of getaddrinfo, which caused a fatal error on python3.9
    on Mac.
  - Make --showbearerurl work properly in combination with --nobearertoken.
  - Change the httokendecode error message for a missing token file to
    stderr instead of stdin.


author: Dave Dykstra <dwd@fnal.gov> - 3.1.1-1
changelog:
  - Rename request.py to cert_request.py
  - Move common crypto code to cert_utils.py
  - Change permissions on generated keys to 644
  - Make -k and -c required in osg-incommon-cert-request, with no default
  - Expand tildes in --cert= and --key= osg-incommon-cert-request options
  - Immediately fail osg-incommon-cert-request if InCommon authentication fails


author: Jeny Teheran <jteheran@fnal.gov> - 3.2.0
changelog:
  - Change -f/--hostfile to -F/--hostfile
  - Change -T/--test to -t/--test
  - Switch argparsing to ArgumentParser
  - Validate if filepath exists and can be read at the ArgumentParser
  - Stop wrapping text messages
  - Include the program name in error messages
  - Show message per certificate when request or retrieval fails
  - Increased the number of retries for certificate retrieval


author: Jeny Teheran <jteheran@fnal.gov> - 3.2.1
changelog:
  - Add man page for osg-incommon-cert-request
  - Add .html version of man page for osg-incommon-cert-request


author: Jeny Teheran <jteheran@fnal.gov> - 3.2.2
changelog:
  - Fix format error for message when retrieval times out
  - Increased the wait time between retrieval attempts
  - Improve formatting of osg-incommon-cert-request man page


author: Dave Dykstra <dwd@fnal.gov> - 3.3.0
changelog:
  - Bump to new middle version number because of the new -O/--orgid option.
  - Slightly reorganize the man page documentation of the new option.


author: Bruno Coimbra <coimbra@fnal.gov> - 3.9.2-1
changelog:
  - GlideinWMS v3.9.2
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_9_2/history.html
  - Release candidates: 3.9.2-0.1.rc1 to 3.9.2-0.5.rc5


author: Dennis Box <dbox@fnal.gov> - 3.7.5
changelog:
  - Glideinwms v3.7.5
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_7_5/history.html
  - Release candidates 3.7.5-01.rc1 to  3.7.5-06.rc6


author: Bruno Coimbra <coimbra@fnal.gov> - 3.9.3
changelog:
  - Glideinwms v3.9.3
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_9_3/history.html
  - Release candidates 3.9.3-01.rc1


author: Dennis Box <dbox@fnal.gov> - 3.7.6
changelog:
  - Glideinwms v3.7.5
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_7_6/history.html
  - Release candidates 3.7.5-01.rc1 to  3.7.5-01.rc2


author: Bruno Coimbra <coimbra@fnal.gov> - 3.9.4
changelog:
  - Glideinwms v3.9.4
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_9_4/history.html
  - Release candidates 3.9.4-01.rc1 to 3.9.4-01.rc5


author: Bruno Coimbra <coimbra@fnal.gov> - 3.9.5
changelog:
  - Glideinwms v3.9.5
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_9_5/history.html
  - Release candidates 3.9.5-01.rc1 to 3.9.5-03.rc3


author: Marco Mambelli <marcom@fnal.gov> - 3.9.6
changelog:
  - Glideinwms v3.9.6
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_9_6/history.html
  - Release candidates 3.9.6-01.rc1 to 3.9.6-06.rc6


author: Marco Mambelli <marcom@fnal.gov> - 3.10.0
changelog:
  - Glideinwms v3.10.0
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_0/history.html
  - Release candidates 3.10.0-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.1
changelog:
  - Glideinwms v3.10.1
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_1/history.html
  - Release candidates 3.10.1-01.rc1


author: Dave Dykstra <dwd@fnal.gov> 1.6-1
changelog:
  - Try a default cafile of '/etc/pki/tls/cert.pem' if system default is empty.
    This can happen when the SSL_CERT_FILE environment variable is empty.


author: Dave Dykstra <dwd@fnal.gov> 1.7-1
changelog:
  - Start using new vault secrets plugin feature that allows it to be shared
     between all issuers.  Requires htvault-config >= 1.5.
  - Expand the --vaultalias option to also additionally allow that name
  -  in vault's host certificate.
  - Support finding python3 from PATH and not only /usr/bin
  - Support python38
  - Add httokendecode -H option
  - Fix bug that caused traceback when handling an error writing the credkey
  - Update python dependencies to current versions in pip


author: Tim Theisen <tim@cs.wisc.edu> - 8.9.13-1
changelog:
  - Host based security is no longer the default security model
  - Hardware accelerated integrity and AES encryption used by default
  - Normally, AES encryption is used for all communication and file transfers
  - Fallback to Triple-DES or Blowfish when interoperating with older versions
  - Simplified and automated new HTCondor installations
  - HTCondor now detects instances of multi-instance GPUs
  - Fixed memory leaks (collector updates in 8.9 could leak a few MB per day)
  - Many other enhancements and bug fixes, see version history for details


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.0-1
changelog:
  - Absent any configuration, HTCondor denies authorization to all users
  - AES encryption is used for all communication and file transfers by default
  - New IDTOKEN authentication method enables fine-grained authorization
  - IDTOKEN authentication method is designed to replace GSI
  - Improved support for GPUs, including machines with multiple GPUs
  - New condor_watch_q tool that efficiently provides live job status updates
  - Many improvements to the Python bindings
  - New Python bindings for DAGMan and chirp
  - Improved file transfer plugins supporting uploads and authentication
  - File transfer times are now recorded in the job log
  - Added support for jobs that need to acquire and use OAUTH tokens
  - Many memory footprint and performance improvements in DAGMan
  - Submitter ceilings can limit the number of jobs per user in a pool


