# changelog

author: Tim Theisen <tim@cs.wisc.edu> - 24.0.9-1
changelog:
  - Initial Support for Enterprise Linux 10, including the x86_64_v2 platform
  - In htcondor2, empty configuration keys are now treated as non-existent


author: Tim Theisen <tim@cs.wisc.edu> - 24.9.2-1
changelog:
  - New job attribute to report number of input files transferred by protocol
  - Optional condor_schedd history log file
  - condor_watch_q can now track DAGMan jobs when using the -clusters option
  - Fix bug that caused claim failure when previous output transfer failed
  - Fix bug where access tokens were not generated from Vault tokens


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.27-1
changelog:
  - Fix bug where condor_ssh_to_job failed when EP scratch path is too long
  - Fix incorrect time reported by htcondor status for long running jobs
  - Fix bug where .job.ad, .machine.ad files were missing when LVM is in use


author: Tim Theisen <tim@cs.wisc.edu> - 24.0.10-1
changelog:
  * Mon Jul 28 2025 Tim Theisen <tim@cs.wisc.edu> - 23.10.27-1
  - Fix bug where the vacate reason was not propagated back to the user
  - HTCondor tarballs now contain Pelican 7.17.2


author: Tim Theisen <tim@cs.wisc.edu> - 24.10.2-1
changelog:
  - Remove support for old JobRouter syntax
  - New condor_dag_checker tool finds syntax and logic errors before run
  - New condor_q -hold-codes produces a summary of held jobs
  - condor_status -lvm reports current disk usage by slots on the EPs
  - Fix bug where condor_q would truncate job counts to six digits
  - Fix bug where suspended jobs did not change state to idle when vacated


author: Tim Theisen <tim@cs.wisc.edu> - 23.10.28-1
changelog:
  - Exit -code and -signal environment variables are now set for Docker jobs
  - Fix issue where ImageSize was over-reported on the Windows platform
  - HTCondor tarballs now contain Pelican 7.18.1 and Apptainer 1.4.2


author: Tim Theisen <tim@cs.wisc.edu> - 24.11.2-1
changelog:
  - Add job attributes to track why and how often a job is vacated
  - Add the ability to notify a user when their job first starts
  - Can now specify which Vault servers are trusted
  - Added htcondor2.ping() to the Python bindings


author: Tim Theisen <tim@cs.wisc.edu> - 23.10.29-1
changelog:
  - Fix flocking to pools when there are intermittent network issues
  - HTCondor tarballs now contain Pelican 7.19.3


author: Tim Theisen <tim@cs.wisc.edu> - 24.0.12-1
changelog:
  - Update condor_upgrade_check to warn about v1 Python bindings retirement
  - Update condor_upgrade_check to look for old syntax job transforms
  - All changes in 23.10.29


author: Tim Theisen <tim@cs.wisc.edu> - 24.12.4-1
changelog:
  - Add the ability to enforce memory and CPU limits on local universe jobs
  - Add the ability for condor_chirp to work within a Docker universe job
  - condor_watch_q now exits with any keyboard input
  - The shell submit keyword now works with interactive jobs
  - All changes in 24.0.12


author: Tim Theisen <tim@cs.wisc.edu> - 25.0.1-1
changelog:
  - New and improved Python bindings: classad2 and htcondor2
  - The original Python bindings have been removed


author: Tim Theisen <tim@cs.wisc.edu> - 24.0.13-1
changelog:
  - Fix bug that could cause Python job submission to crash
  - HTCondor tarballs now contain Pelican 7.20.2


author: Tim Theisen <tim@cs.wisc.edu> - 25.0.2-1
changelog:
  - Update Python file transfer plugins to use the new Python bindings
  - Fix incorrect environment when using Singularity and nested scratch


author: Tim Theisen <tim@cs.wisc.edu> - 24.0.14-1
changelog:
  - Fix problem running PyTorch jobs on multiple GPUs with
    newer versions of the CUDA library by providing long GPU IDs
    in the CUDA_VISIBLE_DEVICES environment variable


