# changelog

author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.54.6-3.1
changelog:
  - Sync with 3.54.6-3
  - *** Upstream changelog ***
  - * Fri Jan 26 2024 Mark Syms <mark.syms@citrix.com> - 3.54.6-3
  - - Rebuild against libxenstore.so.4


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.54.9-1.1
changelog:
  - Sync with 3.54.9-1
  - *** Upstream changelog ***
  - * Thu Apr 25 2024 Mark Syms <mark.syms@citrix.com> - 3.54.9-1
  - - Address various memory management issues
  - * Wed Mar 27 2024 Mark Syms <mark.syms@citrix.com> - 3.54.8-1
  - - CP-48048: Blktap fix code coverage (XS8 only)
  - - tap-ctl: Improve list output filtering
  - - CP-46763: When VBD queue is not ready call the driver completion
  - - CP-46778: always issue request via issue_requests
  - - CP-46771: separate queue checks for completed and new requests.
  - - CP-46764: mask ring event handlers before quiescing the queue
  - - CP-46764: When the VBD is quiesced skip checking for requests to submit
  - - Fix setting of CFLAGS for mockatests
  - - Do not free iconv cd if allocation fails
  - - Fix the order of linker options in CBT
  - - Fixup various bits of incorrect automake usage
  - - CA-384162: Send completions for all partial responses
  - - CA-390490: allocate vhd request before locking bat
  - - CP-48057: Add unit tests for drivers/scheduler.c


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.55.4-1.1
changelog:
  - Sync with 3.55.4-1
  - *** Upstream changelog ***
    * Tue Dec 03 2024 Mark Syms <mark.syms@cloud.com> - 3.55.4-1
    - CA-392151 lcache.c uses wrong buffer size definition
    - CA-403297: when storing read-through do not mirror
    * Mon Nov 18 2024 Mark Syms <mark.syms@cloud.com> - 3.55.3-1
    - CP-52620: enable local caching after opening all other images
    * Tue Nov 05 2024 Tim Smith <tim.smith@cloud.com> - 3.55.2-1
    - CA-387575 Remove static libraries and libtool archives from devel package
    - Correct name of exposed NBD server
    - CA-401174 Filedescriptor leak in NBD option negotiation
    * Mon Sep 16 2024 Tim Smith <tim.smith@cloud.com> - 3.55.1-1
    - Redo the revert of an incorrect NBD FD leak fix
    * Fri Sep 13 2024 Tim Smith <tim.smith@cloud.com> - 3.55.0-1
    - CP-46765 - Fix asan issues in unit tests
    - CA-396659: rationalise bitops and fix overflow issues
    - CA-396659: delete legacy debt utility vhd-update
    - Handle scheduler uuid overflow explictly
    - CP-50952 Autodetect NBD server protocol version on client connect
    - Fix use of incorrect label in error case
    - CA-397082 Properly fix FD leak in NBD server
    - CP-50955 Add a new-style NBD server for each VDI
    * Tue Aug 06 2024 Mark Syms <mark.syms@cloud.com> - 3.54.10-1
    - CA-391882: fix nbd connection fd leak bug
    - Remove some unnecessary build dependencies


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 3.55.5-2.1
changelog:
  - Sync with 3.55.5-2
  - Drop patch "Add an option to never resolve parent path when vhd-util query is
  called" already included in upstream v3.55.5
  - *** Upstream changelog ***
    * Tue Feb 11 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-2
    - CA-404370: enable NBD client only after completing handshake
    * Mon Jan 06 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-1
    - Add an option to never resolve parent path when vhd-util query is called


author: Ronan Abhamon <ronan.abhamon@vates.tech> - 3.55.5-2.3
changelog:
  - Fix a bad integer conversion that interrupts valid coalesce calls on large VDIs
  - Add 0002-CP-308382-fix-sign-conversion-in-coalesce.patch
  - Add 0003-Fix-coalesced-size-conversion-in-vhd-util-coalesce.patch


author: Anthoine Bourgeois <anthoine.bourgeois@vates.tech> - 3.55.5-6.1
changelog:
  - Sync with 3.55.5-6
  - Revert openssl 3 dependency from XS specfile (no change compared to previous XCP-ng release)
  - Drop patch 0002-CP-308382-fix-sign-conversion-in-coalesce.patch, upstream now
  - Drop patch 0003-Fix-coalesced-size-conversion-in-vhd-util-coalesce.patch, upstream now
  - *** Upstream changelog ***
    * Thu Jul 31 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-6
    - Fix coalesced size conversion in vhd-util-coalesce (CP-308382)
    * Mon Jun 23 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-5
    - Backport fix for CA-408175
    - CP-308382: fix sign conversion in coalesce
    * Mon Apr 07 2025 Mark Syms <mark.syms@cloud.com> - 3.55.5-4
    - CP-54256: log when reporting EOPNOTSUPP
    * Fri Feb 21 2025 Deli Zhang <deli.zhang@cloud.com> - 3.55.5-3
    - CP-50273: Move CCM dependency to OpenSSL 3


author: Thierry Escande <thierry.escande@vates.tech> - 8.9.1-5.1
changelog:
  - Restore changes from original fc40 specfile
  - Add %bcond xcpng for specific XCP-ng build directives
  - Add %bcond build_minimal to disable libcurl-minimal package build
  - Update to curl v8.9.1 from el10 srpm
  - Port NSS cipher compat list patch and tests from XS8
  - Backport patch for CVE 2024-8096
  - *** Upstream changelog ***
    * Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 8.9.1-5
    - Bump release for October 2024 mass rebuild:
      Resolves: RHEL-64018
    * Mon Aug 19 2024 Jacek Migacz <jmigacz@redhat.com> - 8.9.1-4
    - correct indentation in test plan
    * Fri Aug 02 2024 Jacek Migacz <jmigacz@redhat.com> - 8.9.1-3
    - fix libcurl and libcurl-minimal conflict in test plan (RHEL-52103)
    * Fri Aug 02 2024 Jacek Migacz <jmigacz@redhat.com> - 8.9.1-2
    - add gating configuration (RHEL-52103)
    - sigpipe: init the struct so that first apply ignores (RHEL-53327)
    * Wed Jul 31 2024 Jacek Migacz <jmigacz@redhat.com> - 8.9.1-1
    - new upstream release (RHEL-50806)
    * Tue Jul 9 2024 Jacek Migacz <jmigacz@redhat.com> - 8.6.0-8
    - disable OpenSSL Engine API support (RHEL-30436)
    - setopt: Fix disabling all protocols (CVE-2024-2004)
    - http2: push headers better cleanup (CVE-2024-2398)
    * Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 8.6.0-7
    - Bump release for June 2024 mass rebuild
    * Mon Feb 12 2024 Jan Macku <jamacku@redhat.com> - 8.6.0-6
    - revert "receive max buffer" + add test case
    - temporarily disable test 0313
    - remove suggests of libcurl-minimal in curl-full
    * Mon Feb 12 2024 Jan Macku <jamacku@redhat.com> - 8.6.0-5
    - add Provides to curl-minimal
    * Wed Feb 07 2024 Jan Macku <jamacku@redhat.com> - 8.6.0-4
    - drop curl-minimal subpackage in favor of curl-full (#2262096)
    * Mon Feb 05 2024 Jan Macku <jamacku@redhat.com> - 8.6.0-3
    - ignore response body to HEAD requests


author: Philippe Coval <philippe.coval@vates.tech> - 3.3.29-10.1
changelog:
  - Remove installed gnutls-dane if no more supported
  - Remove unnecessary removal of non built files
  - Make c++ lib optional (disabled by default)


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 24.0.0-4.1
changelog:
  - Sync with 24.0.0-4
  - *** Upstream changelog ***
  - [mostly rebuilds]
  - * Mon Mar 18 2024 Rob Hoes <rob.hoes@citrix.com> - 24.0.0-1
  - - Re-release with new version number consistent with xapi's version scheme


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 24.1.0-2.1
changelog:
  - Sync with 24.1.0-2
  - *** Upstream changelog ***
  - * Thu Jun 06 2024 Ming Lu <ming.lu@cloud.com> - 24.1.0-2
  - - Bump release and rebuild
  - * Thu May 23 2024 Ming Lu <ming.lu@cloud.com> - 24.1.0-1
  - - CP-48969: log only first time that NVML can't be opened
  - - ci: update all actions


author: Ross Lagerwall <ross.lagerwall@citrix.com> - 2.22.20-6
changelog:
  - CA-386057: Enable legacy-rx by default to resolve performance issue
  - Note: 2.22.20-5 is for Yangtze


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 20240717-1
changelog:
  - Update to IPU 2024.3 release
  - As the archive from XS is missing an update for 06-a5-03 due to Intel
    initially forgetting to release its update, we manually package this file.


author: David Morel <david.morel@vates.tech> - 20250127-1
changelog:
  - Update to publicly released microcode-20250211
  - Security updates for:
      - INTEL-SA-01166
      - INTEL-SA-01213
      - INTEL-SA-01139
      - INTEL-SA-01228
  - Updates for multiple functional issues
  - Upstream update drops files for older Sapphire Rapids steppings, we kept the previous versions


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 20250501-1
changelog:
  - Update to publicly released microcode-20250512
  - Security updates for:
      - INTEL-SA-01153
      - INTEL-SA-01244
      - INTEL-SA-01247
      - INTEL-SA-01322
  - Updates for multiple functional issues
  - Upstream doesn't provide updates for older Sapphire Rapids steppings, we kept the last known versions


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 20250715-1
changelog:
  - Update to publicly released microcode-20250812
  - Security updates for:
      - INTEL-SA-01249
      - INTEL-SA-01308
      - INTEL-SA-01310
      - INTEL-SA-01311
      - INTEL-SA-01367
  - Updates for multiple functional issues
  - Upstream doesn't provide updates for older Sapphire Rapids steppings, we kept the last known versions


author: Gael Duperrey <gduperrey@vates.tech> - 20251029-1
changelog:
  - Update to Intel's publicly released microcode-20251111, based on XenServer's 20251029 release that has the same contents.
  - Updates for multiple functional issues
  - Upstream doesn't provide updates for older Sapphire Rapids steppings, we kept the last known versions


author: Gael Duperrey <gduperrey@vates.tech> - 20260115-1
changelog:
  - Update to Intel's publicly released microcode-20260210, based on XenServer's 20260115 release that has the same contents.
  - Security updates for:
   - Updated security updates for INTEL-SA-01083 originally published on Aug 13, 2024 INTEL-SA-01083
   - Security updates for INTEL-SA-01396
  - Updates for multiple functional issues


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.19-7
changelog:
  - Update IANA numbers
  - Apply patch from CentOS Stream, never applied upstream:
    Disable retry of pre-session "Get cipher suites" command as some
    BMCs are ignoring it (#1831158)
  - Apply patches from Debian, never applied upstream:
    - fix tsol buffer overflow,
      https://sourceforge.net/p/ipmitool/mailman/message/24405281/
    - fix non-analog sensor readings, https://sourceforge.net/p/ipmitool/bugs/490/
  - Update /var/run to /run in ipmievd.service that systemd warns about (#2100475)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-7
changelog:
  - ping hung when it cannot receive echo reply (#1362463)
  - arping documentation inconsistency (#1351704)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-9
changelog:
  - IPv4 vs IPv6 inconsistency on return value of ping (#1362388)
  - ping6 does not use device specified with -I parameter (#1371824, #1424965)
  - double cap_free call in ping_common.c (#1410114)
  - ping assumes EACCESS errors are due to broadcast addresses (#1387315)
  - ping -t with multicast address without effect on ppc64 (#1373333)
  - arping -c <n> does not exit when the device is deleted (#1387542)


author: Philippe Coval <philippe.coval@vates.tech> - 1.15.1-22.1
changelog:
  - Skip keyring tests if keyring blocked by seccomp
  - Add explicit dependency to gcc
  - Make build dependency to latex optionnal
  - Rebuild with openssl-3


author: Petr Menšík <pemensik@redhat.com> - 1.7.0-14
changelog:
  - Add only extra flags to default RPM LDFLAGS
  - Fix multilib conflict of ldns-config (#1463423)
  - Make primary python3 in primary build, python2 in optional


author: Philippe Coval <philippe.coval@vates.tech> 1.7.0-21.1
changelog:
  - Update obsolete %patch macro
  - Reconfigure if patches are touching autotools file
  - Add patch for openssl-3 support
  - Rebuild for openssl-3


author: Philippe Coval <philippe.coval@vates.tech> - 3.6.1-4.1
changelog:
  - Rebuild with openssl-3
  - Reapply changes from 3.3.3-1.1 on upstream base 3.6.1-4
    * Thu Aug 28 2025 Yann Dirson <yann.dirson@vates.tech> - 3.3.3-1.1
    - Refresh ldconfig cache on installation/removal
    * Thu Apr 30 2020 Ondrej Dubaj <odubaj@redhat.com> - 3.3.3-1
    - Rebase to version 3.3.3


author: Steve Dickson <steved@redhat.com> 2.0.18-1
changelog:
  - Updated to latest stable upstream version: 2.0.18-stable
  - Moved documentation into its own rpm (bz 810138)


author: Philippe Coval <philippe.coval@vates.tech> - 2.0.21-4.1
changelog:
  - Rebuild with openssl-compat-10
  - Make openssl optional (enabled by default)
  - Update legacy %patchN syntax for rpmspec
  - Add make and gcc to BuildRequires


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 7:2.02.180-15.1
changelog:
  - Cut the corosynclib-devel build dependency by disabling the cluster subpackage
  - Cut the dlm-devel build dependency by disabling the lockd subpackage


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 7:2.02.180-15.2
changelog:
  - Drop the obsolete lvm2-sm-config subpackage
  - It was unused, and it didn't require the right Release


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 7:2.02.180-16.1
changelog:
  - Rebase on 7:2.02.180-16
  - *** Upstream changelog ***
    * Fri Mar 22 2024 Mark Syms <mark.syms@citrix.com> - 7:2.02.180-16
    - CA-368585 Drop sm-config sub-package
    - CA-380627 Suppress errors when attempting to start services
    - CA-384527 add lvm filter to skip nbd device scan