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.1-1
changelog:
  - Fix problem where X.509 proxy refresh kills job when using AES encryption
  - Fix problem when jobs require a different machine after a failure
  - Fix problem where a job matched a machine it can't use, delaying job start
  - Fix exit code and retry checking when a job exits because of a signal
  - Fix a memory leak in the job router when a job is removed via job policy
  - Fixed the back-end support for the 'bosco_cluster --add' command
  - An updated Windows installer that supports IDTOKEN authentication


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.2-1
changelog:
  - HTCondor can be set up to use only FIPS 140-2 approved security functions
  - If the Singularity test fails, the job goes idle rather than getting held
  - Can divide GPU memory, when making multiple GPU entries for a single GPU
  - Startd and Schedd cron job maximum line length increased to 64k bytes
  - Added first class submit keywords for SciTokens
  - Fixed MUNGE authentication
  - Fixed Windows installer to work when the install location isn't C:\Condor


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.14-1
changelog:
  - Fix for security issue
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0003/


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.3-1
changelog:
  - Fixes for security issues
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0003/
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0004/


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.5-1
changelog:
  - Other authentication methods are tried if mapping fails using SciTokens
  - Fix rare crashes from successful condor_submit, which caused DAGMan issues
  - Fix bug where ExitCode attribute would be suppressed when OnExitHold fired
  - condor_who now suppresses spurious warnings coming from netstat
  - The online manual now has detailed instructions for installing on MacOS
  - Fix bug where misconfigured MIG devices confused condor_gpu_discovery
  - The transfer_checkpoint_file list may now include input files


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.6-1
changelog:
  - CUDA_VISIBLE_DEVICES can now contain GPU-<uuid> formatted values
  - Fixed a bug that caused jobs to fail when using newer Singularity versions
  - Fixed a bug in the Windows MSI installer for the latest Windows 10 version
  - Fixed bugs relating to the transfer of standard out and error logs
  - MacOS 11.x now reports as 10.16.x (which is better than reporting x.0)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 6.9.2-2
changelog:
  - Take new 10-stash-plugin.conf file from upstream (SOFTWARE-5350)
    (replace 10-stash-plugin.config with it, for consistency with upstream)


author: Diego Davila <didavila@ucsd.edu> - 3.5-3
changelog:
  - Changing "koji.chtc.wisc.edu" for "koji.opensciencegrid.org" (SOFTWARE-3863)
  - Fixing date issue on changelog Fri Feb 08 2018 -> Thu


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 6.0.0-1
changelog:
  - Update to 6.0.0.  This release adds Python 3 support and changes the
    statistics collector to collector.atlas-ml.org


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 6.1.0-1
changelog:
  - Update to 6.1.0.  This release changes the behavior of stashcp to use
    multiple caches and never go back to the origin.  (SOFTWARE-4255)


author: Dave Dykstra <dwd@fnal.gov> 1.2-1
changelog:
  - Fix working with a kerberos domain that is missing from krb5.conf
  - Extract more formatted information from http exceptions
  - Improve format of printed kerberos exceptions


author: Dave Dykstra <dwd@fnal.gov> 1.3-1
changelog:
  - Add --kerbprincipal option
  - Change the default kerbpath to include issuer and role
  - Limit oidc polling to 2 minutes
  - Disable oidc authentication when running in the background, that is, when
      none of stdin, stdout, or stderr are on a tty
  - Document that audience can be a comma or space separated list
  - Updated pip-installed dependent packages to latest versions


author: Dave Dykstra <dwd@fnal.gov> 1.4-1
changelog:
  - Add --vaulttokenminttl option
  - Add --web-open-command option, and default it to xdg-open only when
    $SSH_CLIENT is not set
  - Send the extra 'server' parameter recognized by htvault-config >= 1.5
    when --secretpath=secret/oauth/creds/%issuer/%credkey:%role, to use
    shared vault secrets instance (will be default later)
  - Use the new pyinstaller 4.5 exclude_system_libraries() function instead
    of the previous hack to exclude system libraries from being bundled


author: Brian Lin <blin@cs.wisc.edu> - 1.18.48-1
changelog:
  - Add an option for HTCondor batch system to expand references to $HOME in the job environment (#23)
  - Add efficient querying of LSF job statuses (#14)
  - Improve logic when proxy refresh is disabled (#24)
  - Fix invalid argument, output, and error format for HTCondor job submission (#22)


author: Dave Dykstra <dwd@fnal.gov> 1.13-1
changelog:
  - Choose a prefix for the temp output file in the same directory as the
    output file to avoid renaming across filesystems.


author: Brian Lin <blin@cs.wisc.edu> - 4.3.0-1
changelog:
  - Add the CE registry web application to the central collector. The
    registry provides an interface to OSG site administrators of
    HTCondor-CEs to retrieve an HTCondor IDTOKEN for authenticating
    pilot job submissions (#298, #299)
  - Identify broken job routes upon startup (#319)
  - Add benchmarking parameters to the BDII provider via HTCONDORCE_SPEC
    in the configuration. See /etc/condor-ce/config.d/99-ce-bdii.conf
    for examples (#311)
  - Fix handling of unmapped GSI users in the central collector (#317)
  - Fix reference to old BDII configuration values (#322)


author: Brian Lin <blin@cs.wisc.edu> - 4.4.0-1
changelog:
  - Add plug-in interface to HTCondor-CE View and separate out
    OSG-specific code and configuration (SOFTWARE-3963)
  - Add configuration option (COMPLETED_JOB_EXPIRATION) for how many
    days completed jobs may stay in the queue (SOFTWARE-4108)

  - Replace APEL uploader SchedD cron with init and systemd services
    (#323)
  - Fix HTCondor-CE View SchedD query that caused "Info" tables to be blank


author: Brian Lin <blin@cs.wisc.edu> - 4.4.1-1
changelog:
  - Fix a stacktrace with the BDII provider when `HTCONDORCE_SPEC` isn't
    defined in the local HTCondor configuration
  - Fixed a race condition that could result in removed jobs being put
    on hold
  - Improve performance of the HTCondor-CE View