author: Tim Theisen <tim@cs.wisc.edu> - 24.12.14-1
changelog:
  - Fix interoperability problem between HTCondor-CE 24 and 25 which
    manifests as a Job Router crash when upgrading the CE to HTCondor 25
  - Fix several issues when submitting jobs with itemdata in
    the htcondor2 Python bindings
  - Fix bug when using max_idle and transfer_input_files that could result
    in the container_image to be only transferred with the first job


author: Tim Theisen <tim@cs.wisc.edu> - 24.0.15-1
changelog:
  - Fix bug where AP would fail to read job credential files
  - Fix bugs that could causes a crash in the authentication code
  - HTCondor tarballs now contain Pelican 7.21.1 and Apptainer 1.4.4


author: Tim Theisen <tim@cs.wisc.edu> - 24.0.16-1
changelog:
  - Fix floating point memory or disk request not fitting into some slots
  - Fix condor_rooster crash when unhibernate rank was not constant
  - Fix memory leak in the htcondor2.JobEventLog.events() Python method
  - condor_history -long now prints attributes in alphabetical order
  - Fix LVM setup to not timeout when creating a large volume
  - LVM creation no longer saves meta data which eventually fills the disk
  - HTCondor tarballs now contain Pelican 7.22.0 and Apptainer 1.4.5


author: Tim Theisen <tim@cs.wisc.edu> - 24.12.16-1
changelog:
  - Fix problem specifying scope or audience with a Vault-managed credential
  - Fix late materialization bug when job transform sets immutable attribute
  - Fix problem where a backfill slot would refuse claims


author: Tim Theisen <tim@cs.wisc.edu> - 25.0.6-1
changelog:
  - Initial support for openSUSE 16
  - Make HTCondor Python wheel usable with the python-slim Docker image


author: Dave Dykstra <dwd@cern.ch> - 2.12.7-2
changelog:
  - Apply pretrans transaction check to all subpackages that need to
    have their version stay in sync


author: Dave Dykstra <dwd@fnal.gov> - 2.1-1
changelog:
  - Merge LIGO changes to debian packaging
  - Move packaging/debian to debian and packaging/redhat to rpm, to work
    better with OBS and new OSG github packaging standard


author: Dave Dykstra <dwd@fnal.gov> - 2.2-1
changelog:
  - Just change the version number because the OSG github-source for
    reading spec files doesn't work with dash release tags.


author: Dave Dykstra <dwd@fnal.gov> - 2.3-1
changelog:
  - Change the changelog date on version 2.0.3 from Feb 28 2017 to
    May 28 2017 because osg-build complained about non-descending order
    of the dates.
  - Change the rpm/rpmbuild-cvmfs-config-osg development test script 
    to read from rpm instead of packaging/redhat.


author: Dave Dykstra <dwd@fnal.gov> - 2.4-1
changelog:
  - Change the server urls for the config-osg repository to use openhtc.io
    aliases when the proxy url can use DIRECT.


author: Dave Dykstra <dwd@fnal.gov> - 2.4-4
changelog:
  - Skipped release 2.4-2 and 2.4-3 to make consistent with cvmfs-config-egi.
  - Change Conflicts: cvmfs-config-default to Obsoletes: to make it
    easier to replace. Add Conflicts: cvmfs-config-egi because it
    is mutually exclusive.


author: Dave Dykstra <dwd@fnal.gov> - 2.5-1
changelog:
  - Update the configuration for the config repo to apply all the logic
    from the config repo's default.conf and common.conf.  That is, support
    USE_CVMFS_CDN and CVMFS_CLIENT_PROFILE and set default CVMFS_PAC_URLS
    covering the WLCG Web Proxy Auto Discovery.
  - Reverse the order of the fallback proxies because of the bug in 
    https://sft.its.cern.ch/jira/browse/CVM-1920


author: Dave Dykstra <dwd@fnal.gov> - 2.2-1
changelog:
  - Prevent exiting after the first token authentication
  - Close token file descriptor after use
  - Enable token debug messages
  - Implement WLCG bearer token discovery standard
  - Add libscitokens-dev build dependency on debian


author: Derek Weitzel <dweitzel@unl.edu> - 2.3
changelog:
  - Fix tokens that are bigger than 1024 bytes
  - Fix the use of $BEARER_TOKEN when accessing data
  - Allow for multiple read operations, needed on el9