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 7:2.02.180-18.1
changelog:
  - Rebase on 7:2.02.180-18
  - *** Upstream changelog ***
    * Thu Jul 11 2024 Lin Liu <Lin.Liu01@cloud.com> - 7:2.02.180-18
    - CP-46075: Disable cluster and cmirror as not used and introduce extra deps
    * Thu Jul 11 2024 Lin Liu <Lin.Liu01@cloud.com> - 7:2.02.180-17
    - CP-46075: Compatible with XS9


author: Mathieu Labourier <mathieu.labourier@vates.tech> - 7:2.02.180-18.2.1
changelog:
  - Rebase on 7:2.02.180-18.2
  - *** Upstream changelog ***
    * Thu May  1 2025 Mark Syms <mark.syms@cloud.com> - 7:2.02.180-18.2
    - Rebuild
    * Wed Apr 30 2025 Mark Syms <mark.syms@cloud.com> - 7:2.02.180-18.1
    - Update scan search root and add device filters


author: Ronan Abhamon <ronan.abhamon@vates.tech> - 7:2.02.180-18.3.1
changelog:
  - Rebase on 7:2.02.180-18.3
  - *** Upstream changelog ***
    * Wed Dec 03 2025 Mark Syms <mark.syms@citrix.com> - 7:2.02.180-18.3
    - CP-31079: update default configuration


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 5.7.2-51.1
changelog:
  - Rebase on XS8's 5.7.2-51
  - Undo most changes from snmp.xs.conf, which are related to a proprietary implementation


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 5.7.2-51.2
changelog:
  - Add net-snmp-5.7.2-no-XENSERVER-MIB.xcp-ng.patch
  - Remove XenServer-specific options from /etc/sysconfig/snmpd


author: Thierry Escande <thierry.escande@vates.tech> - 5.7.2-51.3
changelog:
  - Backport patches for CVE-2022-24805, CVE-2022-24806, CVE-2022-24807,
    CVE-2022-24808, CVE-2022-24809, CVE-2022-24810, and CVE-2022-44793


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 5.7.2-52.1
changelog:
  - Rebase on 5.7.2-52
  - Replace our patch by upstream identical one
  - *** Upstream changelog ***
    * Wed Jul 31 2024 Deli Zhang <deli.zhang@cloud.com> - 5.7.2-52
    - CA-393002: Fix CVE-2022-24805 and CVE-2022-24809 issues


author: Philippe Coval <philippe.coval@vates.tech> - 5.9.3-8.1
changelog:
  - Rebuild for openssl-3
  - Remove obsolete net-snmp-5.7.2-CVE-2022-24806.patch
  - Rebase on 5.9.3-8
  - *** Upstream changelog ***
    * Mon Jan 20 2025 Deli Zhang <deli.zhang@cloud.com> - 5.9.3-8
    - CP-50295: Add epoch 1 for XS 8

    * Fri Jan 17 2025 Chunjie Zhu <chunjie.zhu@cloud.com> - 5.9.3-7
    - CP-53263: Remove net-tools

    * Fri Jan 17 2025 Stephen Cheng <stephen.cheng@cloud.com> - 5.9.3-6
    - CP-53229: Remove chrpath

    * Thu Nov 21 2024 Stephen Cheng <stephen.cheng@cloud.com> - 5.9.3-5
    - CP-50538 Remove perl related packages
    - CP-50538 Remove selinux from BuildRequires

    * Fri Aug 23 2024 Deli Zhang <deli.zhang@cloud.com> - 5.9.3-4
    - CP-44169: Add XenServer SNMP Agent so
    - CP-44170: Update default settings
    - CP-44429: Move snmpd.xs.conf from xenserver-release
    - CP-44429: Improve service config

    * Tue Jul 30 2024 Deli Zhang <deli.zhang@cloud.com> - 5.9.3-3
    - CP-50122: Revert perl-srpm-macros require

    * Fri Jul 26 2024 Deli Zhang <deli.zhang@cloud.com> - 5.9.3-2
    - CP-50122: Replace redhat-rpm-config with xenserver-config-rpm in XS9

    * Mon Sep 04 2023 Lin Liu <lin.liu@citrix.com> - 5.9.3-1
    - First imported release


author: Alex Brett <alex.brett@cloud.com> - 7.4p1-23.1 + 0.10.3-2
changelog:
  - Imported openssh-7.4p1-23.el7_9 from CentOS, including:
  - Fix for CVE-2023-38408
  - Fix for CVE-2021-41617
  - Fix for CVE-2018-15473
  - Fix for CVE-2017-15906


author: Thierry Escande <thierry.escande@vates.tech> - 7.4p1-23.2.1 + 0.10.3-2.23.2.1
changelog:
  - Harden default ciphers and algorithms
  - Disable GSSAPIAuthentication in sshd_config
  - Remove build dependency on xauth (used for X11 forwarding not supported on XCP-ng hosts)
  - Make use of xcpng_subrel macro for versioning
  - Disable gnome_askpass
  - Add BuildRequires for gcc


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 7.4p1-23.3.1 + 0.10.3-2.23.3.1
changelog:
  - Sync with 7.4p1-23.3 + 0.10.3-2.23.3
  - *** Upstream changelog ***
  - * Tue Jul 02 2024 Ross Lagerwall <ross.lagerwall@citrix.com> - 7.4p1-23.3 + 0.10.3-2
  - - CP-50166: Remove libsystemd integration
  - - CA-395182: Fix CVE-2024-6387 - use of non-async-signal-safe fn in sighandler


author: Philippe Coval <philippe.coval@vates.tech> - 9.8p1-1.2.1
changelog:
  - Refresh XCP-ng patches:
    - Drop unnecessary hardening and gssapi patches
    - Replace CVE-2025-26465 backport with upstream patch from 9.9p1
  - Sync with 9.8p1-1.2
  - *** Upstream changelog ***
  - * Fri Nov 07 2025 Alex Brett <alex.brett@citrix.com> - 9.8p1-1.2
  - - CA-420416: Remove diffie-hellman-group14-sha1 KexAlgorithm
  - * Thu Jan 02 2025 Deli Zhang <deli.zhang@cloud.com> - 9.8p1-1.1
  - - CA-400917: Disable PerSourcePenalties
  - - CA-401322: Revert sshd.pam to xs8 default
  - - CA-401322: Ensure new config files applied
  - * Fri Sep 13 2024 Deli Zhang <deli.zhang@citrix.com> - 9.8p1-1
  - - CP-50298: Upgrade to version 9.8p1
  - * Wed Jul 31 2024 Lin Liu <lin.liu@citrix.com> - 8.8p1-3
  - - CP-50477: Customize ssh configurations
  - * Mon Sep 25 2023 Lin Liu <lin.liu@citrix.com> - 8.8p1-2
  - - CP-45435: Permit root ssh login
  - * Thu Jul 20 2023 Lin Liu <lin.liu@citrix.com> - 8.8p1-1
  - - First imported release


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
  - fix CVE-2021-23841 openssl: NULL pointer dereference
    in X509_issuer_and_serial_hash()
  - fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
  - Resolves: rhbz#1932132, rhbz#1932126


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
  - fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
  - Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
  - Resolves: rhbz#2039993


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
  - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Related: rhbz#2067160


author: Guillaume Thouvenin <guillaume.thouvenin@vates.tech> - 1:1.0.2k-26.1
changelog:
  - Add openssl-1.0.2k-update-expiring-certificates.patch to fix build time tests
  - Added gcc to BuildRequires


author: Andrii Sultanov <andriy.sultanov@vates.tech> - 3.0.9-2.0.1.2
changelog:
  - Update to the upstream 3.0.9-2.0.1 package
  - Remove backported patches as OpenSSL 3.0.9 is not affected by the CVEs they
    were fixing: openssl-1.0.2k-cve-2019-1547.backport.patch,
    openssl-1.0.2k-cve-2019-1551.backport.patch, and
    openssl-1.0.2k-cve-2019-1563.backport.patch
  - Remove a patch fixing a build time test as it's no longer necessary on 3.0.9:
    openssl-1.0.2k-update-expiring-certificates.patch
  - *** Upstream changelog ***
    * Thu Jan 02 2025 Deli Zhang <deli.zhang@cloud.com> - 3.0.9-2.0.1
    - CP-52657: Fix CVE-2024-6119
    - CP-52243: Remove new ciphers
    - CP-50862: Add fips only config file
    - CP-50299: Revert epoch=1
    - CP-50299: Disable crypto-policies
    - CP-50299: Build with devtoolset-11

    * Thu Jul 27 2023 Lin Liu <lin.liu@citrix.com> - 3.0.9-2
    - Restore basearch

    * Thu Jul 27 2023 Lin Liu <lin.liu@citrix.com> - 3.0.9-1
    - First imported release


author: Andrii Sultanov <andriy.sultanov@vates.tech> - 1.0.2k-26.1.1
changelog:
  - First build - OpenSSL 1.0.2k-26 compatible package
  - Add backported patches from our OpenSSL package: openssl-1.0.2k-cve-2019-1547.backport.patch,
    openssl-1.0.2k-cve-2019-1551.backport.patch, openssl-1.0.2k-cve-2019-1563.backport.patch
    (the openssl-1.0.2k-update-expiring-certificates.patch was dropped since it
    was already included in the upstream package)
  - *** Upstream changelog ***
    * Thu Feb 13 2025 Lin Liu <deli.zhang@cloud.com> - 1.0.2k-26.1
    - CP-53507: Build OpenSSL 1.0.2k-26 compatible package

    * Thu Jul 18 2024 Lin Liu <Lin.Liu01@cloud.com> - 1.0.2k-26
    - First imported release


author: Philippe Coval <philippe.coval@vates.tech> - 1.0.2k-26.2.1
changelog:
  - Replace older openssl-devel (1.0 API) during transition
  - Release is set 26.2.1 (as a follow up of openssl-1:1.0.2k-26.2)


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 2.5.3-2.3.13.1
changelog:
  - Rebase on latest package from CH 8.3 Preview
  - Re-add changes to produce openvswitch-ipsec subpackage


author: David Morel <david.morel@vates.fr> - 2.5.3-2.3.13.2
changelog:
  - Backport fix for CVE-2023-1668: Remote traffic denial of service via crafted packets with IP proto 0
  - Comment out tests that fail
  - Enable make check in spec file


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 2.5.3-2.3.14.1
changelog:
  - Update to 2.5.3-2.3.14
  - Drop openvswitch-2.5.3-CVE-2023-1668.backport.patch, now patched in XenServer's RPM
  - *** Upstream changelog ***
  - * Tue Apr 18 2023 Ross Lagerwall <ross.lagerwall@citrix.com> - 2.5.3-2.3.14
  - - CA-376367: Fix CVE-2023-1668


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 2.17.7-1.1
changelog:
  - Update to 2.17.7-1
  - Add openvswitch-2.17.7-comment-failing-tests.XCP-ng.patch (Benjamin Reis)
  - Add openvswitch-2.17.7-add-pythonpath-ipsec.XCP-ng.patch (Benjamin Reis)
  - Get ipsec script and service from new sources (Benjamin Reis)
  - *** Upstream changelog ***
  - * Wed Aug 23 2023 Chunjie Zhu <chunjie.zhu@cloud.com> - 2.17.7-1
  - - CP-44181: upgrade to OVS LTS 2.17.7


author: David Morel <david.morel@vates.tech> - 2.17.7-1.2
changelog:
  - Apply fix for CVE-2023-3966, provided in advisory
  - Apply fix for CVE-2023-5366, provided in advisory


author: David Morel <david.morel@vates.tech> - 2.17.7-1.3
changelog:
  - Link with xs-openssl instead of openssl
  - Tweak ovs-ctl script that is used to start ovsdb-server, passing it
    --ssl-ciphers and --ssl-protocols command line parameters to disable weak
    ciphers.


author: David Morel <david.morel@vates.tech> - 2.17.7-1.5
changelog:
  - link back to openssl to avoid issues with XO sdn-controller
  - use ciphers that works with XO sdn-controller and should not be considered as weak-ciphers


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 2.17.7-2.1
changelog:
  - Sync with 2.17.7-2
  - *** Upstream changelog ***
  - * Thu Jun 13 2024 Lin Liu <Lin.Liu01@cloud.com> - 2.17.7-2
  - - CP-46117: Refresh patches to build with XS9


author: Gaëtan Lehmann <gaetan.lehmann@vates.tech> - 2.17.7-4.1
changelog:
  - Sync with 2.17.7-4
  - *** Upstream changelog ***
    * Wed Jan 22 2025 Alex Brett <alex.brett@cloud.com> - 2.17.7-4
    - CA-405118: Backport 3 patches to handle updated groff
    
    * Thu Dec 12 2024 Stephen Cheng <stephen.cheng@cloud.com> - 2.17.7-3
    - CP-50699: For xs9, move config file for openvswitch.service from xenserver-release


author: Paul Howarth <paul@city-fan.org> - 2.05.03-3
changelog:
  - Don't BR: perl(LWP::Simple) for optional tests when bootstrapping; this is a
    cleaner fix than nobbling perl-URI's runtime dependencies


author: Paul Howarth <paul@city-fan.org> - 20081208-8
changelog:
  - Clean up for modern rpmbuild:
    - Drop BuildRoot specification
    - Drop %clean section
    - Don't bother cleaning buildroot in %install section
    - Make %files list more explicit
    - Use DESTDIR rather than PERL_INSTALL_ROOT
    - Use %{_fixperms} macro rather than our own chmod incantation
    - Replace provides filter with version that works with rpm ≥ 4.9
  - Include tests as %doc since they're referred to by examples/README


author: Paul Howarth <paul@city-fan.org> - 20120719-1
changelog:
  - Update to 20120719:
    - Support using data from RangeMessage.xml, so you can use the latest data
      from ISBN without updating this module
  - Fix shellbang and permissions of make_data.pl script to placate rpmlint
  - Filter dependency on perl(LWP::Simple), required only by make_data.pl script,
    not in normal operation
  - Don't need to remove empty directories from the buildroot
  - BR: perl(Carp), perl(File::Spec::Functions) and perl(Test::Manifest) ≥ 1.14
  - BR: at least version 1.00 of perl(Test::Pod)


author: Paul Howarth <paul@city-fan.org> - 20120719.001-1
changelog:
  - Update to 20120719.001:
    - Require Test::More ≥ 0.95 for subtest support
    - No code or feature changes
  - Bump Test::Manifest version requirement to 1.21
  - Bump Test::More version requirement to 0.95
  - Drop redundant buildreq perl(Test::Prereq)


author: Petr Pisar <ppisar@redhat.com> 6.01-1
changelog:
  - Specfile autogenerated by cpanspec 1.78.
  - Remove BuildRoot stuff
  - Conflicts with perl-libwww-perl 5* and older


author: Paul Howarth <paul@city-fan.org> - 1.59-3
changelog:
  - Break build dependency loop by only using perl(Business::ISBN) if we're not
    bootstrapping
  - BR: perl(Carp) and perl(Exporter)
  - Make %files list more explicit
  - Use DESTDIR rather than PERL_INSTALL_ROOT
  - Use %{_fixperms} macro rather than our own chmod incantation
  - Don't use macros for commands