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 4.4.1-2
changelog:
  - Change voms-clients-cpp requirement to voms-clients for non-OSG builds,
    because voms-clients-java works equally well


author: Brian Lin <blin@cs.wisc.edu> - 5.0.0-0.rc1
changelog:
  - Convert HTCondor-CE to Python 3 (#391, #397, #400, #402, #403, #404, #405,
    - Add USE_CE_HOME_DIR configuration to allow users to disable passing the CE
    users's HOME dir to the job on the worker node (#377)
  - RPM packaging fixes for default CE registry httpd configuration (#372)
  - Add CE View advertising of GPU job counts to the central collector (#381)
  - BDII: Reduce package dependencies of htcondor-ce-bdii (#384)
  - BDII: Add support for whitespace/comma separated local collectors (#375)


author: Jason Patton <jpatton@cs.wisc.edu> - 0.8-1
changelog:
  - Python 3 compatibility
  - Credmon subprocess returns on parent exit
  - condor_who now reports credmon as Ready
  - Local issuer no longer refreshes tokens every loop


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 0.8.1-1.2
changelog:
  - Fix Python 3 bytes/str issue
    Added patch Open-temp-file-as-bytes-for-atomic_output-to-fix-str.patch


author: Derek Weitzel <dweitzel@cse.unl.edu> - 1.3.1-1
changelog:
  - Fix dependency change of behavior in PyJWT
  - Add lifetime argument to scitokens-admin-create-token


author: Derek Weitzel <dweitzel@cse.unl.edu> - 1.5.0-1
changelog:
  - Include tests in distribution
  - Bump pyjwt version
  - Add test run with minimum dependencies
  - Run continuous integration on macOS and windows
  - Check verified claims for issuer in SciToken.serialize
  - Add base SciTokensException class
  - Remove verify=False keyword from calls to decode()
  - Print package list in CI jobs
  - Use python3_pkgversion macro in RPM package names
  - Move package version declaration into 'scitokens' module
  - Fix deprecation warning from cryptography.utils.int_from_bytes


author: Carl Edquist <edquist@cs.wisc.edu> - 0.5.0-1
changelog:
  - Build against xrootd 5.1 (SOFTWARE-4426)
  - Refactor how username is determined to match new behavior in xrootd 5.1 (#17)
  - Check for 'request.name' attribute before failing (#18)
  - Obtain username from passed env when SecEntity object not passed (#19)
  - Disable POSC when set in file open() (#20)


author: Derek Weitzel <dweitzel@unl.edu> - 1.0.0-1
changelog:
  - Wrap the OSS filesystem rather than SFS.  Available in XRootD 5.0+
  - Add checksum wrapper, only available in XRootD 5.2+


author: Derek Weitzel <dweitzel@unl.edu> - 2.0.0-1
changelog:
  - Add checksum library that saves to extended attributes
  - Add multiuser.checksumonwrite option to turn on checksumming the file while it is being written.


author: Carl Edquist <edquist@cs.wisc.edu> - 2.0.4-1
changelog:
  - Initialize crc32
  - Fix assert in el8 due to vector reserve
  - Reorder variables to address compiler warning/error


author: Carl Edquist <edquist@cs.wisc.edu> - 1.23.2-1
changelog:
  - Fix attribute list handling for QueueTime (#94) (SOFTWARE-4521)
  - Fix python3 int division in niceNum (#92)


author: Carl Edquist <edquist@cs.wisc.edu> - 2.1.0-1
changelog:
  - Get VO info from AuthToken (SciToken) attrs (SOFTWARE-4615)
  - Lock Version-Release across sub-packages (SOFTWARE-4667)
  - Move 99_gratia-ce.conf to /usr/share location (SOFTWARE-4611)
  - Fix exception handling in condor_meter (SOFTWARE-4711)
  - Fix missing log level (#107)
  - Add GHA workflow (SOFTWARE-4684)


author: Carl Edquist <edquist@cs.wisc.edu> - 2.2.0-1
changelog:
  - Drop xrootd-transfer probe (SOFTWARE-4520)
  - Update directory configuration for htcondor-ce probe (SOFTWARE-4621)


author: Carl Edquist <edquist@cs.wisc.edu> - 2.3.0-1
changelog:
  - Consolidate condor and old glideinwms probe into condor-ap (SOFTWARE-4846)
  - Add support for running HTCondor access point probe as a SchedD cron (SOFTWARE-4846)


author: Brian Lin <blin@cs.wisc.edu> - 2.3.1-1
changelog:
  - Fix SchedD cron path to HTCondor AP probe (SOFTWARE-4846)
  - Fix ownership of HTCondor AP directories (SOFTWARE-4846)
  - Fix case of Lockfile config name for HTCondor-CE and HTCondor AP
    probes (SOFTWARE-4621, SOFTWARE-4846)
  - Remove OSPool specific configuration in HTCondor AP ProbeConfig
    (SOFTWARE-4846)


author: Brian Lin <blin@cs.wisc.edu> - 2.3.2-1
changelog:
  - Fix PER_JOB_HISTORY_DIR configuration for HTCondor AP (SOFTWARE-4846)
  - Suppress payload job records by default for HTCondor APs (SOFTWARE-4846)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.0.1-1.1
changelog:
  - Build for OSG; add setuptools_scm build dependency (SOFTWARE-4877)
    Ignore byte-compile errors: they fail on Python 2 code in the examples