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-2.1
changelog:
  - Apply security patches from Squid 6 to address security concerns since
      a version of Squid 6 suitable for frontier-squid is not available yet.
   - The following security vulnerabilities have been addressed with patches:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46724
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46847
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46848
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49285
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50269
      https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
   - The following two vulnerabilities are addressed by disabling Gopher and TRACE
      requests, respectively, in the squid.conf.proto file:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46728
      https://megamansec.github.io/Squid-Security-Audit/trace-uaf.html
   - To support SELinux, require /sbin/restorecon and apply it to the log directory,
      in addition to the cache directory.
   - Update to shoal-1.0.2 to fix setting of external_ip.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.1
changelog:
  - Upgrade to 5.9-3 tarball with the following release notes:
    - Add *.eessi.science to MAJOR_CVMFS in squid/files/postinstall/squid.conf.proto.
   - Move frontier-squid.sh from /etc/init.d to /usr/libexec/squid. Remove chkconfig
      because it is no longer needed. Move all steps of preparation of the
      frontier-squid-utils prototype files to this file to simplify future
      maintenance.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.9-3.2
changelog:
  - Fix building of RPM to properly choose Python36 or Python39.
       Also, restrict building to x86_64 architecture.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 5.10-1.1
changelog:
  - Update to squid-5.10, with release notes at
      https://github.com/squid-cache/squid/commits/v5.
      The security patches included in frontier-squid-5.9-2 have been incorporated
      into the baseline Squid code in this release.
      It also contains fixes for minor bugs and these security issues:
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25617
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23638
      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37894
      https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html
      https://megamansec.github.io/Squid-Security-Audit/ftp-fatal.html
      https://megamansec.github.io/Squid-Security-Audit/ipv6-assert.html
      https://megamansec.github.io/Squid-Security-Audit/stream-assert.html
   - For SELinux, provide proper labeling for /usr/libexec/squid/frontier-squid
      script to prevent log rotation failures.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 6.13-1.3
changelog:
  - Upgrade to 6.13-1 tarball with announcement at
     https://lists.squid-cache.org/pipermail/squid-announce/2025-February/000167.html
     and release notes at https://github.com/squid-cache/squid/releases/tag/SQUID_6_13
     squid-6 has a number of new features and changes, such as
      - TLS ServerHello
      - Log TLS Communication Secrets
      - Ban ACL key Changes in ACLs
      - Block to-local Traffic
      - RFC 9211: HTTP Cache-Status support
      - RFC 9111: Stop treating Warning specially
      - ext_kerberos_ldap_group_acl: Support -b with -D
      - Remove Gopher Protocol Support
      - Remove Outdated Tools
   - Set "memory_cache_shared on" as work-around for Squid bug 5332:
      https://bugs.squid-cache.org/show_bug.cgi?id=5332
   - Require Rock cache when workers > 1.  NOTE: This is a breaking change for
      installations with multiple workers, but necessary because of the work-around
      for bug 5332.
   - Set "request_header_access If-Modified-Since deny all" when Rock cache is used to
      avoid Squid bug 4890: https://bugs.squid-cache.org/show_bug.cgi?id=4890
   - Add patch to fix reporting of number of cache objects.


author: Carl Vuosalo <carl.vuosalo@cern.ch> 6.14-1.1
changelog:
  - Upgrade to 6.14-1 tarball with the following release notes:
     https://github.com/squid-cache/squid/releases/tag/SQUID_6_14
   - Add an "ignore_vary" option to prevent Vary headers (like those from
      Cloudflare) from interfering with caching in Rock cache, and enable
      that option by default.
   - Add a default value of "shared_transient_entries_limit 1048576" to
      reduce the chances of clashing hashes of queries while using
      multiple workers.  A clashing hash causes a query to not be cached.
      This increased value could use up to 128MB of shared memory.
   - Restored text of error messages that appear in rare cases and that were
      missing from the previous release.
   - Improved checks for cache memory configuration to allow multiple services to
      have their own cache memory values and to prevent reduction in configured
      cache memory during re-starts. Also, increased safety buffer of shared memory from
      10% to 20%.
   - Addressed security vulnerability SQUID-2025:2 Information Disclosure in Error handling:
      https://github.com/squid-cache/squid/security/advisories/GHSA-c8cc-phh7-xmxr
   - Removed obsolete in2p3, gridpp, and triumf from "acl ATLAS_FRONTIER".
   - Add a patch from v7 to avoid a "slot->sameKey()" assertion error in
      rock/RockSwapDir.cc that has been seen with multiple workers and
      causes one worker to restart and prevent a query from being cached
      until a full restart.
   - Remove cachenumfix.patch because it is now part of Squid 6.14.
  - Add support for EL10.
  - Disable admin emails from shoal-agent.
  - Changed pip3 install of obsolete Python module "netifaces" to new "netifaces-plus" to
     enable shoal-agent to run on EL10.
  - Fixed setting permissions of shoal-download directories to prevent "Permission denied"
     errors.