author: Paul Howarth <paul@city-fan.org> - 1.60-1
changelog:
  - Update to 1.60
    - Do not reverse the order of new parameters
    - Avoid test failure if the local hostname is 'foo' (CPAN RT#75519)
    - Work around a stupid join bug in 5.8.[12] (CPAN RT#59274)
    - Updated repository URL
  - Don't need to remove empty directories from buildroot
  - BR: perl(constant)


author: Paul Howarth <paul@city-fan.org> - 1.60-8
changelog:
  - Retain runtime dependency of perl(Business::ISBN) when bootstrapping; a
    better fix for the build dependency cycle was to drop LWP::Simple as a
    buildreq of perl-Business-ISBN (needed only for optional tests) when
    bootstrapping


author: Deli Zhang <deli.zhang@cloud.com> - 2.7.5-92
changelog:
  - CP-50325: Use new api of ncurses-devel
  - CP-50323: Replace deprecated functions
  - CA-397616: Remove test_gdb test temporarily
  - CP-50323: Remove unused module test test_ftplib.py
  - CP-50323: Build with OpenSSL 3
  - CP-50323: Import python-2.7.5-90.el7.src.rpm


author: Kamil Dudka <kdudka@redhat.com> - 7.19.0-15
changelog:
  - allow to return -1 from the write callback (#857875) 
  - remove the patch for curl-config --static-libs no longer needed
  - run the tests against the just built pycurl, not the system one


author: Philippe Coval <philippe.coval@vates.tech> - 7.19.0-19.1
changelog:
  - Add gcc to BuildRequires
  - Define __python for modern parser
  - Update obsolete patch macro with autosetup
  - Rebuild with openssl-3


author: Deli Zhang <deli.zhang@cloud.com> - 3.6.8-20
changelog:
  - CP-53516: Fix build issue caused by expat upgrade
  - CP-50324: Replace deprecated functions
  - CP-50324: Remove python3-pip require
  - CA-397616: Remove test_gdb tests temporarily
  - CP-50324: Build with OpenSSL 3
  - CP-50324: Import python3-3.6.8-18.el7.src.rpm


author: Ross Lagerwall <ross.lagerwall@citrix.com> - 4.2.1-5.2.8
changelog:
  - Disable capstone and fdt explicitly
  - CP-42792: Backport a patch to avoid unncessary buffered ioreq polling


author: Ross Lagerwall <ross.lagerwall@citrix.com> - 4.2.1-5.2.9
changelog:
  - CA-391031: Reinstate rate limiting of RTC_CHANGE events
  - CA-391069: Avoid livelock due to buffered ioreqs


author: Yann Dirson <yann.dirson@vates.tech> - 4.2.1-5.2.12.1
changelog:
  - Sync with xs8 4.2.1-5.2.12, no code change, only rebuild against libjemalloc.so.2:
    * Fri Aug 02 2024 Stephen Cheng <stephen.cheng@cloud.com> - 4.2.1-5.2.12
    - CP-46112: Rebuild after new version of jemalloc

    * Fri Aug 02 2024 Stephen Cheng <stephen.cheng@cloud.com> - 4.2.1-5.2.11
    - CP-46112: Rebuild with new version of jemalloc


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 4.2.1-5.2.14.1
changelog:
  - Sync with 4.2.1-5.2.14
  - Remove 0001-nvme-Don-t-check-NSID-in-NVME_VOLATILE_WRITE_CACHE.patch in favor of XenServer's fix
  - *** Upstream changelog ***
    * Wed Oct 15 2025 Ross Lagerwall <ross.lagerwall@citrix.com> - 4.2.1-5.2.14
    - CA-418876: Fix NVMe namespace indexing

    * Thu Oct 02 2025 Ross Lagerwall <ross.lagerwall@citrix.com> - 4.2.1-5.2.13
    - CA-417654: Fix NVME bug which causes WS2025 install failures


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 4.2.1-5.2.15.1
changelog:
  - Sync with 4.2.1-5.2.15
  - *** Upstream changelog ***
    * Thu Oct 23 2025 Roger Pau Monné <roger.pau@citrix.com> - 4.2.1-5.2.15
    - Allow passthrough of devices from a PCI segment different than 0.


author: Quentin Casasnovas <quentin.casasnovas@vates.tech> - 4.2.1-5.2.17.1
changelog:
  - Sync with 4.2.1-5.2.17
  - *** Upstream changelog ***
    * Thu Jan 08 2026 Ross Lagerwall <ross.lagerwall@citrix.com> - 4.2.1-5.2.17
    - CA-407410: qmp: Fix race causing events to be sent during negotiation
    * Mon Dec 01 2025 Ross Lagerwall <ross.lagerwall@citrix.com> - 4.2.1-5.2.16
    - CA-420202: xen-hvm: Handle framebuffer relocation


author: Andrew Cooper <andrew.cooper3@citrix.com> - 3.4.1-1
changelog:
  - Update to 3.4.1
     - Fixes for CVE-2024-12084, CVE-2024-12085, CVE-2024-12086
                 CVE-2024-12087, CVE-2024-12088, CVE-2024-12747
  - Resync specfile


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 4.10.16-17.0.3.1
changelog:
  - Don't build vfs_glusterfs and thus don't buildrequire glusterfs
  - Remove the useless build dependency to epel-release
  - Add gcc to the BuildRequires


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 4.10.16-17.0.4.1
changelog:
  - Update from XS 8.3 pre-release updates
  - *** Upstream changelog ***
  - * Tue Sep 20 2022 Lin Liu<lin.liu@citrix.com> - 4.10.16-17.0.4
  - - CP-40720: Remove epel-release from BuildRequires


author: Yann Dirson <yann.dirson@vates.tech> - 4.10.16-25.1
changelog:
  - Revert XS changes to prepare for merging new upstream, keeping changelog
    and kerberos config changes
  - By Lucas Ravagnier <lucas.ravagnier@vates.tech>:
    - Import samba-4.10.16-25.el7_9
    - Use a bcond to enable XCP-ng packaging tweaks while preserving upstream spec content.
    - *** Upstream changelog ***
      * Tue Jul 25 2023 Andreas Schneider <asn@redhat.com> - 4.10.16-25
      - resolves: #2222250 - Fix netlogon capabilities level 2

      * Fri Jan 20 2023 Andreas Schneider <asn@redhat.com> - 4.10.16-24
      - related: #2154364 - Add additional patches for CVE-2022-38023

      * Wed Dec 21 2022 Andreas Schneider <asn@redhat.com> - 4.10.16-23
      - resolves: #2154364 - Fix CVE-2022-38023

      * Tue Aug 30 2022 Andreas Schneider <asn@redhat.com> - 4.10.16-20
      - resolves: #2119058 - Fix possible segfault in winbind

      * Tue May 10 2022 Andreas Schneider <asn@redhat.com> - 4.10.16-19
      - resolves: #2081649 - Fix idmap_rfc2307 and idmap_nss returning wrong
                 mapping for uid/gid conflict

      * Tue Jan 25 2022 Andreas Schneider <asn@redhat.com> - 4.10.16-18
      - resolves: #2034800 - Fix usermap script regression caused by CVE-2020-25717
      - resolves: #2036595 - Fix MIT realm regression caused by CVE-2020-25717
      - resolves: #2046148 - Fix CVE-2021-44142


author: Gaëtan Lehmann <gaetan.lehmann@vates.tech> - 4.10.16-25.2
changelog:
  - Apply packaging changes from XenServer's samba-4.10.16-17.0.{4-8}
  - *** Upstream changelog ***
  - * Tue Apr 01 2025 Lin Liu <Lin.Liu01@cloud.com> - 4.10.16-17.0.8
  - - CA-408843: enctypes support machine account
  -
  - * Thu Jan 02 2025 Deli Zhang <deli.zhang@cloud.com> - 4.10.16-17.0.7
  - - CP-50277: Remove unused cups package
  -
  - * Mon Sep 9 2024 Lin Liu<lin.liu@citrix.com> - 4.10.16-17.0.6
  - - CP-50735: Remove avahi support
  -
  - * Wed Aug 7 2024 Lin Liu<lin.liu@citrix.com> - 4.10.16-17.0.5
  - - CP-50670: Remove python and json support
  -
  - * Tue Sep 20 2022 Lin Liu<lin.liu@citrix.com> - 4.10.16-17.0.4
  - - CP-40720: Remove epel-release from BuildRequires


author: Yann LE BRIS <yann.lebris@vates.tech> - 3.2.3-1.16
changelog:
  - Add 0061-Fix-LVHDSR.load-set-other_conf-in-cond-branch-to-pre.patch
  - Add 0062-fix-cleanup.py-protect-LinstorSR-init-against-race-c.patch
  - Add 0063-Fix-filter-to-reject-other-device-types-77.patch
  - Add 0064-feat-add-HPE-Nimble-multipath-configuration.patch


author: Ronan Abhamon <ronan.abhamon@vates.tech> - 3.2.12-3.1
changelog:
  - Rebase on 3.2.12-3
  - Sync patches with our latest 3.2.12-8.3 branch
  - Remove patches merged upstream:
    - 0028-CA-398425-correctly-check-for-multiple-targets-in-iS.patch
    - 0030-fix-getAllocatedSize-is-incorrect-75.patch
    - 0047-Define-and-details-attr-on-Failure-mock.patch
    - 0064-feat-add-HPE-Nimble-multipath-configuration.patch
  - *** Upstream changelog ***
    * Tue Feb 11 2025 Mark Syms <mark.syms@cloud.com> - 3.2.12-3
    - CA-405381: update mpathcount while xapi is not enabled
    * Thu Feb 06 2025 Mark Syms <mark.syms@cloud.com> - 3.2.12-2
    - CA-403593: don't log session refs
    * Mon Jan 06 2025 Mark Syms <mark.syms@cloud.com> - 3.2.12-1
    - CA-400789: Do not exclude parentless VDIs from cacheing
    - CP-52844: allow for open session to be passed to sr_get_capability
    - CP-52852: add handler for xmlrpc ProtocolError
    - fix(cleanup.py): bad live coalesce check regarding FileSR
    * Tue Nov 19 2024 Mark Syms <mark.syms@cloud.com> - 3.2.11-1
    - CP-42675: send messages to Xapi if GC has insufficient space
    - CP-52620: enable read-through cache on persistent leaf
    * Tue Nov 05 2024 Mark Syms <mark.syms@cloud.com> - 3.2.10-1
    - CA-397084: SR scan tries to deactivate LV in use by tapdisk
    - CA-399644: if we make progress do not abort the GC or evaluate criteria
    - CA-400743: perform post snapshot rename in ioretry
    - CA-401068: if iSCSI device path is not found scan the bus
    * Wed Oct 09 2024 Mark Syms <mark.syms@cloud.com> - 3.2.9-3
    - CP-51658: install stop gc helper script
    - CA-399643 Use full paths when stopping fairlock on upgrade
    - CA-396655: check xapi is enabled before starting multipath reporting
    - CA-396658: check xapi is enabled before checking SR health
    - CA-400106: disable leaf coalesce with VDI snapshot secondary
    * Tue Sep 24 2024 Tim Smith <tim.smith@cloud.com> - 3.2.8-2
    - CA-399643 Use full paths when stopping fairlock on upgrade
    * Fri Sep 06 2024 Robin Newton <robin.newton@cloud.com> - 3.2.8-1
    - CA-398958 Cope with concurrent read-only activations
    * Wed Sep 04 2024 Mark Syms <mark.syms@cloud.com> - 3.2.7-1
    - CA-398425: correctly check for multiple targets in iSCSI
    * Wed Aug 21 2024 Mark Syms <mark.syms@cloud.com> - 3.2.6-1
    - CA-395560: Log exception details when LUN refresh fails
    - CA-396124: amend criteria under which the garbage collector aborts
    - CA-397084: Log any user of LV at deactivate
    - CP-51214: stop cgrules triggering errors on update
    * Tue Jul 23 2024 Tim Smith <tim.smith@cloud.com> - 3.2.5-1
    - CA-395554 Stop fairlock services on package upgrade
    * Mon Jul 22 2024 Mark Syms <mark.syms@cloud.com> - 3.2.4-1
    - Add missing sg3_utils dependency
    - Update multipath config for Dell, IBM and Nimble arrays


author: Ronan Abhamon <ronan.abhamon@vates.tech> - 3.2.12-3.2
changelog:
  - Prevent leaf coalesce during migration for LINSTOR (CA-400106)
  - Use GC daemon code for LINSTOR like other drivers


author: Yann Dirson <yann.dirson@vates.fr> - 3.2.12-3.3
changelog:
  - Add missing dependency on libcgroup-tools, uses cgclassify(1)
  - Drop dependency on old and unused python3-future
  - Refresh patch not applying on Alma10 due to fuzz


author: Ronan Abhamon <ronan.abhamon@vates.tech> - 3.2.12-10.1
changelog:
  - Rebase on 3.2.12-10
  - Sync patches with our latest 3.2.12-8.3 branch
  - Add new patches:
    - 0064-chore-.github-workflows-use-ubuntu-24.04.patch
    - 0065-Fix-warns-reported-by-new-github-workflow.patch
    - 0066-Improve-LinstorSR.py-to-handle-thick-SR-creation-85.patch
    - 0067-Fix-LINSTOR-satellite-LS_KEEP_RES-regex.patch
    - 0068-fix-LinstorSR-Correctly-reference-a-variable-excepti.patch
    - 0069-Fix-GC-hidden-attribute-in-case-of-SIGTERM-signal-87.patch
    - 0070-fix-LinstorSR-robustify-DB-umount-call.patch
    - 0071-feat-Linstor-rewrite-linstorhostcall-logic.patch
    - 0072-feat-linstor-Add-new-debug-log-in-linstorhostcall-67.patch
    - 0073-fix-linstor-subsequent-fixes-for-linstorhostcall.patch
    - 0074-Fix-tests-of-CP-51843-add-unit-tests-for-setup_cache.patch
    - 0075-feat-LinstorSR-improve-DB-volume-robustness.patch
    - 0076-fix-linstorvolumemanager-robustify-usable-size-gette.patch
    - 0077-fix-linstorvhdutil-don-t-log-when-get_hosts_attached.patch
    - 0078-refactor-linstorvhdutil-simplify-linstorhostcall.patch
    - 0079-fix-linstorvhdutil-call-local-method-when-possible-i.patch
    - 0080-fix-linstorvhdutil.py-remove-useless-param-on-call_r.patch
    - 0081-chore-pylintrc-get-rid-of-E1120-errors-for-LINSTOR-u.patch
    - 0082-fix-linstorvhdutil-support-missing-session-97.patch
  - *** Upstream changelog ***
    * Fri Jul 04 2025 Mark Syms <mark.syms@cloud.com> - 3.2.12-10
    - CA-413209: remove dangling reference to rawhba
    - CP-308587: update NetApp multipath as requested
    * Wed Jun 18 2025 Mark Syms <mark.syms@cloud.com> - 3.2.12-9
    - CA-395221: require systemd target
    * Tue May 27 2025 Mark Syms <mark.syms@cloud.com> - 3.2.12-8
    - CP-53692 SR attach with kicking the mpathcount pipe
    - CA-411163: refuse to attach if we see multiple SCSI IDs for SR PVs
    * Tue Apr 08 2025 Mark Syms <mark.syms@cloud.com> - 3.2.12-7
    - CA-409231: Report IntelliCache stats when parent is NBD.
    * Mon Mar 31 2025 Mark Syms <mark.syms@cloud.com> - 3.2.12-6
    - CA-407743: do not try to add memory caching and intellicache
    * Tue Mar 25 2025 Mark Syms <mark.syms@cloud.com> - 3.2.12-5
    - CA-408105: add logging to failure paths
    - CA-408452: remove VDI parent if it does not have one
    - CP-51843:  extend IntelliCache coverage
    * Tue Mar 04 2025 Mark Syms <mark.syms@cloud.com> - 3.2.12-4
    - CA-407343: do not remove the parent's vhd-parent in leaf GC
    - Revert the changes in 2979937bbb7 (CA-397084)
    - CP-50026 Ensure mpathcount runs after multipath deactivate