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.1.1-1
changelog:
  - Relax hostname validation in 40-siteinfo.ini (failing to resolve is now a warning) (SOFTWARE-3953)
  - No longer make resource_group mandatory for CEs in 40-siteinfo.ini (SOFTWARE-3949)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 3.11.0-1
changelog:
  - Add Pilot entries (SOFTWARE-4177)
  - Don't try to resolve Squid on the CE (SOFTWARE-4362)
  - Ignore all fetch-crl errors, but warn if no CRLs exist (SOFTWARE-4364)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.0.0-1
changelog:
  - Drop lcmaps-db-templates dependency (SOFTWARE-4503)
  - Turn osg-configure-misc into a dummy package (SOFTWARE-4507)
  - Rename 30-gip.ini to 31-cluster.ini and osg-configure-gip to osg-configure-cluster (SOFTWARE-4485)
  - Deprecate RSV  (SOFTWARE-4511)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.1.0-0.15
changelog:
  - Depend on /usr/bin/condor_remote_cluster instead of condor-bosco (SOFTWARE-4973)
  - Split libs into separate RPM
  - Add osg-ce-attributes-generator (SOFTWARE-4895)
  - Don't require base osg-configure package in osg-configure-siteinfo and osg-configure-cluster
    because they can also be used by osg-ce-attributes-generator
  - Advertise batch system used by bosco (SOFTWARE-3720)


author: Brian Lin <blin@cs.wisc.edu> 1.1.6-1
changelog:
  - Change software.grid.iu.edu to repo.grid.iu.edu in osg-ca-scripts (SOFTWARE-2666)
  - Remove unsupported compat links for old OpenSSL hashes
  - Added `ITB` options back to help text


author: Mats Rynge <rynge@isi.edu> 1.7-1
changelog:
  - Moved to the new ospool.osg-htc.org central managers in high
    availability setup
  - Removed pre-9.0 HTCondor config - this is no longer
    supported by the OSPool (IDTOKENS only)
  - Change the VO override to the lowercase "osg" (SOFTWARE-4905)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.8-1
changelog:
  - Include the package version in the schedd classad (SOFTWARE-5105)
  - Disable .sif images on 3.x kernels (OSPOOL-18)
  - Improve OS_VERSION handling
  - Drop Map* ProbeConfig overrides (SOFTWARE-5042)


author: Marco Mambelli <marcom@fnal.gov> - 3.6.5-1
changelog:
  - GlideinWMS v3.6.5
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_6_5/history.html
  - Release candidates: 3.6.5-0.1.rc1


author: Dennis Box <dbox@fnal.gov> - 3.7.1-1
changelog:
  - GlideinWMS v3.7.1
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_7_1/history.html
  - Release candidates: 3.7.1-0.1.rc1 to 3.7.1-0.7.rc9


author: Dennis Box <dbox@fnal.gov> - 3.7.2-1
changelog:
  - GlideinWMS v3.7.2
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_7_2/history.html
  - Release candidates: 3.7.0.1.rc1 to 3.7.2-0.3.rc3


author: Bruno Coimbra <coimbra@fnal.gov> - 3.9.1-1
changelog:
  - GlideinWMS v3.9.1
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_9_1/history.html
  - Release candidates: 3.9-0.1.rc1 to 3.9.1-0.5.rc6


author: Dennis Box <dbox@fnal.gov> - 3.7.3-1
changelog:
  - GlideinWMS v3.7.3
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_7_3/history.html
  - Release candidates: 3.7.3-01.rc1 .rc1 to


author: Brian Lin <blin@cs.wisc.edu> - 2.4.0-1
changelog:
  - Add gratia-probe-condor-batch, formerly gratia-probe-condor (SOFTWARE-4978)
  - Fix ownership of quarantine directories (SOFTWARE-4975)


author: Brian Lin <blin@cs.wisc.edu> - 2.5.0-1
changelog:
  - Fix record generation for HTCondor-CE with HTCondor batch systems
    (SOFTWARE-4978)
  - Remove condor-batch probe (SOFTWARE-4978)


author: Carl Edquist <edquist@cs.wisc.edu> - 2.5.2-1
changelog:
  - Delete Grid=Local jobs for htcondor-ce by default (SOFTWARE-4977)
  - Set MapUnknownToGroup in condor-ap ProbeConfig (SOFTWARE-5041)


author: Brian Lin <blin@cs.wisc.edu> - 4.2.1-1
changelog:
  - Drop vestigial central collector config generator
  - Fix unmapped GSI/SSL regexps and allow unmapped enttities to advertise to the central ceollector (SOFTWARE-3939)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.4.0-2
changelog:
  - Add python3-condor and python3-xrootd build dependencies so we don't build RPMs for repos
    which they can't be installed from.


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Update vault-plugin-secrets-oauthapp to 3.1.1 which adds support for token
    exchange at a /sts path instead of /creds.  Keep applying the PR patch
    that also adds it under /creds for a transition period until htgettoken
    is updated everywhere to use the new path.
  - Update vault-plugin-auth-jwt to 0.15.2.
  - Update vault-plugin-auth-ssh to 0.3.0.
  - Require vault >= 1.13.
  - Require diffutils.
  - Fix bug where the kerberos policydomain option was ignored.


author: Dave Dykstra <dwd@fnal.gov> 1.3-1
changelog:
  - Added license in COPYING file
  - Updated to vault-plugin-secrets-oauthapp-2.1.0
  - Updated the token exchange PR for vault-plugin-secrets-oauthapp to
      accept comma-separated lists of audiences
  - Added audit log at /var/log/htvault-config/auditlog
  - Enabled delayed log compression and daily logs instead of weekly
  - Add support for moving the master in a high-availability cluster from
    one machine to another and for changing the name of either peer
  - If 'name' is missing from a yaml list, give a helpful error message 
    instead of causing a python crash
  - Limit vault token policies for oidc and kerberos to a single role
    and issuer.  To use these limited policies for kerberos requires
    htgettoken >= 1.3 so for now the coarse-grained kerberos is still
    supported as well but it will be removed later.
  - Remove the default policy from vault tokens.


author: Dave Dykstra <dwd@fnal.gov> 1.4-1
changelog:
  - Updated the token exchange PR for vault-plugin-secrets-oauthapp to
      send the client secret in the initial authorization request in the
      device flow
  - Updated to vault-plugin-secrets-oauthapp-2.2.0