author: Marco Mambelli <marcom@fnal.gov> - 3.10.8
changelog:
  - Glideinwms v3.10.8
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_8/history.html
  - Release candidates 3.10.8-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.9
changelog:
  - Glideinwms v3.10.9
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_9/history.html
  - Release candidates 3.10.9-01.rc1 to 3.10.9-03.rc3


author: Marco Mambelli <marcom@fnal.gov> - 3.10.10
changelog:
  - Glideinwms v3.10.10
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_10/history.html
  - Release candidates 3.10.10-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.11
changelog:
  - Glideinwms v3.10.11
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_11/history.html
  - Release candidates 3.10.11-01.rc1 to 3.10.11-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.12
changelog:
  - Glideinwms v3.10.12
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_12/history.html
  - Release candidates 3.10.12-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.13
changelog:
  - Glideinwms v3.10.13
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_13/history.html
  - Release candidates 3.10.13-01.rc1


author: Marco Mambelli <marcom@fnal.gov> - 3.10.14
changelog:
  - Glideinwms v3.10.14
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_14/history.html
  - Release candidates 3.10.14-01.rc1 to 3.10.14-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.15
changelog:
  - Glideinwms v3.10.15
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_15/history.html
  - Release candidates 3.10.15-01.rc1 to 3.10.15-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.16
changelog:
  - Glideinwms v3.10.16
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_16/history.html
  - Release candidates 3.10.16-01.rc1 to 3.10.16-02.rc2


author: Marco Mambelli <marcom@fnal.gov> - 3.10.17
changelog:
  - Glideinwms v3.10.17
  - Release Notes: http://glideinwms.fnal.gov/doc.v3_10_17/history.html
  - Release candidates 3.10.17-01.rc1 to 3.10.17-02.rc2


author: Brian Lin <blin@cs.wisc.edu.> - 2.8.4-1
changelog:
  - HTCondor AP and CE probes now drop privileges to the 'condor' user
    if run as 'root' (SOFTWARE-5531)
  - Improve logging and failure modes when encountering unwriteable
    directories (SOFTWARE-5531)


author: Matt Westphall <westphall@wisc.edu.> - 2.8.5-1
changelog:
  - Log gratia probe failures to aid debugging (SOFTWARE-6037)
  - Fix NameError in post-install script (SOFTWARE-5558)


author: Matt Westphall <westphall@wisc.edu.> - 2.9.1-1
changelog:
  - Advertise the following ClassAd attributes in condor-ap (SOFTWARE-6257):
  - OSG_INSTITUTION_ID, MachineAttrOSG_INSTITUTION_ID0,  
  - GLIDEIN_Site, MachineAttrName0, MachineAttrGLIDEIN_ResourceName0, MachineAttrGLIDEIN_Site0


author: Tim Theisen <tim@cs.wisc.edu> - 23.0.18-1
changelog:
  - Does not pass WholeNode request expressions to non-HTCondor batch systems
  - Fix certificate subject parsing in condor_ce_host_network_check


author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Update httokensh to by default set the minimum vault token time to live to
    6 days, and to make sure that the background refresh never gets a new vault
    token.
  - Changed the preferred name of httokendecode to htdecodetoken, keeping
    links in the opposite direction.
  - Add man pages for httokensh, htdestroytoken, and htdecodetoken.