author: Damien Thenot <damien.thenot@vates.tech> - 3.2.12-10.2
changelog:
  - Add 0083-Remove-useless-loadLocked-param-on-vdi-methods-98.patch
  - Add 0084-fix-largeblock-redo-VG-activation-using-custom-confi.patch


author: Ronan Abhamon <ronan.abhamon@vates.tech> - 3.2.12-16.1
changelog:
  - Rebase on 3.2.12-16
  - Sync patches with our latest 3.2.12-8.3 branch
  - Add new patches:
    - 0085-Stop-SMGC-service-on-SR-detach-to-prevent-orphaned-s.patch
    - 0086-fix-linstorvolumemanager-create-local-DB-path-when-r.patch
    - 0087-feat-linstorvolumemanager-raise-when-empty-device-pa.patch
    - 0088-fix-linstorvolumemanager-prevent-ops-on-version-mism.patch
    - 0089-fix-linstor-handle-deleted-volumes-during-UUID-updat.patch
    - 0090-fix-linstor-don-t-raise-if-volume-cannot-be-deleted-.patch
    - 0091-fix-linstor-print-DRBDs-open-during-chain-check-in-R.patch
    - 0092-metadata-improve-error-messages-when-vdi_type-is-mis.patch
    - 0093-Use-serial-instead-of-SCSI-ID-for-USB-devices-107.patch
  - *** Upstream changelog ***
    * Fri Nov 21 2025 Mark Syms <mark.syms@citrix.com> - 3.2.12-16
    - CA-420515: log errors in GC when running in foreground
    - CA-419706: fix incorrect print syntax
    - CA-421013: ensure repeated CBT enable/disable works
    * Mon Nov 10 2025 Mark Syms <mark.syms@citrix.com> - 3.2.12-15
    - CA-418775: ensure getsize and sg_readcap agree on resize
    - CA-420307: encode synthetic SCSI data correctly
    * Wed Oct 15 2025 Mark Syms <mark.syms@citrix.com> - 3.2.12-14
    - CA-416486: leaf coalesce wait for GC
    * Tue Sep 30 2025 Mark Syms <mark.syms@citrix.com> - 3.2.12-13
    - CP-309718: calculate a moving average of leaf size in GC
    * Tue Sep 09 2025 Mark Syms <mark.syms@cloud.com> - 3.2.12-12
    - CA-414438 Defend against unexpected VDI name_description contents
    - CA-413899: Rescan lvs when activating
    * Mon Aug 18 2025 Mark Syms <mark.syms@cloud.com> - 3.2.12-11
    - Rebuild


author: Ronan Abhamon <ronan.abhamon@vates.tech> - 3.2.12-17.1
changelog:
  - Rebase on 3.2.12-17
  - Remove patches merged upstream:
    - 0092-metadata-improve-error-messages-when-vdi_type-is-mis.patch
  - Add new patches:
    - 0093-fix-linstorvolumemanager-fix-typo-106.patch
    - 0094-fix-linstorvolumemanager-don-t-allow-InUse-volumes-t.patch
    - 0095-fix-cleanup-ensure-VDI-is-active-before-relink-119.patch
    - 0096-feat-linstor-simplify-get_controller_uri-using-ss-co.patch
    - 0097-fix-linstor-ignore-unknown-res-to-get-volume-info-12.patch
    - 0098-feat-linstor-parallelize-SR.scan-cleanup-vhd-util-ca.patch
    - 0099-fix-cleanup-properly-handle-FileSR-exception-for-sla.patch
    - 0100-Ensure-DRBD-sync-before-resizing-volumes-in-thick-co.patch
  - *** Upstream changelog ***
    * Fri Dec 12 2025 Mark Syms <mark.syms@citrix.com> - 3.2.12-17
    - Backport changes from upstream.
    - remove flag gc_no_space from SR sm-config when not applicable
    - improve error messages when vdi_type is missing


author: Manuel "lonely wolf" Wolfshant <wolfy@fedoraproject.org> - 2.64-7
changelog:
  - remove world readable permissions of the config file (#962988)
  - revive the authpass patch (#970123)
  - revive improved default config settings which were lost during rebase (#895708)


author: Gael Duperrey <gduperrey@vates.tech> - 1.9.15-3.1
changelog:
  - Synced from sudo-1.9.15-3.xs8.src.rpm
  - Removed XS-specific test of dist macro to determine buildrequires


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1.9.15-4.1
changelog:
  - Sync with 1.9.15-4
  - *** Upstream changelog ***
  - * Thu Jul 4 2024 Lin Liu <Lin.Liu01@cloud.com> - 1.9.15-4
  -- - Drop python plugin as not required


author: Gaëtan Lehmann <gaetan.lehmann@vates.tech> - 1.9.15-5.1
changelog:
  - Sync with 1.9.15-5
  - *** Upstream changelog ***
    * Tue Nov 12 2024 Lin Liu <Lin.Liu01@cloud.com> - 1.9.15-5
    - CP-50489: Remove selinux


author: Ross Lagerwall <ross.lagerwall@citrix.com> - 0.7.3-8
changelog:
  - Add gnutls-compat.patch back to make compatible with xs8/xs9
  - CA-377995: Fix static analysis warnings


author: Martin Sehnoutka <msehnout@redhat.com> - 14:4.9.0-1
changelog:
  - New upstream version 4.9.0. Resolves: #1422473
  - Add legacy -P switch with warning. Related to #1422473 and #1292056


author: Martin Sehnoutka <msehnout@redhat.com> - 14:4.9.0-4
changelog:
  - Drop downstream patch (drop root privileges)
  - Add libcap-ng as a new build dependency
  - Related: #1262283


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1.2.0-1.3
changelog:
  - Update secureboot-certs script for recent UEFI cert handling in XAPI
  - Remove KEK and db cert databases for now, pending legal advice.


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1.2.0-2.1
changelog:
  - Sync with 1.2.0-2
  - *** Upstream changelog ***
  - * Fri Jan 26 2024 Andrew Cooper <andrew.cooper3@citrix.com> - 1.2.0-2
  - - Rebuild against libxenstore.so.4


author: Thierry Escande <thierry.escande@vates.tech> - 1.2.0-2.2
changelog:
  - Auth: Add support to make KEK and DB files optional
  - Auth: Enable AUTH_ONLY_PK_REQUIRED build macro


author: Thierry Escande <thierry.escande@vates.tech> - 1.2.0-2.3
changelog:
  - Remove generation and installation of KEK and db files
  - Add helper script to remove pem file from source archive
  - Update source archive with pem files removed


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 1.2.0-2.4
changelog:
  - Add gen-sbvar.py
  - Add self-signed PK.auth blob
  - Generate {KEK,db,dbx}.auth using gen-sbvar.py
  - Update secureboot-certs to take builtin KEK/db/dbx
  - Update Secure Boot certs from microsoft/secureboot_objects@3f69ef4


author: Thierry Escande <thierry.escande@vates.tech> - 1.2.0-3.1
changelog:
  - Sync with 1.2.0-3
  - *** Upstream changelog ***
    * Wed Jan 22 2025 XenServer Rebuild <rebuild@xenserver.com> - 1.2.0-3
    - Add yangtze release branch
    - CP-53310: XenServer 9 rebuild


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 1.2.0-3.4
changelog:
  - Fix owner GUID of EFI_SIGNATURE_DATA structures
  - Restore dbx generation
  - Update dbx info to microsoft/secureboot_objects@e64d1a5c89e5 (v1.6.1)
  - Add fix-efivars.py script


author: Andriy Sultanov <andriy.sultanov@vates.tech> - 1.3.1-2.1
changelog:
  - Sync with 1.3.1-2
  - *** Upstream changelog ***
    * Mon Jan 12 2026 Andrew Cooper <andrew.cooper3@citrix.com> - 1.3.1-2
    - Fix for XSA-478 / CVE-2025-58151

    * Thu Nov 13 2025 Ross Lagerwall <ross.lagerwall@citrix.com> - 1.3.1-1
    - CA-419599: Check DATA_LIMIT when appending

    * Mon Oct 06 2025 Ross Lagerwall <ross.lagerwall@citrix.com> - 1.3.0-1
    - CP-309775: Add new Microsoft certificates
    - Fix varstore-sb-state exit code
    - Don't fail setup_keys if the optional dbx is missing


author: Andrii Sultanov <andriy.sultanov@vates.tech> - 25.27.0-2.1
changelog:
  - Update to upstream 25.27.0-2
  - Drop 0003-xcp-ng-disable-cancellable-sleep.patch, alternative fix merged upstream
  - Drop 0004-xcp-ng-add-debug-info-in-observer.patch, merged upstream
  - Rename 0005-xcp-ng-fix-IPv6-import.patch to 0003-xcp-ng-fix-IPv6-import.patch
  - Rename 0006-xcp-ng-open-close-openflow-port.patch to 0004-xcp-ng-open-close-openflow-port.patch
  - Rename 0007-xcp-ng-update-db-tunnel-protocol-from-other-config.patch to
    0005-xcp-ng-update-db-tunnel-protocol-from-other-config.patch
  - Drop 0008-CA-408126-rrd-Do-not-lose-ds_min-max-when-adding-to-.patch, merged upstream
  - Drop 0009-CA-408126-follow-up-Fix-negative-ds_min-and-RRD-valu.patch, merged upstream
  - Drop 0010-CA-408841-rrd-don-t-update-rrds-when-ds_update-is-ca.patch, merged upstream
  - Drop 0011-Check-that-there-are-no-changes-during-SR.scan.patch, merged upstream
  - Drop 0012-xapi_guest_agent-Update-xenstore-keys-for-Windows-PV.patch, merged upstream
  - Drop 0013-xapi_xenops-Try-to-avoid-a-race-during-suspend.patch, merged upstream
  - Drop 0014-CA-409510-Make-xenopsd-nested-Parallel-atoms-explici.patch, merged upstream
  - Drop 0015-CA-409510-Give-a-warning-if-atoms-nested-incorrectly.patch, merged upstream
  - Drop 0016-CA-410782-Add-receive_memory_queues-for-VM_receive_m.patch, merged upstream
  - Drop 0017-CA-411319-Concurrent-VM.assert_can_migrate-failure.patch, merged upstream
  - Drop 0018-CA-409488-prevent-Xenctrl-exceptions-from-escaping-o.patch, merged upstream
  - Drop 0019-CA-409489-prevent-running-out-of-pages-with-lots-of-.patch, merged upstream
  - Drop 0020-rrd_file_writer-protect-against-resource-leak.patch, merged upstream
  - Drop 0021-Raise-log-level-for-rrd-thread-monitor.patch, merged upstream
  - Drop 0022-CA-410001-Check-rrdi.rrd-to-avoid-ds-duplicate.patch, merged upstream
  - Drop 0023-CA-409482-Using-computed-delay-for-RRD-loop.patch, merged upstream
  - Drop 0024-CA-411679-Runstate-metrics-return-data-over-100.patch, merged upstream
  - Drop 0025-xcp-rrdd-change-the-code-responsible-for-filtering-o.patch, merged upstream
  - Drop 0026-rrdd-Avoid-missing-aggregation-of-metrics-from-newly.patch, merged upstream
  - Drop 0027-CA-407370-Use-remote.conf-for-customer-rsyslog-forwa.patch, merged upstream
  - Drop 0028-xenopsd-set-xen-platform-pci-bar-uc-key-in-xenstore.patch, merged upstream
  - Drop XSA-474 backport to 25.6.0 (0029-prepare-make-StringPool-share-safer.patch and
    0030-Simplify-UTF-8-decoding.patch), replace with the upstream backport to 25.27.0
  - *** Upstream changelog ***
    * Tue Sep 02 2025 Gabriel Buica <danutgabriel.buica@cloud.com> - 25.27.0-2
    - CA-411297/XSA-474: XAPI UTF8

    * Wed Jul 23 2025 Gabriel Buica <danutgabriel.buica@cloud.com> - 25.27.0-1
    - CP-54332 Update host/pool datamodel to support SSH auto mode
    - CP-53721 Implement SSH set auto mode API for Dom0 SSH control
    - CP-53724 Add xe CLI commands for setting and querying Dom0 SSH auto mode
    - CP-54382 Set Different Auto-Mode Default Values for XS8 and XS9
    - CP-54382 Reconfigure Auto mode when pool join and pool eject
    - CA-412854 Fix ssh_expiry drift after XAPI restart
    - CA-413328 Enable auto-mode when XAPI failed for a extend period that exceeds the timeout duration
    - CA-413319: Ensure console timeout file exists when timeout is configured
    - CA-413424: Enhance xe help output
    - xapi_sr_operations: Report more useful info when raising other_operation_in_progress error
    - xapi_cluster_helpers: Correctly report other_operation_in_progress error
    - xapi_vm_lifecycle: Correctly report other_operation_in_progress error
    - qcow-stream-tool: Add a minimal CLI wrapper for Qcow_stream
    - {export,import}_raw_vdi: add qcow as supported format
    - export_raw_vdi: Add support for differential QCOW2 export with base
    - CP-52334 MVD - add -d option to mock driver-tool
    - xapi_vbd_helpers: Fix operation reporting when raising other_operation_in_progress
    - xapi_vdi: Report more useful information when raising other_operation_in_progress
    - xapi_{vif,vusb}_helpers: Report more useful information when raising other_operation_in_progress
    - message_forwarding: Report more info when raising other_operation_in_progress
    - xapi_pool_helpers: Report more info when raising other_operation_in_progress error
    - xapi_pif: Report more info when raising other_operation_in_progress error
    - xapi_vm_appliance_lifecycle: Report more info when raising other_operation_in_progress error
    - xapi_vbd: Report more useful info when raising other_operation_in_progress error
    - xapi_host_helpers: Report more useful info when raising other_operation_in_progress error
    - xapi/helpers: Fix handling of other_operation_in_progress delays
    - idl/datamodel_errors: Add operation_{type,ref} to other_operation_in_progress
    - Adjust tests after other_operation_in_progress refactoring
    - CA-412420: Set vdi-type When Create snapshot on SMAPIv3 SR
    - [doc] add documentation about tracing
    - CP-54480 Update release number for ssh_auto_mode
    - CA-413587: Checking feature for old FreeBSD driver