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.7-1
changelog:
  - Fix bug where condor_gpu_discovery could crash with older CUDA libraries
  - Fix bug where condor_watch_q would fail on machines with older kernels
  - condor_watch_q no longer has a limit on the number of job event log files
  - Fix bug where a startd could crash claiming a slot with p-slot preemption
  - Fix bug where a job start would not be recorded when a shadow reconnects


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.8-1
changelog:
  - Fix bug where huge values of ImageSize and others would end up negative
  - Fix bug in how MAX_JOBS_PER_OWNER applied to late materialization jobs
  - Fix bug where the schedd could choose a slot with insufficient disk space
  - Fix crash in ClassAd substr() function when the offset is out of range
  - Fix bug in Kerberos code that can crash on macOS and could leak memory
  - Fix bug where a job is ignored for 20 minutes if the startd claim fails


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.9-1
changelog:
  - Added Debian 11 (bullseye) as a supported platform
  - Since CentOS 8 has reached end of life, we build and test on Rocky Linux 8
  - The OAUTH credmon is now packaged for Enterprise Linux 8


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4-1
changelog:
  - Remove osg-release requirement; ignore missing compat packages; only try to
    update packages that are installed (SOFTWARE-2146)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6-1
changelog:
  - Replace references to OSG Twiki with links to current docs (SOFTWARE-3083)
  - Replace help email (SOFTWARE-3015)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.4.2-1
changelog:
  - Update to 5.4.2 and merge OSG changes (SOFTWARE-5072, SOFTWARE-5073)
  - Update SOFTWARE-4870.voms-mapfile.patch


author: Brian Lin <blin@cs.wisc.edu> - 5.4.2-1.1
changelog:
  - Move VOMS mapfile support to the source (SOFTWARE-4870)
  - Fix HTTP DN hashing
  - Add new throttling config for max open files and active connections


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.4.3-0.rc1.1
changelog:
  - Build from 5.4.3-rc1 and add OSG changes (SOFTWARE-5160)
  - Remove xrootd-multiuser < 0.6.0 conflict (SOFTWARE-5170)


author: Brian Lin <blin@cs.wisc.edu> - 1.7.0-1
changelog:
  - Reference test files using relative paths
  - Use shutil.move instead of os.rename
  - Add error message for when SciToken.discover doesn't find a token
  - SciToken.serialize: fix str/bytes mismatch
  - Add rpmbuild github actions workflow
  - Update the bogus url used in the tests
  - Fix bug decoding a token with no audience
  - Use unittest.mock to check UnableToCreateCache
  - Add obsoletes for smoother Yum updates on EL7
  - Update algorithm used to test UnsupportedKeyException
  - Run test suite using pytest during rpmbuild
  - Update pyjwt version in requirements.txt
  - small typo fix in readme
  - Default cached public keys set to 4 days


author: Carl Edquist <edquist@cs.wisc.edu> - 1.7.4-1
changelog:
  - bugfix release v1.7.4 (SOFTWARE-5446)
  - Attempt to fix codacy in github actions #159
  - Add pyproject.toml file for PEP 517 builds #162
  - Install requires setuptools #163
  - Add configuration for readthedocs #165
  - Add links to readthedocs in some places #166
  - Run pip list installed to show packages #168
  - Remove aud enforcement from deserialize function #167


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.16-1
changelog:
  - Fix for security issue
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0003


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.10-1
changelog:
  - Fixes for security issues
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0001
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0002
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0003


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.11-1
changelog:
  - The Job Router can now create an IDTOKEN for use by the job
  - Fix bug where a self-checkpointing job may erroneously be held
  - Fix bug where the Job Router could erroneously substitute a default value
  - Fix bug where a file transfer error may identify the wrong file
  - Fix bug where condor_ssh_to_job may fail to connect


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.12-1
changelog:
  - Fix bug in parallel universe that could cause the schedd to crash
  - Fix rare crash where a daemon tries to use a discarded security session


author: Carl Edquist <edquist@cs.wisc.edu> - 100-1
changelog:
  - Drop MIS VO (SOFTWARE-3575)
  - Map FNAL VO subgroups to the VO-wide target (SOFTWARE-4005)
  - New cert for GLOW (SOFTWARE-4006)
  - Replace one of the certs for OSG (SOFTWARE-4007)
  - Update Gluex cert for gryphn.phys.uconn.edu (SOFTWARE-4008)
  - Update voms2.fnal.gov DN for DES, DUNE, Fermilab (SOFTWARE-4012)
  - Drop CDF (SOFTWARE-4012)
  - Crosscheck script improvements


author: Carl Edquist <edquist@cs.wisc.edu> - 101-1
changelog:
  - Second round of InCommon subject DN changes (SOFTWARE-4018)
  - Add new GlueX DN (SOFTWARE-4008)
  - Drop obsolete GLOW cert
  - Update LZ DN for voms.hep.wisc.edu (SOFTWARE-4021)
  - Retire DOSAR (SOFTWARE-4019)


author: Carl Edquist <edquist@cs.wisc.edu> - 2.6.0-1
changelog:
  - Add SCHEDD_CRON_LOG_NON_ZERO_EXIT to htcondor-ce config (SOFTWARE-5150)
  - Remove certinfo errors/warnings (SOFTWARE-4980)
  - Replace AuthToken with routed job attrs (SOFTWARE-5185)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.22.1-1
changelog:
  - Add multi-site handling for osg-pilot-container probe (SOFTWARE-4386)
  - More python3 packaging fixes for el8 (SOFTWARE-4398)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.22.2-1
changelog:
  - Fix duration formatting in xml for python3 (SOFTWARE-4416)
  - Report partial jobs for osg pilot container probe (SOFTWARE-4404)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.23.1-1
changelog:
  - Add python2/3 compat for sge probe (SOFTWARE-4286)
  - Add 'QueueTime' collection (SOFTWARE-4479)
  - Add 'GratiaVersion' to UsageRecords (SOFTWARE-4455)


author: Carl Edquist <edquist@cs.wisc.edu> - 2.0.0-1
changelog:
  - Drop lots of probes for OSG 3.6 (SOFTWARE-4467)
  - Support running htcondor-ce probe under schedd cron (SOFTWARE-4490)
  - Fix python3 int division in niceNum
  - Fix QueueTime attribute handling