    * Wed Jul 16 2025 Rob Hoes <rob.hoes@citrix.com> - 25.26.0-1
    - xenopsd: set xen-platform-pci-bar-uc key in xenstore
    - CP-308455 VM.sysprep add timeout parameter
    - CP-308455 VM.sysprep wait for shutdown
    - CP-308455 VM.sysprep update documentation
    - CP-308455 VM.sysprep wait for "action" key to disappear
    - CA-413713: Change bash-completion shortcut
    - Replace `List.fold_left (||) false (List.map f lst)` with `List.exists f lst`
    - CP-308875: set Xen PCI MMIO BAR to WB
    - Add message argument to LICENSE_CHECKOUT_ERROR

    * Sun Jul 13 2025 Bengang Yuan <bengang.yuan@cloud.com> - 25.25.0-1
    - CA-393417: Drop device controller of cgroup v1 and fix USB passthrough for XS9
    - xapi-stdext-threads: calibrate ratio for delay times
    - Downgrade unknown SM.feature errors to warnings
    - CP-308455 VM.sysprep use watch to detect sysprep running
    - datamodel_lifecycle: automatic update
    - CA-413412: Fail to designate new master
    - XSI-1954: Only block pool join for clustering on non-management VLAN

    * Sun Jul 06 2025 Bengang Yuan <bengang.yuan@cloud.com> - 25.24.0-1
    - CA-410965: Modify default ref of console
    - Design proposal for supported image formats (v3)
    - CA-411477: Fix SM API version check failure
    - CP-54207: Move VBD_attach outside of VM migrate downtime
    - xenopsd/xc: upstream more NUMA changes
    - idl: Remove unused vm_lacks_feature_* errors
    - python: Add qcow2-to-stdout.py script
    - Move collection of memory metrics from xcp-rrdd to rrdp-squeezed
    - Move common retry_econnrefused function to xcp_client
    - CA-412636: hostname changed to localhost with static IP and reboot
    - Add mlis for observer_helpers and observer_skeleton
    - CP-308455 Toolstack VM.sysprep API
    - `xapi_vm_lifecycle`: Improve feature handling, avoid crashes
    - CA-413304: Restore VBD.unplug function to keep old functionality

    * Wed Jun 25 2025 Bengang Yuan <bengang.yuan@cloud.com> - 25.23.0-1
    - Improve the xapi_observer debug logs by adding more context
    - Reduce code duplication by using a common Observer Interface
    - CA-409431: Use an Observer forwarder for xapi-storage-script
    - xapi: Move cpu_info keys to xapi-consts from xapi_globs to be used across modules
    - Improve xapi-cli-server
    - Improve `xe-cli` completion
    - xapi/helpers: Note that get_localhost can fail while the database is starting up
    - xapi_host: missing UEFI certificates warrant a warning, not an error
    - CA-412164: XSI-1901: uid-info does not support `:` in gecos
    - CP-47063: Instrument message-switch functions
    - CA-412313: DT spans not exported on host evacuation (XAPI shutdown)
    - xenopsd: Allow to override the default NUMA placement
    - Fix `message-switch` opam metadata
    - opam: generate xapi-log with dune
    - xapi-log: remove circular dependency on tests
    - datamodel_lifecycle: automatic update
    - CA-412146 Filter out VF when scan
    - Update datamodel_host
    - Update XE_SR_ERRORCODES from SM
    - CP-308253: `Task.destroy` spans should no longer be orphaned
    - CP-308392: Create specialized functions
    - xapi-idl: Clean up xenops-related interfaces
    - xapi_xenops: Remove unnecessary Helpers.get_localhost call
    - xapi_xenops: Split update_vm internals into a separate function
    - CA-408552: Improve bootstrom performance by save db ops
    - xenops_server_plugin: Refer to the type alias instead of its definition
    - xapi-idl/updates: Make filterfn in inject_barrier only look at keys
    - xapi_xenops: Refactor update_vm_internal
    - CP-308253: Instrument `Consumers` Spans in `Message-switch`.
    - CP-50001: Add instrumentation to `xapi_xenops.ml`
    - CA-406770: Improve error message
    - xenopsd: Remove data/updated from the list of watched paths
    - xapi_xenops: Simplify update_* functions
    - CP-308201: make unimplemented function more obvious

    * Thu Jun 12 2025 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 25.22.0-2
    - Bump release and rebuild

    * Wed Jun 11 2025 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 25.22.0-1
    - xcp-rrdd: change the code responsible for filtering out paused domains
    - Update datamodel_lifecycle (25.21.0)
    - CA-410085: Improving clearing cgroup after vfork
    - Adapt code to new mirage-crypto (CP-308222)
    - CP-308252 add VM.call_host_plugin
    - xapi-client: Add Tasks.wait_for_all_with_callback
    - xapi_host: Parallelize host evacuation even more
    - github: keep scheduled yangtze's runs working
    - rrdd: Avoid missing aggregation of metrics from newly destroyed domains
    - xapi-aux: remove cstruct usage from networking_info
    - xapi-cli-server: Expose evacuate-batch-size parameter in the CLI
    - [maintenance]: add forkexecd C objects to .gitignore
    - unixext: Add a raise_with_preserved_backtrace function
    - xapi_vgpu_type: Don't pollute the logs with non-critical errors
    - networkd: Add ENOENT to the list of expected errors in Sysfs.read_one_line
    - xenguestHelper: Don't dump errors on End_of_file

    * Tue Jun 10 2025 Bengang Yuan <bengang.yuan@cloud.com> - 25.21.0-4
    - Bump release and rebuild

    * Mon Jun 09 2025 Bengang Yuan <bengang.yuan@cloud.com> - 25.21.0-3
    - Bump release and rebuild

    * Fri Jun 06 2025 Bengang Yuan <bengang.yuan@cloud.com> - 25.21.0-2
    - Bump release and rebuild

    * Fri Jun 06 2025 Bengang Yuan <bengang.yuan@cloud.com> - 25.21.0-1
    - CP-53477 Update host/pool datamodel to support SSH status query and configure
    - CP-53802: Restore SSH service to default state in pool eject
    - CP-53711: Apply SSH settings in joiner before update_non_vm_metadata
    - CP-53723 Implement Console timeout configure API for Dom0 SSH control
    - CP-53478: Implement SSH enabeld timeout API for Dom0 SSH control
    - CP-53725 Create SSH-related xe CLI for Dom0 SSH control
    - CP-54138: Sync SSH status during XAPI startup
    - CP-308049: rrdview tool
    - CA-410948 Avoid rasie full Exception when disable/enable ssh failed
    - CA-409949 CA-408048 XSI-1912 remove unabailable SM plugin by ref
    - xapi-types: remove dev errors when adding features
    - xenctrlext: add function to set the hard-affinity for vcpus
    - xenopsd: pass the hard-affinity map to pre_build
    - xenopsd: do not send hard affinities to xenguest when not needed
    - xenopsd: set the hard affinities directly when set by the user
    - xenopsd: expose a best-effort mode that set the hard affinity mask (CP-54234)
    - xapi: use hard-pinning with best-effort as an experimental feature (CP-54234)
    - CA-411679: Runstate metrics return data over 100%
    - Modify doc mistakes
    - CONTRIBUTING: add some initial guidelines
    - Removed PowerShell 5.x build due to the retirement of windows-2019.
    - Add file-upload support to xe host-call-plugin
    - CP-53475 Update release number to latest tag
    - XSI-1918: Host can not join pool after enable external auth
    - xapi_vif: Guarantee the device parameter is an unsigned decimal integer
    - xapi-idl: Avoid printing cli output when testing
    - xapi-storage-script: avoid output when running python tests
    - CA-411766: Detach VBDs right after VM Halted
    - datamodel_lifecycle: automatic update

    * Fri May 23 2025 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 25.20.0-2
    - Bump release and rebuild

    * Fri May 23 2025 Bengang Yuan <bengang.yuan@cloud.com> - 25.20.0-1
    - CA-409949 CA-408048 remove unavailable SM types at startup
    - CP-307933: database: do not marshal/unmarshal every time
    - CP-307865 Support SHA-512 Certificates for XenServer Hosts
    - gencert testing: use human-readable errors for validation
    - CA-409510: xenopsd operations time out due to deadlock
    - CA-411122: do not call set-iscsi-initiator with an empty string for IQN
    - CA-410782: Add receive_memory_queues for VM_receive_memory operations
    - xapi: Cleanup unused functions
    - CP-308075 document changing paths for SM plugins in XS9
    - CP-53642: change default NUMA placement policy to best-effort
    - CP-54275: Add a blocklist mechanism to avoid incorrect/old repo config.
    - CP-307922: Implement SMAPIv3 outbound migration
    - CA-409482: Using computed delay for RRD loop
    - CA-411319: Concurrent `VM.assert_can_migrate` failure

    * Thu May 15 2025 Bengang Yuan <bengang.yuan@cloud.com> - 25.19.0-1
    - [maintenance]: bool is a keyword in newer C versions, cannot be a parameter
    - CP-307947: cleanup database interface
    - Mux mirror failure check for SXM
    - Bring back DATA.MIRROR.list and DATA.MIRROR.stat
    - Add more debugging to storage_smapiv1_migrate
    - CP-307958: database: small lock and RPC tweaks + benchmarks
    - CA-408492: Keep backwards compatibility for SMAPIv2

    * Fri May 09 2025 Bengang Yuan <bengang.yuan@cloud.com> - 25.18.0-1
    - CP-52880: [XSI-1763]: Xapi_vdi.update_allowed_operations is slow
    - Add additional tracing to VBD plug/unplug
    - CP-53554: Split plug xenopsd atomic into attach/activate
    - CP-53555: Split unplug atomic into deactivate/detach
    - Move update_snapshot_info_dest to storage_mux
    - Refactor Storage_smapiv1.find_vdi
    - Use the new scan2
    - Add new interface for mirror operation in SMAPIv3
    - Add more states for SXM
    - Remove receive_start(2) from storage_migrate
    - Change how receive_start2 is called
    - Add qcow2 as supported format by xcp-rrdd-iostat
    - CA-404946: NBD: increase timeout to match iSCSI timeout and use persistent connections
    - Update datamodel_lifecycle
    - [maintenance]: reformat dune files in sdk-gen
    - build: avoid race condition on install
    - [maintenance]: drop sexprpp
    - XAPI website link updated in README
    - xapi-log/test: Package the cram test in xapi-log
    - CA-409710: Modify the default backup parameters
    - xenopsd: Don't balloon down memory on same-host migration
    - CA-410001: Check rrdi.rrd to avoid ds duplicate
    - xapi_xenops: Avoid a race during suspend
    - CP-54828: RBAC: Avoid raising exception on happy path
    - CP-54827: Optimize pool object
    - CP-54826: Mutex.execute: avoid costly backtrace formatting in finally
    - CA-403867: Block pool join if IP not configured on cluster network

    * Thu Apr 24 2025 Bengang Yuan <bengang.yuan@cloud.com> - 25.17.0-1
    - xe-reset-networking: Avoid truncating IPv6 addresses
    - networkd: simplify parsing of config
    - networkd: read IPv6 entries in the firstboot management config file
    - xapi: Log exceptions in check_network_reset
    - CA-408230: Enable destroy op for HA statefile VDI after HA is disabled
    - CP-52131/CP-53474: Reorder operations during pci_add
    - xapi_guest_agent: Update xenstore keys for Windows PV drivers versions
    - tests: Add Windows PV driver version parsing test to test_guest_agent
    - Explicitly define failures for SXM
    - Define the utility function for choosing the backend
    - Move the copying function to storage_smapiv1_migrate
    - Move MigrateRemote before MigrateLocal
    - Move `find_local_vdi` utility function
    - Split Storage_migrate.start
    - Remove duplicate Storage_migrate.stop impl
    - Implement send_start for SMAPIv1
    - doc: Add sxm mux design
    - doc: Add an overview of SXM
    - doc: Add error handling of SXM
    - CA-409628: Do not lose the original backtrace in log_backtrace
    - Update cluster-stack-version lifecycle
    - CP-54034: Expose `expected_votes` in Cluster object

    * Tue Apr 15 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.16.0-1
    - CP-54072: Create template for storage_smapi{v1,v3}_migrate
    - CA-401023: Remove smapi observer config if smapi is set as experimental
    - xapi_message: Implement proper expression handling in get_all_records_where
    - CP-54026: option to control VM-internal shutdown behaviour under HA
    - CP-53951: Drop SSL and Lwt dependency from XAPI
    - quicktest: Add a test verifying Message.get_all_records_where filtering
    - CI: allow XAPI linking with Lwt for now
    - Check that there are no changes during SR.scan
    - CA-408843: XSI-1852: Set encryption type of machine account
    - CP-52745: Add `ThreadLocalStorage` in `Threadext`
    - CA-409488: prevent Xenctrl exceptions from escaping on VM boot/shutdown races
    - CA-409489: prevent running out of pages with lots of domains
    - rrd_file_writer: protect against resource leak
    - Raise log level for rrd thread monitor
    - xapi-aux: Add function to return all management ip addresses
    - gencert: Allow adding more than one IP as the certificate subject
    - network_server: add gateway and dns options to DHCP6
    - opam: update xapi-storage-cli metadata

    * Fri Apr 11 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.15.0-3
    - Bump release and rebuild

    * Tue Apr 08 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.15.0-2
    - Bump release and rebuild