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.13-1
changelog:
  - Schedd and startd cron jobs can now log output upon non-zero exit
  - condor_config_val now produces correct syntax for multi-line values
  - The condor_run tool now reports submit errors and warnings to the terminal
  - Fix issue where Kerberos authentication would fail within DAGMan
  - Fix HTCondor startup failure with certain complex network configurations


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.14-1
changelog:
  - SciToken mapping failures are now recorded in the daemon logs
  - Fix bug that stopped file transfers when output and error are the same
  - Ensure that the Python bindings version matches the installed HTCondor
  - $(OPSYSANDVER) now expand properly in job transforms
  - Fix bug where context managed Python htcondor.SecMan sessions would crash
  - Fix bug where remote CPU times would rarely be set to zero


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.16-1
changelog:
  - Singularity now mounts /tmp and /var/tmp under the scratch directory
  - Fix bug where Singularity jobs go on hold at the first checkpoint
  - Fix bug where gridmanger deletes the X.509 proxy file instead of the copy
  - Fix file descriptor leak when using SciTokens for authentication


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.17-1
changelog:
  - Fix file descriptor leak when schedd fails to launch scheduler jobs
  - Fix failure to forward batch grid universe job's refreshed X.509 proxy
  - Fix DAGMan failure when the DONE keyword appeared in the JOB line
  - Fix HTCondor's handling of extremely large UIDs on Linux
  - Fix bug where OAUTH tokens lose their scope and audience upon refresh
  - Support for Apptainer in addition to Singularity


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.1-1
changelog:
  - Use --location argument to specify destination; use /etc or $OSG_LOCATION/etc if not specified (SOFTWARE-2527)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.3.0-1
changelog:
  - Add osg-release requirement
  - Allow taking osg repo definition from osg-release installed in a tarball client (SOFTWARE-2527)


author: Carl Edquist <edquist@cs.wisc.edu> - 2.6.3-1
changelog:
  - Restore ProbeConfig symlinks, and other dcache-transfer fixes (SOFTWARE-5241)
  - Replace default_prefix with _datadir; drop relocatable Prefixes


author: Carl Edquist <edquist@cs.wisc.edu> - 2.7.0-1
changelog:
  - Prefer CpusProvisioned over RequestCpus if set (SOFTWARE-5246)
  - Prefer MachineAttrGLIDEIN_ResourceName0 for ResourceName calculation;
  - Include GLIDEIN_ResourceName in SYSTEM_JOB_MACHINE_ATTRS (SOFTWARE-5249)


author: Dave Dykstra <dwd@fnal.gov> 1.13-1
changelog:
  - Remove support for old-style per issuer/role secret plugins.  Requires
     htgettoken >= 1.7.
   - Add ability to delete a previously defined configuration by using
     a keyword "delete:" under the configuration name and setting it to
     any value.
   - Update vault-plugin-auth-jwt to the latest commit (because the patches
     had been rebased on it).


author: Dave Dykstra <dwd@fnal.gov> 0.2-1
changelog:
  - Pre-download and prepare all the go modules using new make-downloads
    script, so no network is needed during rpm build.


author: Mátyás Selmeci <matyas@cs.wisc.edu> 2.3.1-1
changelog:
  - Replace info about GOC/OIM in 40-siteinfo.ini comments (SOFTWARE-3297)
  - More thoroughly disable WN proxy renewal in BLAHP config (SOFTWARE-3161)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 2.4.0-1
changelog:
  - Stop checking sponsor field in site information (SOFTWARE-3722)
  - Don't change batch system from slurm to pbs (SOFTWARE-3717)
  - Add option to configure blahp for PBS Pro (SOFTWARE-3674)
  - Stop osg-configure when a bad attribute is found (SOFTWARE-3581)
  - Own a section of the SSH config for bosco (SOFTWARE-3630)


author: Dave Dykstra <dwd@fnal.gov> 1.3-1
changelog:
  - Add --kerbprincipal option
  - Change the default kerbpath to include issuer and role
  - Limit oidc polling to 2 minutes
  - Disable oidc authenticatio when running in the background, that is, when
      none of stdin, stdout, or stderr are on a tty
  - Document that audience can be a comma or space separated list
  - Updated pip-installed dependent packages to latest versions


author: Carl Edquist <edquist@cs.wisc.edu> - 0.2-1
changelog:
  - Address code review comments (SOFTWARE-4719)
    - Improve config validation & error messages
    - Improve error handling; continue on errors
    - Increase the systemd timer frequency
  - Add README leftovers from usage doc (SOFTWARE-4763)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.22.0-1
changelog:
  - Initial release of osg-container-pilot probe (SOFTWARE-4169)
  - More el8 / python3 build fixes (SOFTWARE-4348)
  - Fix bug in cmd.communicate() handling of stderr (SOFTWARE-4348)


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.0-1.3
changelog:
  - Fix malformed default Bosco tarball URL format (HTCONDOR-433)
  - Fix autocluster problem (HTCONDOR-414)
  - Fix claim activation faiure (HTCONDOR-434)
  - Fix Bosco tarball extraction (HTCONDOR-438)


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.3-1
changelog:
  - Fixes for security issues
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0003.html
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0004.html


author: Tim Theisen <tim@cs.wisc.edu> - 9.0.4-1
changelog:
  - Fixes for security issues
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0003
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0004