    * Tue Apr 08 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.15.0-1
    - CP-53313: Add field services in VM_guest_metrics
    - CP-53314: Read and watch <domain>/data/service in xenstore to DB
    - Define SR_CACHING capability
    - CP-52365 fix up driver-tool invocations
    - CA-408339: Respect xenopsd's NUMA-placement-policy default
    - Use records when accumulating events
    - Remove mutable last_generation from Xapi_event
    - Factor out event reification
    - Use record type for individual event entries
    - xenctrlext: do not truncate the amount of memory in claims to 32 bits
    - CA-407177: Fix swtpm's use of SHA1 on XS9
    - forkexecd: do not tie vfork_helper to the forkexec package
    - opam: add missing dependencies to packages
    - Simplify code by using get_trace_context
    - CA-404460: Expose Stunnel_verify_error for mismatched or corrupted certificate, and expose ssl_verify_error during update syncing
    - CA-408550: XSI-1834: Host netbios name should be added to local
    - CP-54020: Refactor sxm and storage_mux code
    - CA-408500: Remove ListFile with Xapi_stdext_unix.Unixext
    - CP-53472: Create parent for add_module spans
    - xapi-stdext-threads, test: use stable testing interface
    - CA-408841 rrd: don't update rrds when ds_update is called with an empty datasource array
    - Remove xapi-stdext-date
    - CP-50836: Add VM_migrate_downtime and request_shutdown spans
    - opam: move all opam files to the opam subdir
    - numa: add test binary that prints changes in free memory and domain lifetime
    - CP-53658: adapt claim_pages to new version with numa node parameter
    - xenctrl: Don't use numa_node in domain_claim_pages calls
    - xenopsd: log_reraise doesn't ignore the result
    - CP-54065, xenopsd: use domain_claim_pages on a single node, if possible
    - xenopsd/xc: Do not try to allocate pages to a particular NUMA node
    - xapi_vm_migrate: Avoid duplicate, overly-strict CBT check on VDIs
    - Update datamodel lifecycle VM_guest_metrics.services
    - CA-408048 add library to represent version strings
    - CA-408048 remove SM plugins from DB if unavailable

    * Tue Mar 18 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.14.0-1
    - IH-533: Remove usage of forkexecd daemon to execute processes
    - Add opam local switch in gitignore
    - xenopsd: start vncterm for PVH guests

    * Mon Mar 17 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.13.0-1
    - CP-48824: Increase xenopsd worker-pool-size to 25
    - CP-52074: Add systemctl enable and disable API
    - CP-53161: Pass `baggage` back into `xapi` from `smapi`.
    - CA-405864: Drop usage of init.d functions
    - doc: Update xapi storage layer code links
    - CA-405864: Fix shellcheck warnings
    - CP-53827, xenopsd: claim pages for domain on pre_build phase
    - CI: fix compile_commands.json caching
    - Resolve build failure in message_forwarding.ml
    - CP-48676: Reuse pool sessions on slave logins.
    - xapi-stdext-date: replace all usages to use clock instead
    - CA-408126 follow-up: Fix negative ds_min and RRD values in historical archives

    * Wed Mar 12 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.12.0-1
    - Revert "CA-403851 stop management server in Pool.eject ()"

    * Tue Mar 11 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.11.0-1
    - Design proposal for supported image formats
    - (docs) Describe the flows of setting NUMA node affinity in Xen by Xenopsd
    - CA-407687/XSI-1834: get_subject_information_from_identifier should
    - CA-408126 - rrd: Do not lose ds_min/max when adding to the RRD
    - Change Ocaml version in readme
    - CA-403851 stop management server in Pool.eject ()

    * Fri Mar 07 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.10.0-1
    - CA-407328: Change vm parameter names of SXM calls
    - CP-53708: Expose the existing PCI vendor/device IDs
    - CP-53444: For XenServer 9, remove python dnf plugins
    - XSI-1821: Add pre-condition for host.emergency_reenable_tls_verification
    - CP-50934: fix qemu cgroups to be compatible with cgroupv2
    - opam: move stunnel metadata to dune-project
    - stdext: replace all ignore_type with annotated ignores
    - xapi_vdi_helpers: actually write raw vdi when possible
    - CA-399631: Increase the max size of xcp-rrdd-plugins for bug-tool
    - CP-53779: Guard all `Tgroup` library call behind `tgroups-enabaled`
    - CI: add a codechecker workflow
    - [maintenance] xa_auth.h: avoid using reserved macro names
    - unixpwd.c: fix error path file descriptor leak
    - [maintenance] syslog_stubs.c: avoid using reserved identifier names
    - [maintenance] blkgetsize64: avoid warning about uninit value
    - CP-53747 document PEM/Certificate relation
    - c_stubs: use 'new' acquire and release runtime functions
    - Hoist value access outside section without lock
    - CA-407370: Use remote.conf for customer rsyslog forwarding rules
    - Revert: Refactor Xapi_event #6306

    * Mon Mar 03 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.9.0-2
    - Bump release and rebuild

    * Thu Feb 27 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.9.0-1
    - Design proposal to support import/export of Qcow2 VDI
    - message_forwarding: Change call_slave_... functions to reduce repetition
    - Revert "CA-403867: Block pool join if IP not configured on cluster network"

    * Wed Feb 26 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.8.0-1
    - CP-52744: Thread `TraceContext` as json inside debug_info
    - Use records when accumulating events
    - Remove mutable last_generation from Xapi_event
    - Use record type for individual event entries
    - CA-403867: Block pool join if IP not configured on cluster network
    - CA-403744: Implement other_config operations
    - CP-45795: Decompress compressed trace files without Forkexecd
    - CP-53362: Rename hcp_nss to nss_override_id
    - CP-52365 adjust interface to dmv-utils
    - CA-407033: Call `receive_finalize2` synchronously
    - Add internal links to XenAPI reference
    - CA-405643: Update DNF to DNF5
    - Add filter_by to Dm_api
    - Use Cmdliner for gen_api_main.exe
    - CA-407322 - libs/rrd: Keep lastupdate XML field as int, XenCenter relies on it

    * Mon Feb 24 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.7.0-2
    - Bump release and rebuild

    * Tue Feb 18 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.7.0-1
    - CP-51393: Datamodel: update Repository for syncing from a remote pool (#6049)
    - CP-51835: Keep the HTTP /repository handler enabled
    - CP-50789: Enable verified rpc to external host
    - CP-51836: Restrict/check binary_url of remote_pool repository
    - CP-51391: Implement handling for /repository/enabled
    - CP-51988: Fix functions not work for remote_pool repo
    - CP-50787 CP-51347: Support pool.sync_updates from remote_pool repo
    - CP-52245: Temp disable repo_gpgcheck when syncing from remote_pool repo
    - Revert "CP-52245: Temp disable repo_gpgcheck when syncing from remote_pool repo"
    - python3: Add previously unused API classes to Python stubs used during testing
    - CA-404660: Refine repository enabling error message
    - doc: walkthroughs/VM.start: Update the xenguest chapter (domain build)
    - debug traces for is_component_enabled
    - CP-53470 Additional spans in & around the pause section in VM.migrate
    - Hugo docs: Support dark themes: Invert images to match the theme
    - README: Submission: Add DCO, issues & remove the disabled xen-api list
    - docs/xenopsd: List the child pages using the children shortcode
    - CA-405820 guard /etc/init.d/functions in xe-toolstack-restart
    - Simplify cases of may_be_side_effecting
    - Drop count_mandatory_message_parameters
    - message-switch/unix: simplify the scheduler
    - docs: Add dedicated walk-throughs for VM.build and xenguest
    - xenopsd docs: Add Walk-through descriptions, show them on the index page
    - python3: Resurrect metrics.py helper script
    - python3: Resurrect a metricsgraph.py helper script
    - CA-406403: Do not return HTTP 500 when Accept header can't be parsed
    - Replace startswith and endswith with stdlib calls
    - Domain.build docs: Improve notes on node_affinity, move to new page
    - (docs) VM.migrate.md: Rephrase and simplify, improve readability

    * Wed Feb 12 2025 Vincent Liu <shuntian.liu2@cloud.com> - 25.6.0-2
    - Bump release and rebuild


author: Pau Ruiz Safont <pau.safont@vates.tech> - 25.33.1-2.1
changelog:
  - Update to upstream 25.33.1-2
  - *** Upstream changelog ***
    * Thu Oct 30 2025 Rob Hoes <rob.hoes@citrix.com> - 25.33.1-2
    - Bump release and rebuild
    
    * Thu Oct 30 2025 Rob Hoes <rob.hoes@citrix.com> - 25.33.1-1
    - CA-419227 Move force_state_reset after refresh_vm
    
    * Thu Oct 16 2025 Gabriel Buica <danutgabriel.buica@cloud.com> - 25.33.0-2
    - CP-53573: Enable NUMA placement in XS9
    
    * Tue Oct 14 2025 Gabriel Buica <danutgabriel.buica@cloud.com> - 25.33.0-1
    - Update dune lang to 3.20
    - Avoid no-cmx-warning when building xapi_version
    - CP-308455 VM.sysprep turn on feature
    - XSI-1969 CA-418141 more thorough resource cleanup
    - CA-417951: Split checks for migration and detecting RPU
    - CA-417951: Host.create now takes a software version argument
    - python3/perfmon: Remove broken calls to /etc/init.d/perfmon
    - Extend diagnostic-timing-stats to optionally show counts
    - xapi_vm_clone: Remove impossible, confusing case when dealing with suspend VDIs
    - CA-417020: DNS not cleared after reconfiguring to static IP without DNS
    - fix: Xen Version checks
    
    * Tue Sep 30 2025 Gabriel Buica <danutgabriel.buica@cloud.com> - 25.32.0-1
    - XSI-1969 more thorough resource cleanup
    - CP-54163: xapi: Add secure boot field to host
    - http-lib: Add filename hint to file response
    - system_status: Clean up imports, add an interface
    - system_status: Reduce logging
    - system_status: reify the output types for xen-bugtool
    - system_status: Group bugtool command-handling into a module
    - system_status: consolidate error-handling
    - system_status: suggest consistent filenames to clients
    - system_status: add URL parameter to show xen-bugtool entries
    - Fix missing-dependency alerts for unix and str on OCaml 5
    - Fix test for OCaml 5
    - Remove unused Xenctrlext function
    - idl: Remove apparently unused gen_test.ml
    - idl/gen_client: Don't specify argument values when they're equal to defaults
    
    * Wed Sep 24 2025 Gabriel Buica <danutgabriel.buica@cloud.com> - 25.31.0-1
    - CP-308811: Add an option to limit the span depth in tracing
    - CP-309305: Split Spans.since into chunks for exporting
    - Use a forwarder so each component updates their depth and chunk size
    - CA-416351: Slave shutdown timeout
    - rrd: Fix absolute rate calculations
    - CP-309523: Make networkd_db utility return bridge MAC address
    - xapi_vm_migrate: Fix reservations not being cleared on halted VMs
    - CP-308863: Count vGPU migrations
    - CA-416516: vm.slice/cgroup.procs write operation gets EBUSY
    - CA-367765: remove reference to obsolete default URL
    - Remove obsolete test script
    - host.disable: Add auto_enabled parameter for persistency
    - Simplify UTF-8 decoding
    - Adjust quality-gate.sh
    - xapi/nm: Send non-empty dns to networkd when using IPv6 autoconf
    - CP-53479: Add xapi-ssh-monitor script and service
    - CP-308800: Dynamically control ssh firewalld service in xapi-ssh-monitor
    - xapi-idl/network: Remove code duplication for DNS persistence decisions
    - Remove redundant check
    - xapi_pbd: use HA shared SR constraint violation when plugging and unplugging
    - xapi_pif: use HA shared network constraint violation when plugging and unplugging
    - xapi_ha_vm_failover: remove superfluous debug message
    - xenopsd: Drop unused variables in domain.ml
    - docs: Update add-function.md to fix example
    - ocaml: allow xapi to compile under OCaml 5.3
    - XSI-1987 & CA-416462: Fix RPU host evacuation version check
    - CA-417390: No RRD metric for vGPU migration with local storage
    - ocaml: prepare formatting for ocamlformat 0.27.0
    - git-blame-ignore-revs: ignore previous, formatting commit
    - networkd: Remove usage of ovs-vlan-bug-workaround
    - networkd: Remove has_vlan_accel from network_utils
    
    * Tue Sep 02 2025 Gabriel Buica <danutgabriel.buica@cloud.com> - 25.30.0-1
    - CA-411297: XAPI UTF8
    - CA-412983: HA doesn't keep trying to start best-effort VM
    - Add Xapi_globs.ha_best_effort_max_retries to eliminate hard-coding
    - Optimize with List.compare_lengths
    - Copy dependency libraries to the output folder. Build using the project file (or the build switches in it are ignored).
    - CP-308539 Added preprocessor conditions to compile with .NET 8
    - Updated language use. Removed redundant calls and initializers. Use Properties instead of public fields.
    - CP-308539 Replaced obsolete code.
    - CP-308539 Use HttpClient for .NET as HttpWebRequest is obsolete.
    - CP-44752: propagate System.Diagnostics tracing information using W3C traceparent header.
    - Action from CA-408836: Deprecate the method SaveChanges. It is a XenCenterism and not always correct.
    - libs/log: adapt backtrace test to pass on aarch64
    - ocaml/util: delete module xapi_host_driver_helpers and tests
    - Updated dependencies for PS 5.1.
    - I forgot to initialize the Roles.
    - ci: enable experimental ocaml workflow on aarch64
    - CP-308455 VM.sysprep if CD insert fails, remove ISO
    - CP-308455 VM.sysprep declare XML content as SecretString
    - CP-308539: Updated certificate validation to support .NET 8.0 in PowerShell.
    - Revert "xapi/nm: Send non-empty dns to networkd when using IPv6 autoconf (#6586)"
    
    * Wed Aug 27 2025 Andrew Cooper <andrew.cooper3@citrix.com> - 25.29.0-2
    - Rebuild against Xen 4.20
    