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.13-1
changelog:
  - condor_ssh_to_job now maps CR and NL to work with editors like nano
  - Improved the performance of data transfer in condor_ssh_to_job
  - HA replication now accepts SHA-2 checksums to prepare for MD5 removal
  - Submission to NorduGrid ARC CE works with newer ARC CE versions
  - Fixed condor_annex crashes on platforms with newer compilers
  - Fixed "use feature: GPUsMonitor" to locate the monitor binary on Windows
  - Fixed a bug that prevented using the '@' character in an event log path


author: Dave Dykstra <dwd@fnal.gov> 4.15-2.1
changelog:
  - Upgrade to 4.15-2 tarball with the following release notes:
   - Fix SQUID_COMPRESS_LOGS=false, which was broken since 4.13-3.  Change
      it to also use the external logrotate command instead of the squid
      builtin log rotation.


author: Edita Kizinevic <edita.kizinevic@cern.ch> 4.17-1.1
changelog:
  - Upgrade to 4.17-1 tarball with the following release notes:
   - Update to squid-4.17.  Includes squid-4.16 with release announcement at
       http://lists.squid-cache.org/pipermail/squid-announce/2021-July/000134.html
      and squid-4.17 with release announcement at
       http://lists.squid-cache.org/pipermail/squid-announce/2021-October/000137.html
      The latter includes a security fix, but it is to code disabled in
      frontier-squid.
  - Avoid including standard system libraries with pyinstaller.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 4.17-2.1
changelog:
  - Upgrade to 4.17-2 tarball with the following release notes:
   - Add sites sampacs*.if.usp.br and cvmfs-*.hpc.swin.edu.au to MAJOR_CVMFS in
       squid/files/postinstall/squid.conf.proto.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.1
changelog:
  - Upgrade to 5.7-1 tarball with the following release notes:
   - Update to squid-5.7 with release notes at https://wiki.squid-cache.org/Squid-5 and
      http://www.squid-cache.org/Versions/v5/RELEASENOTES.html.
      Most important new feature in 5.7:
      - "Happy Eyeballs" feature uses the first destination IP address that responds
         from DNS, whether it is IPv4 (A records) or IPv6 (AAAA records). A consequence
         of this feature is that the dns_v4_first directive is no longer supported.
   - Add sites cvmfs-stratum-one.cc.kek.jp and cvmfs*.sdcc.bnl.gov
      to MAJOR_CVMFS in squid/files/postinstall/squid.conf.proto.
   - Remove obsolete frontier*.racf.bnl.gov from ATLAS_FRONTIER
      in squid/files/postinstall/squid.conf.proto.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.2
changelog:
  - Add pretrans scriplet to this spec file to fix problem with squid-4 to
     squid-5 upgrade where a link becomes a directory.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.7-1.3
changelog:
  - Complete the fix from 5.7-1.2. An additional work-around was needed
     for the squid-4 to squid-5 upgrade to change a directory that was generating
     yum transaction errors into a link, which silenced the errors.


author: Dave Dykstra <dwd@fnal.gov> 4.10-3.1
changelog:
  - Upgrade to 4.10-3 tarball with the following release notes:
   - Update patch for squid bug #5022 to final version.
   - Add patch for squid bug #5030 which reported that negative caching
      was not working.  This is an important feature for keeping load
      down on CVMFS stratum 1s that are not hosting a repository.


author: Dave Dykstra <dwd@fnal.gov> 4.10-4.1
changelog:
  - Upgrade to 4.10-4 tarball with the following release note:
   - Add patch for bug 5036 which caused a varying number of capital 'L's
      to appear at the beginning of access.log lines when the log buffer
      overflows.


author: Dave Dykstra <dwd@fnal.gov> 4.11-1.1
changelog:
  - Upgrade to 4.11-1 tarball with the following release notes:
   - Update to squid-4.11.  There's no announcement yet but the change log
      is at http://www.squid-cache.org/Versions/v4/changesets/.
   - Remove patches for bugs #5022 and #5036 which are in version 4.11. The
      patch for #5030 is still applied.


author: Dave Dykstra <dwd@fnal.gov> 4.11-2.1
changelog:
  - Upgrade to 4.11-2 tarball with the following release notes:
   - The 4.11 release announcement is now at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00108.html
      The announcement was delayed because security vulnerabilities were
      being double-checked.
   - frontier-squid was not susceptible to the ESI vulnerability, because of
      missing libraries on the build machine.  Add --disable-esi to make
      sure it doesn't get accidentally enabled.


author: Dave Dykstra <dwd@fnal.gov> 4.11-3.1
changelog:
  - Upgrade to 4.11-3 tarball with the following release notes:
   - Apply patch for bug #5051 which prevents a negative cache from
      persisting indefinitely with if-modified-since and collapsed forwarding.
   - Fix shoal when there are multiple squid workers.
   - Add cc.*\.in2p3\.fr to MAJOR_CVMFS.  It was already in ATLAS_FRONTIER
      so it was included for installations that accept both, but not for
      those that accept only MAJOR_CVMFS.


author: Dave Dykstra <dwd@fnal.gov> 4.11-4.1
changelog:
  - Upgrade to 4.11-4 tarball with the following release note:
    - Apply patch for bug #5041 which broke compilation in squid-4.11 on
      el7 with systemd.
  - Update rpm spec to build on el8.
  - Use python3 for shoal instead of python2 because that has the greatest
    portability across operating systems.  On el6, use the scl add-on
    package from Red Hat.  Apply a patch to shoal to work with python3.  
  - Pre-download python pip packages into shoal-downloads.tar.gz to include
    them in the src rpm.
  - Disable NIS basic-authentication on el8 because required header files
    are missing


author: Dave Dykstra <dwd@fnal.gov> 4.11-4.2
changelog:
  - Fix quoting on el6 build options to select the correct types of basic
    authentication.  The bug accidentally enabled ldap authentication which
    prevented an el6 rpm from installing on el7.
  - Remove openldap-devel build dependency.


author: Dave Dykstra <dwd@fnal.gov> 4.11-4.3
changelog:
  - Require systemd-devel on non-el6 systems, so squid's configure will
    recognize that it is on a systemd-based system.
  - Update to shoal-agent-0.9.9, and remove python3 patch because that
    is now merged.