    * Thu Aug 21 2025 Gabriel Buica <danutgabriel.buica@cloud.com> - 25.29.0-1
    - CP-40265 - xenopsd: Drop max_maptrack_frames to 0 by default on domain creation
    - CP-40265 - xenopsd: Calculate max_grant_frames dynamically
    - Treat 64 max_grant_frames as the lower bound
    - xenopsd: Don't iterate over StringMaps twice
    - xapi_vm_helpers: Raise allowed_VIF limit from 7 to 16
    - xapi/nm: Send non-empty dns to networkd when using IPv6 autoconf
    - xapi-idl/network: Remove code duplication for DNS persistence decisions
    - CI: update pre-commit config
    - CI: update diff-cover parameters
    - Minor wording improvement
    - CP-53858: Domain CPU ready RRD metric - runnable_any
    - CP-54087: Domain CPU ready RRD metric - runnable_vcpus
    - CP-308465: RRD metric "runnable_vcups": rebase on top of xen.spec/PR#481
    - python3/usb_scan: Skip empty lines in usb-policy.conf, add more comments
    - Changed the order of operations so that the sources are stored before any CI runs.
    - CA-413254: Sort and remove duplicate serialized types.
    - message_forwarding: Log which operation is added/removed from blocked_ops
    - xe-cli: Allow floppy to be autocompleted
    - CA-415952: HA can not be enabled
    
    * Wed Aug 06 2025 Gabriel Buica <danutgabriel.buica@cloud.com> - 25.28.0-1
    - CA-413424: Enhance xe help output
    - CP-308455 VM.sysprep CA-414158 wait for "action" key to disappear
    - Disable SARIF upload for now: they are rejected
    - CP-308455 VM.sysprep CA-414158 wait for "action" key to disappear (#6604)
    - CP-309064 Add SSH Management feature design
    - CA-414418: Detection of AD account removal does not cause logout
    - CA-414418: Perf: save user validate result and apply to sessions
    - CA-414418: Code refine for comments
    - CA-414627: increase polling duration for tapdisk
    - Update datamodel lifecycle


author: Pau Ruiz Safont <pau.safont@vates.tech> - 26.0.0-1.1
changelog:
  - qcow-stream-tool: Avoid stack overflows in read_headers
  - Update to upstream 26.0.0-1
  - *** Upstream changelog ***
    * Thu Jan 08 2026 Rob Hoes <rob.hoes@citrix.com> - 26.0.0-1
    - CP-54473 Implement max-state setting
    - Add host.max_cstate and host.set_max_cstate
    - update last_known_schema_hash
    - CP-54471 Add ntp operations
    - CP-54471 Add host.ntp_mode and host.ntp_custom_servers
    - CP-54471 Add host.enable/disable_ntp
    - CP-54471 Add ntp config dbsync
    - CP-308854 Add host.get_ntp_servers_status
    - Update last_known_schema_hash
    - CP-308544 Promote legacy default ntp servers
    - rrdp-dcmi: Detect more errors on discovery
    - [doc] Add host-ntp-time feature doc
    - CP-308545 Add host.timezone
    - Update last_known_schema_hash
    - CP-308856 host.get_ntp_synchronized
    - CP-308855: host.set_servertime
    - CP-54476 Merge ntp disable/enable to ntp mode
    - Use timedatectl to enable/disable ntp
    - Fix `/run/chrony-dhcp` does not exist
    - Update datamodel lifecycle and bump schema
    - CA-420533: Only clear RestartVM guidance on up-to-date hosts
    - qcow-stream-tool: Add read_headers command
    - python3: Use pre-parsed cluster allocation data in qcow2-to-stdout
    - vhd_tool_wrapper: Make vhd_of_device generic
    - qcow_tool_wrapper: Read headers of QCOW2-backed VDIs on export
    - qcow_tool_wrapper: Implement parse_header to determine allocated clusters
    - Update lifecycle
    - opam: add missing dependencies
    - CA-420856: Re-read inventory file when resetting network
    - opam: generate metadata for uuid with dune
    - libs: remove unused type parameters
    - git-blame: ignore another formatting commit
    - sdk-gen: make code compatible with ocaml 5.4
    - CA-421991: Fix QEMU coredumps on XS9
    - CA-421914: preserve Host.numa_affinity_policy across pool join
    - CA-421847: set vcpu affinity if node claim succeeded
    - CA-422071: preserve latest_synced_updates_applied and pending_guidances* across pool join
    - CA-422071: add unit test for Host.create_params
    - XSI-2088: CA-422080: External auth can not support large forest
    - CA-422072 Add new fields to host create params
    - XSI-2088: CA-422080: Code refine for comments
    - ocaml/xapi-idl: change CLI help tests
    - ocaml: prepare formatting for new ocamlformat
    - coverage: remove dependency on bisect_ppx
    - CP-310867 Sort output of diagnostic-timing-stats
    - XSI-2093: CA-422229: Host should not register all IPs to DNS server
    - [doc] Improvements on management of trusted certificates
    - CA-422282 Fix race condition about xenops cache
    - libs: add try_map to listext
    - database: Make a custom exception when fetching of db connections fails
    - ocaml: remove usages of List.hd
    - ocaml/libs: List.last and List.head now return options
    - ocaml: replace List.(hd (rev list)) with List.last
    - ocaml: use new List.head instead of List.nth_opt
    - vhd-tool: Add read_headers command for determining allocated blocks
    - stream_vdi: Factor out send_one into a top-level function
    - xapi_vdi_helpers: Move backing_file_of_device from vhd_tool_wrapper
    - xapi_vdi_helpers: Split backing_file_of_device in two
    - vhd_tool_wrapper: Add parse_header to determine allocated blocks
    - stream_vdi: Only process allocated clusters for VHD and QCOW
    - tapctl: Return Option instead of raising Not_found
    - stream_vdi: Move to using Mtime_clock.counter
    - dune-project: Add yojson as vhd-tool dependency
    - vhd_qcow_parsing: Only use the basename in the with_logfile_fd call
    - CA-422187: fix NUMA on XS8
    - xenops: Fix migrate parameter ordering
    - libs: add Stat module in Unixext to handle special device IDs
    - ocaml: Unify handling of major and minor device IDs
    - vhd_tool_wrapper: generate detailed errors when getting tapctl devices
      
    * Fri Dec 05 2025 Steven Woods <steven.woods@citrix.com> - 25.39.0-1
    - CA-420968: compute the amount of physical cores available on a NUMA node set
    - CA-420968: ensure compatibility between NUMARequest.fits and plan
    - CA-420968: track number of physical cores during a NUMA planning request
    - CA-420968: introduce an explicit name for the current NUMA policy: Prio_mem_only
    - CA-420968: avoid large performance hit on small NUMA nodes
    - [doc] add missing command to xs-trace
    - numa_placement: use Seq instead of List
    - CA-419908: Move module Watcher ahead for future use in module VM
    - s/xe-syslog-reconfigure: Keep disclaimer in remote.conf
    - opam: update metadata
    - ocaml/xapi: remove unused xmlrpc_sexpr module
    - ocaml/libs/http-lib: remove unused mime module
    - ocaml: reduce and guard all users of Pool.get_all |> List.hd
    - CA-419908: Update xenstore watcher to refresh domains when VM is renamed
    - Refactor IntMap to use built-in Int module in Map.Make
    - CP-309847: Make HTTP/80 configurable
    - CP-31566 define xenopsd fast resume operation
    - fixup! CP-31566 define xenopsd fast resume operation
    - increase max supported NVMe request size
    
    * Thu Nov 27 2025 Steven Woods <steven.woods@citrix.com> - 25.38.0-1
    - Refactor: Rename Http.Request.uri -> path
    - RPC: Add "/RPC2" route for the RPC handler
    - Compute PCI device directory only once
    - CA-418993: Enable PCI ROM BAR before attempting to give permissions to the VM
    - [doc] fix typo in command to create new certificates
    - rrdd: Add HTTP paths /host_rrds and /vm_rrds
    - nbd: use URI type for /var/xapi/xapi socket
    - idl: Remove FIXME comment in datamodel_pool
    - CP-49045: add unit test for db_get_by_uuid when a uuid is changed
    - CP-49045: factor out uuid_of_row
    - CP-49045: update UUID index when the uuid is changed
    - CP-49045: optimize database uuid lookup: use index
    - Reuse Filename.concat and // operator
    - quicktest: Add delta tests for VHD data integrity suite
    - Correct parameter description in assert_can_migrate
    - CA-418227: Handle exceptions in At_least_once_more.again
    - CA-418227: Catch exceptions from host.update_allowed_operations
    - CA-418227: Detect rolling upgrade after setting software_version
    - CA-421084: xstringext: Improve performance of escaped
    - xstringext: Test escaped against reference implementation
    - xstringext: Add benchmark for escaped
    - quicktest: Add qcow to VDI integrity tests
    
    * Wed Nov 12 2025 Steven Woods <steven.woods@citrix.com> - 25.37.0-1
    - xapi-stdext: remove unused functions from listext
    - xapi-stdext: consolidate listext's chop tests
    - xapi-stdext: introduce split_at to listext
    - xapi-stdext: replace List's chop with split_at
    - stunnel_cache: remove ad-hoc chop implementation
    - stunnel_cache: use timestamps for cache evictions instead of IDs
    - [perfmon] Fix typo in variable name
    - xapi: remove some usages of common, exception-raising functions
    - xapi-consts: use a variant to reify valid values of cluster stack
    - xapi: open firewall for XHAd only if xHAd is actually selected
    - localdb: expose option-based get functions
    - xapi_ha: avoid raising Not_found when joining a liveset
    - quality-gate: capture more unnecessary List.length cases
    - xapi_ha: add more information to not found errors
    - CA-419238: Remove /etc/dnf/repos.override.d/99-config_manager.repo after using
    - quicktest: reduce indentation in vdi module
    - quicktest: test tags being copied on vdi clone and snapshot
    - xapi_vdi: copy tags on VDI clone and snapshot
    - CP-309791: Update samba to 4.21
    - CP-310555: Rotate machine password through winbind
    - Rename encode_bdf function
    - XSI-2025: Only abort HA host reenable for unpluggable PIFs
    
    * Fri Oct 31 2025 Steven Woods <steven.woods@citrix.com> - 25.36.0-1
    - Move xenopsd's xenctrl_ext to ocaml/libs/
    - Add Makefile for with "format" target
    - Fix front matter for Hugo
    - CA-419227 Add logs for debug
      - CA-419227 Move force_state_reset after refresh_vm
    - docs: add documentation about setting up alarms
    
    * Wed Oct 29 2025 Steven Woods <steven.woods@citrix.com> - 25.35.0-1
    - [doc] Host network device ordering
    - CP-44103: Ordering network devices - IDL changes
    - CP-44103: Ordering network devices - ordering logic
    - CP-44103: Unit tests for ordering network devices
    - CP-54445: Filter out ibft devices which are for boot from iSCSI SAN
    - CP-44106: Update networkd config after sort
    - CP-44106: Do not clear interface_order in networkdb
    - CP-44107: Add Interface.get_interface_positions
    - CP-53614: Update xapi pif introduce
    - CP-53614: Use get_all to get net interfaces
    - CP-53718: Update device name in xapi pif refresh
    - Minor change: correct comments
    - CP-44105: Adjust Net.reset_state for pool.eject_self
    - CP-53719: Update monitor and collecting list for host network devices
    - CP-308116: Write management_address_type to inventory
    - CP-308116: Update hard code eth in network-init
    - CP-54444: Return MAC addresses to host installer
    - Change expect files for networkd command
    - CP-308260: Handle networkd upgrade
    - CP-308260: Generate changed_interfaces list for upgrade
    - CP-308260: Update inventory after upgrade
    - CP-308115 Ensure networkd start after systemd-udev-settle.service
    - Fix review comments
    - CP-54441 Adapt interface ordering in xe-reset-networking
    - Use systemctl to stop xapi service in xe-reset-networking
    - CP-308450 Refine the bridge name converting
    - CP-308450 Use the position in new network name_label
    - CP-54468 Handle USB network devices in network devices sort
    - CA-414651 Fix device rename in PIF after RPU
    - Sync pif.device when its type is vlan or sriov
    - Delete unused function Xapi_pif.refresh
    - Abstract get_pif_position in xapi_pif_helpers
    - Copy bonds from master using pif position
    - Copy network sriovs from master using pif position
    - ocaml/libs: Check if blocks are filled with zeros in vhd_format
    - zerocheck: write a failing test
    - zerocheck: fix check for strings longer than 2 GiBs
    - zerocheck: exposing the length to users is unsafe and not needed
    - datamodel_lifecycle: fix release of functions from #6717
    - Update datamodel_lifecycle
    - CA-418759: Failed to start attach-static-vdis
    - Make CI shellcheck happy
    - unixpwd: putpwent() is GNU extension
    - forkexecd: memcpy() and strcpy() comes from string.h
    - forkexecd: explicitly cast `struct sockaddr_un` to `struct sockaddr`
    - Add numa.md design sketch; new fields to to VM_metrics.
    
    * Wed Oct 22 2025 Steven Woods <steven.woods@citrix.com> - 25.34.0-1
    - CP-308927 Add nr_nodes in host.cpu_info to expose numa nodes count
    - CP-308873 Update software_version to reflect the newly applied livepatch after apply_livepatch
    - CP-308800: Add firewalld control function
    - CP-308800: Dynamic control http firewall service
    - CP-308800: Dynamic control xha firewalld service
    - CP-308800: Dynamic control cluster firewalld service
    - CP-308800: Dynamic control VxLan firewalld service
    - CP-308800: Dynamic control ssh firewalld service
    - CP-308800: Revert https_only sync logic
    - CP-308800: Dynamic control iptables port
    - CP-308859 Track user_agents
    - Add unit test
    - Add host.get_tracked_user_agents
    - CP-308798: Dynamic control NBD firewalld service
    - CP-308873 Parse kernel livepatch list and drop the status
    - CP-308864 Dump the pvs_target_version into VM_guest_metric.service
    - CA-417366 make_xen_livepatch_list can not Parse the Output of xen-livepatch
    - CP-309535: Extract function get_nbd_interfaces
    - CP-309535: Add a function all_service_types
    - CP-309535: Add API update_firewalld_service_status
    - CP-309535: Update firewalld service when start
    - CP-309535: Add CLI host-update-firewalld-service-status
    - CP-309535: Update datamodel_lifecycle
    - CP-309535: Add a service to update firewalld
    - CA-417520: Fix 2 HA firewalld issues
    - CP-47867: Add observer uuid to span attributes
    - More missing unix dependencies
    - CI: Add OCaml 5.3 as experimental build
    - xenopsd/bootloader: No need to create /var/run/xend/boot anymore
    - doc: change outdated information in storage
    - doc: update better VM revert proposal
    - CA-418960: VM with vTPM Delete doesn't remove the snapshot


author: Pau Ruiz Safont <pau.safont@vates.tech> - 26.1.3-1.1
changelog:
  - Update to upstream 26.1.3-1
  - Provide configuration for NTP servers, keep the previous servers for now
  - *** Upstream changelog ***
   * Tue Feb 10 2026 Rob Hoes <rob.hoes@citrix.com> - 26.1.3-1
   - CA-423708: xapi: Wrap {vhd,qcow}-tool read_header invocation in a thread