author: Dave Dykstra <dwd@fnal.gov> 4.12-2.1
changelog:
  - Upgrade to 4.12-2 tarball with the following release notes (from 4.12-1
     and 4.12-2):
   - Update to squid-4.12 with release announcement at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00114.html
      It includes a couple of security advisories, but they are on
      features that as far as I know are not used by frontier-squid users.
   - Remove patches for bug #5030 and #5041 which are included in 4.12
   - Slightly update patch for bug #5051 as recommended by squid consultant
   - Note that an additional, more relevant squid advisory fixed in 4.12 was
      published late:
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00116.html
   - Support the "stdio:" prefix for access_log


author: Dave Dykstra <dwd@fnal.gov> 4.13-1.1
changelog:
  - Upgrade to 4.13-1tarball with the following release notes:
   - Update to squid-4.13 with release announcement at
       https://www.mail-archive.com/squid-announce@lists.squid-cache.org/msg00117.html
      It includes a couple of relevant security advisories related to
      cache poisoning.
   - Remove patch for bug 5051 since it is included in the 4.13 release.
  - Remove the recursion on the restorecon for SELinux in the %post install
      step, to avoid taking a long time when going through a large cache.


author: Brian Lin <blin@cs.wisc.edu.> - 2.8.4-1
changelog:
  - HTCondor AP and CE probes now drop privileges to the 'condor' user
    if run as 'root' (SOFTWARE-5531)
  - Improve logging and failure modes when encountering unwriteable
    directories (SOFTWARE-5531)


author: Dave Dykstra <dwd@fnal.gov> 1.11.1-1
changelog:
  - Update to upstream 1.11.1, which includes a fix to avoid denial of
    service on HA installation.
  - Remove $GOPATH/mod/*.* from the source tarball, leaving just
    $GOPATH/mod/cache/download.  That saves about 300M while still
    allowing offline builds.


author: Dave Dykstra <dwd@fnal.gov> - 2.1-1
changelog:
  - Merge LIGO changes to debian packaging
  - Move packaging/debian to debian and packaging/redhat to rpm, to work
    better with OBS and new OSG github packaging standard


author: Dave Dykstra <dwd@fnal.gov> - 2.2-1
changelog:
  - Just change the version number because the OSG github-source for
    reading spec files doesn't work with dash release tags.


author: Dave Dykstra <dwd@fnal.gov> - 2.3-1
changelog:
  - Change the changelog date on version 2.0.3 from Feb 28 2017 to
    May 28 2017 because osg-build complained about non-descending order
    of the dates.
  - Change the rpm/rpmbuild-cvmfs-config-osg development test script 
    to read from rpm instead of packaging/redhat.


author: Dave Dykstra <dwd@fnal.gov> - 2.4-1
changelog:
  - Change the server urls for the config-osg repository to use openhtc.io
    aliases when the proxy url can use DIRECT.


author: Dave Dykstra <dwd@fnal.gov> - 2.4-4
changelog:
  - Skipped release 2.4-2 and 2.4-3 to make consistent with cvmfs-config-egi.
  - Change Conflicts: cvmfs-config-default to Obsoletes: to make it
    easier to replace. Add Conflicts: cvmfs-config-egi because it
    is mutually exclusive.


author: Dave Dykstra <dwd@fnal.gov> - 2.5-1
changelog:
  - Update the configuration for the config repo to apply all the logic
    from the config repo's default.conf and common.conf.  That is, support
    USE_CVMFS_CDN and CVMFS_CLIENT_PROFILE and set default CVMFS_PAC_URLS
    covering the WLCG Web Proxy Auto Discovery.
  - Reverse the order of the fallback proxies because of the bug in 
    https://sft.its.cern.ch/jira/browse/CVM-1920


author: Dave Dykstra <dwd@fnal.gov> 1.8-1
changelog:
  - If kerberos initialization fails with the default KRB5_CONFIG="", try
      again without it.  Observed to be needed at CNAF, although not for
      FNAL, CERN, or LIGO.  Don't do second try if the first error was due
      to an expired ticket, because that sometimes erroneously succeeds on
      second try.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.6-9
changelog:
  - Replace RPM-GPG-KEY-OSG-3 with something that's accepted by rpm on both EL7 and EL9 (SOFTWARE-5408)


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.14-1
changelog:
  - Fix for security issue
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0003.html


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 4.2.3-1.1
changelog:
  - Update to 4.2.3-1 from upstream (SOFTWARE-4885)
  - Add Check-for-DT_REG-macro.patch to avoid compile error on EL7 due to missing DT_REG macro


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 8.9.11-1.4
changelog:
  - Add SOFTWARE-4525-condor_watch_q_crash.patch to fix a condor_watch_q crash when watching DAGs (SOFTWARE-4525)
  - Add HTCONDOR-315-Always-handle-exceptions-when-decoding-.patch to fix a schedd crash caused by malformed SciTokens (SOFTWARE-4533)


author: Dave Dykstra <dwd@fnal.gov> 1.5-1
changelog:
  - Require at least vault version 1.8.2
  - Update to vault-plugin-auth-jwt to the master branch at the time of the
      0.10.1 tag of the release-1.8 branch
  - Update to vault-plugin-secrets-oauthapp 3.0.0-beta.3 and use its new
    feature of combining all providers in a single plugin process
  - Include vault-plugin-secrets-oauthapp PR #64 which enables a default
    "legacy" server so older versions of htgettoken can still work.
  - Reconfigure kerberos if the service name changes.
  - Add a "kerbservice" issuers keyword to select non-default kerberos service
    for a particular issuer
  - Immediately fail with a clear message if there's a duplicate name in a
    configuration list
  - Allow vault tokens to read auth/token/lookup-self so clients can look up
    the remaining time to live on the tokens


author: Tim Theisen <tim@cs.wisc.edu> - 8.8.15-1
changelog:
  - Fix for security issue
  - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0003