   * Fri Feb 06 2026 Rob Hoes <rob.hoes@citrix.com> - 26.1.2-1
   - XSI-2128: Ignore RBAC when destroying internal tasks

   * Wed Feb 04 2026 Rob Hoes <rob.hoes@citrix.com> - 26.1.1-1
   - lifecycle: refresh with version 26.1.0
   - ci: prepare for lcm status
   - Check that suspend SR has enough space to save VM state
   - CP-311102: Make migration timeouts configurable
   - qcow-stream-tool: Use tail-recursive functions in read_headers
   - Don't depend on LANG for running tests
   - CA-419840 improve logging for VDI.forget
   - CA-419840 mark CD VBD as empty when its VDI is removed
   - CA-422713: XSI-2105: Pool.join failed due to AD status corrupt
   - CA-422713: Reset numbered_release for lcm
   - xapi_sm: remove nested call to serialize function
   - xapi_sm: add interface
   - listext: add better description to set_difference
   - storage_access: split the code off that queries message switch for SMAPIv2 plugins
   - storage_access: share code for unregistering plugins
   - storage_access: avoid the addition of multiple SM with the same type
   - xapi_sm: Don't allow host_pending_features that are empty
   - storage_access: log when there are SM duplicates on startup
   - CA-423369: fix suspend-SR space check

   * Tue Jan 13 2026 Rob Hoes <rob.hoes@citrix.com> - 26.1.0-1
   - CP-54217: Add a new pool level field to limit the vnc console access
   - CP-54216: Add a new pool level field to set guest console idle timeout
   - CP-54393: A simple RFB protocol parser for VNC console connections
   - CP-54393: VNC console idle timeout
   - CP-54274: Send a meaningful error message for vnc connection limits
   - CP-310425: Add username in VNC console error messages
   - dune-project: Move vhd-format.opam to be generated by dune, add yojson dependency
   - xapi_vm_migrate: share function to check capabilities
   - xapi_vm_migrate: add capabilities to migration not supported by sr error
   - ocamlformat: avoid bug in newest version of the tool
   - ocaml: format using `make format` with ocamlformat 0.28.1


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 8.3.0-27
changelog:
  - Loosely sync with xenserver-release-8.4.0-11
  - *** Upstream changelog ***
  - * Tue Jun 18 2024 Gerald Elder-Vass <gerald.elder-vass@cloud.com> - 8.4.0-11
  - - CP-47026: Move mcelog config changes to mcelog.spec


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 8.3.0-28
changelog:
  - Update repo files for CentOS and EPEL
  - Point at repo.vates.tech for CentOS since mirrorlist.centos.org was cut
  - Add "(EOL)" to repo descriptions for EOL repos
  - Drop unused repos


author: Lucas Ravagnier <lucas.ravagnier@vates.tech> - 8.3.0-29
changelog:
  - Add 0001-fix-curl-resolve-TLS-issue-caused-by-restrictive-con.patch
  - This adds a cipher to '.curlrc' to fix a TLS Handshake Error with xoa.io


author: Yann Dirson <yann.dirson@vates.tech> - 8.3.0-30
changelog:
  - Sync with xenserver-release-8.4.0-14:
    - 0001-Sync-vm.slice-with-xenserver-release-v8.4.0-12.tar.g.patch
    - 0002-Sync-systemd-presets-with-xenserver-release-v8.4.0-1.patch
    - Pull xcp-python-libs-compat (dropped from xapi deps between
      4.19 and 4.39)
  - *** Upstream changelog ***
    * Thu Dec 05 2024 Frediano Ziglio <frediano.ziglio@cloud.com> - 8.4.0-14
    - CA-403415: Install xcp-python-libs-compat for XS8
    * Fri Oct 04 2024 Ross Lagerwall <ross.lagerwall@citrix.com> - 8.4.0-13
    - Enable new RRDD plugins
    * Fri Sep 20 2024 Mark Syms <mark.syms@cloud.com> - 8.4.0-12
    - CA-399511: Change systemd dependencies for vm.slice


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 8.3.0-31
changelog:
  - Rebuild for updated branding-xcp-ng
  - Loosely sync with xenserver-release-8.4.0-15 (no real change, just a merge point)
    * Thu Jan 23 2025 Gerald Elder-Vass <gerald.elder-vass@cloud.com> - 8.4.0-15
    - CP-53338: Rebuild to pick up branding changes to 8.4


author: Andrii Sultanov <andriy.sultanov@vates.tech> - 8.3.0-32
changelog:
  - Fix patches that weren't properly generated and included in the specfile:
    - 0002-Sync-vm.slice-with-xenserver-release-v8.4.0-12.tar.g.patch
    - 0003-Sync-systemd-presets-with-xenserver-release-v8.4.0-1.patch


author: Anthoine Bourgeois <anthoine.bourgeois@vates.tech> - 4.17.5-15.2
changelog:
  - Backport 22650d605462 "x86/hvmloader: select xen platform pci MMIO BAR UC or WB MTRR
    cache attributes"
  - Backport fd06f8700769 "tools/golang: update auto-generated libxl based types"


author: Yann Sionneau <yann.sionneau@vates.tech> - 4.17.5-18.1
changelog:
  - Sync with 4.17.5-18
  - Drop 0001-x86-hvmloader-select-xen-platform-pci-MMIO-BAR-UC-or.patch, applied upstream
  - *** Upstream changelog ***
    * Tue Aug  5 2025 Andrew Cooper <andrew.cooper3@citrix.com> - 4.17.5-18
    - Domain runstate extentions for more RRDs
    - Mwait-idle updates for Intel Alder Lake thru Granite Rapids platforms

    * Wed Jul 23 2025 Roger Pau Monné <roger.pau@citrix.com> - 4.17.5-17
    - Fix bad interaction of cache attribute relax with vGPU

    * Tue Jul 22 2025 Roger Pau Monné <roger.pau@citrix.com> - 4.17.5-16
    - Relax cache attributes for Xen Platform PCI device BAR
    - Optimize flushing of Intel PML buffer


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 4.17.5-20.1
changelog:
  - Sync with 4.17.5-20
  - Use xsa472-[123].patch provided by XenServer
  - *** Upstream changelog ***
    * Mon Sep 01 2025 Roger Pau Monné <roger.pau@citrix.com> - 4.17.5-20
    - Fix for XSA-472 CVE-2025-27466 CVE-2025-58142 CVE-2025-58143

    * Thu Aug 28 2025 Roger Pau Monné <roger.pau@citrix.com> - 4.17.5-19
    - Add support for 4 or more socket Intel Granite Rapids systems
    - Fix usage of PCI devices on segments other than 0


author: Thierry Escande <thierry.escande@vates.tech> - 4.17.5-21.1
changelog:
  - Sync with 4.17.5-21
  - Removed XSA-475 patches now included in 4.17.5-21
  - *** Upstream changelog ***
    * Thu Oct 09 2025 Roger Pau Monné <roger.pau@citrix.com> - 4.17.5-21
    - Fix for XSA-475 CVE-2025-58147 CVE-2025-58148
    - Use superpages where possible on migrate/resume
    - Populate CPUID 0x1.edx features early for self-snoop detection


author: Thierry Escande <thierry.escande@vates.tech> - 4.17.5-23.1
changelog:
  - Sync with 4.17.5-23
  - *** Upstream changelog ***
    * Thu Dec 04 2025 Andrew Cooper <andrew.cooper3@citrix.com> - 4.17.5-23
    - Support the new Linux AMD microcode container format with multiple blobs per
      CPU, to cope with pre-EntrySign firmware.
    * Mon Oct 27 2025 Roger Pau Monné <roger.pau@citrix.com> - 4.17.5-22
    - Fix for XSA-476 CVE-2025-58149
    - Support passthrough of devices on PCI segment different than 0


author: Thierry Escande <thierry.escande@vates.tech> - 4.17.6-2.1
changelog:
  - Sync with 4.17.6-2
  - Drop patches for XSA-477 and XSA-479 from the XCP-ng patches section, now
    provided in the main patches section with different names
  - *** Upstream changelog ***
   * Thu Jan 15 2026 Andrew Cooper <andrew.cooper3@citrix.com> - 4.17.6-2
   - Fix for XSA-479 CVE-2026-23553
   * Mon Dec 15 2025 Andrew Cooper <andrew.cooper3@citrix.com> - 4.17.6-1
   - Update to Xen 4.17.6


author: Tu Dinh <ngoc-tu.dinh@vates.tech> - 4.17.6-4.1
changelog:
  - Sync with XenServer 4.17.6-4
  - *** Upstream changelog ***
    * Mon Feb 23 2026 Ross Lagerwall <ross.lagerwall@citrix.com> - 4.17.6-4
    - Improve migration performance
    * Mon Feb 09 2026 Roger Pau Monné <roger.pau@citrix.com> - 4.17.6-3
    - Fix Xen watchdog triggering during domain construction.


author: Benjamin Reis <benjamin.reis@vates.tech> - 6.77.0-1.1
changelog:
  - Rebase on 6.77.0-1
  - Drop xs-opam-repo-6.74.0-metajson.XCP-ng.patch
  - *** Upstream changelog ***
    * Wed Jan 31 2024 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.77.0-1
    - Remove xapi-rd, xapi-inventory and xapi-stext-* packages

    * Wed Dec 20 2023 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.76.0-2
    - Bump release

    * Tue Dec 19 2023 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.76.0-1
    - upstream: update ocamlformat to the latest version
    - update inotify to 2.5.0 and uri to 4.4.0

    * Fri Nov 17 2023 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.75.0-1
    - xs: update xapi-rrd to 1.11.0


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 6.78.0-1.1
changelog:
  - Rebase on 6.78.0-1
  - *** Upstream changelog ***
    * Thu Mar 07 2024 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.78.0-1
    - Add patch for rpclib to accept empty variants
    - Non-breaking update of upstream dependencies


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 6.80.0-1.1
changelog:
  - Rebase on 6.80.0-1
  - *** Upstream changelog ***
    * Wed May 22 2024 Rob Hoes <rob.hoes@cloud.com> - 6.80.0-1
    - Add psq 0.2.1

    * Mon May 13 2024 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.79.0-1
    - ocaml: add 4.14.2 packages
    - upstream: update non-breaking packages


author: Yann Dirson <yann.dirson@vates.tech> - 6.86.0-1.1
changelog:
  - Update to 6.86.0-1
  - Refresh removal of dlm package (location changed in source tree)
  - Don't pass "-f" to "rm" while removing packages, to better catch upstream changes
  - Fix typo generating /etc/profile.d/opam.sh
  - Reformat changelog to allow diffing with upstream
  - *** Upstream changelog ***
    * Wed Oct 09 2024 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.86.0-1
    - Include crowbar library
    
    * Tue Oct 08 2024 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.85.0-1
    - Update Uuidm to 0.9.9
    - Use upstream folder structure, use opam-directed tools for managing it
    
    * Mon Sep 23 2024 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.84.0-1
    - CA-399172: fix potential crash in Uri.of_string
    
    * Fri Jul 26 2024 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.83.0-1
    - Patch Uri packages to add path_unencoded
    - jst-config: fix build on Fedora40
    - Metadata refresh, breaking update of upstream libraries
    - Remove systemd library
    
    * Tue Jul 02 2024 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.81.0-1
    - Update crc to 2.2.0
    - Add qcheck and qcheck-alcotest
    
    * Wed May 22 2024 Rob Hoes <rob.hoes@cloud.com> - 6.80.0-1
    - Add psq 0.2.1


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 6.87.0-1.1
changelog:
  - Update to 6.87.0-1
  - *** Upstream changelog ***
    * Tue Dec 03 2024 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.87.0-1
    - Drop dependency on async and core packages
    - Non-breaking updates of packages


author: Andrii Sultanov <andriy-sultanov@vates.tech> - 6.91.0-1.1
changelog:
  - Update to 6.91.0-1
  - *** Upstream changelog ***
    * Fri Jul 18 2025 Rob Hoes <rob.hoes@cloud.com> - 6.91.0-1
    - Add qcow-stream and its dependencies
    - packages: update xen-api's metadata

    * Tue Jun 10 2025 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.90.0-1
    - packages: update dune packages to 3.18.2
    - packages: update ocaml-xenstore to 2.4.0
    - packages: update mirage-crypto to 2.0.1

    * Mon Jun 09 2025 Bengang Yuan <bengang.yuan@cloud.com> - 6.89.0-2
    - Bump release and rebuild

    * Thu May 22 2025 Pau Ruiz Safont <pau.ruizsafont@cloud.com> - 6.89.0-1
    - packages: round of non-breaking updates (dune, ssl, others)
    - packages: update xenstore_transport to 1.4.0

    * Fri Mar 28 2025 Rob Hoes <rob.hoes@cloud.com> - 6.88.0-1
    - New HTTP packages
    - Non-breaking updates of existing packages

    * Tue Jan 21 2025 Deli Zhang <deli.zhang@cloud.com> - 6.87.0-2
    - CP-52964: Build with OpenSSL3 for XS8


author: Pau Ruiz Safont <pau.safont@vates.tech> - 6.96.0-1.1
changelog:
  - *** Upstream changelog ***
    * Fri Oct 03 2025 Rob Hoes <rob.hoes@cloud.com> - 6.96.0-1
    - Add missing oxenstored dependencies

    * Wed Oct 01 2025 Rob Hoes <rob.hoes@cloud.com> - 6.95.0-1
    - Package updates for OCaml 5.3 compatibility


author: Pau Ruiz Safont <pau.safont@vates.tech> - 6.97.0-1.1
changelog:
  - *** Upstream changelog ***
    * Thu Nov 27 2025 Rob Hoes <rob.hoes@cloud.com> - 6.97.0-1
    - qcow: update to 0.12.2
    - packages: define dlm's depext for centos-based distributions


author: Pau Ruiz Safont <pau.safont@vates.tech> - 6.99.0-1.1
changelog:
  - *** Upstream changelog ***
   * Tue Jan 13 2026 Rob Hoes <rob.hoes@cloud.com> - 6.99.0-1
   - packages: Use ocamlformat 0.28.1

   * Tue Jan 13 2026 Rob Hoes <rob.hoes@cloud.com> - 6.98.0-1
   - vhd-format: Sync with xapi
   - packages: prepare for an ocamlformat compatible with ocaml 5.4 (#750)
   - packages: update ocamlformat from 0.27.0 to 0.28.1
   - packages: patch notty 0.2.3 for ocaml 5.4
   - packages: update num to 1.6
   - packages: drop bisect_ppx from testing dependencies
   - packages: update xen-api's metadata