author: Dave Dykstra <dwd@fnal.gov> 2.0-1
changelog:
  - Replace use of m2crypto and pyOpenSSL with urllib3
  - Replace use of pykerberos with gssapi
  - Use standard Requires for Python modules instead of PyInstaller
  - Add --vaultcertname option to specify an alternative certificate name.
    That used to be an additional optional meaning of the --vaultalias option,
    but urllib3 requires only one name to match.
  - Add setuptools build infrastructure
  - Refactor htgettoken script into module with entry point.
    This enables invoking htgettoken as `htgettoken.main()` from Python.
  - Use wheels to build/install Python package, which simplified the entry
    points and improves (slightly) the metadata
  - Fix the httokensh background process's check for its parent process.
    That is only a backup in case only the parent process is hard-killed,
    because normally the parent process kills the background process when
    the parent exits.
  - Use newer `sts` secrets API for token exchanges.
  - Fix the `-o`/`--outfile` option to work with relative paths. 
  - Change the `--nobearertoken` option to always get and save a vault token.


author: Dave Dykstra <dwd@fnal.gov> 2.0-2
changelog:
  - Fix broken httokendecode symlink.
  - Use python wheels to build/install on el9.  It didn't work on el8 so
    the use of wheels was removed at the last minute before the 2.0-1
    release (without removing it from the changelog like it should have).


author: Dave Dykstra <dwd@fnal.gov> 2.1-1
changelog:
  - Fix htdecodetoken to work with token files that do not end in a newline.
  - Support args in htgettoken.main() Python entry point.


author: Dave Dykstra <dwd@fnal.gov> 2.2-1
changelog:
  - Add BuildRequires python3-devel to generate correct Python metadata.
  - Remove explicit Requires for python dependencies, rely on Python metadata.
  - Always build with wheels.
  - Remove Python root logger configuration.


author: Dave Dykstra <dwd@fnal.gov> 2.4-1
changelog:
  - Add the new -s and -f options to the htdecodetoken usage summary.
  - Add a -v option to htdecodetoken to show the token source.


author: Dave Dykstra <dwd@fnal.gov> 2.5-1
changelog:
  - Add htdestroytoken -f option to force a removal of a refresh token in
    vault.
  - Add htgettoken --novaulttoken option as an alias for --noiodc, --nossh,
    and --nokerberos.
  - Again fix --showbearerurl to work in combination with --nobearertoken.
    That was fixed in 1.17 but broke in 1.21 and 2.0.
  - Fix httokensh to pay attention to htgettoken options in $HTGETTOKENOPTS.
  - Fix httokensh to correctly locate the log file if a -o or --outfile
    is given, instead of writing to ".log" in the current directory.
  - Fix httokensh to not pass on a --vaulttokenminttl option to the background
    htgettoken command, to make the vault token last as long as possible since
    it doesn't get renewed.


author: Dave Dykstra <dwd@fnal.gov> 2.6-1
changelog:
  - Have htdecodetoken take advantage of new scitokens-verify ability
    to read from stdin, when available.
  - Add support in htdestroytoken -f for getting a CA cert directory
    from ${X509_CERT_DIR:-/etc/grid-security/certificates} or from 
    a --capath option, and to get a CA cert file from a --cafile option,
    mirroring the behavior of htgettoken.


author: Dave Dykstra <dwd@fnal.gov> 1.14-1
changelog:
  - Add auditlog configuration option.  As part of that, disable the
    vault systemd ProtectFull and ProtectHome options.
  - Require vault >= 1.12.1.
  - Update the vault-plugin-auth-jwt to the latest upstream commit.
  - Include gox in the source tarball.


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Update vault-plugin-secrets-oauthapp to 3.1.1 which adds support for token
    exchange at a /sts path instead of /creds.  Keep applying the PR patch
    that also adds it under /creds for a transition period until htgettoken
    is updated everywhere to use the new path.
  - Update vault-plugin-auth-jwt to 0.15.2.
  - Update vault-plugin-auth-ssh to 0.3.0.
  - Require vault >= 1.13.
  - Require diffutils.
  - Fix bug where the kerberos policydomain option was ignored.


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Add 'ratelimits' keyword to put a limit on the number of requests per
    client per interval.
  - Allow '@' to be included in the ssh plugin's keys.
  - Fix bug that prevented reconfiguration when a policy name changed.
  - Update vault-plugin-auth-jwt to 0.18.0.
  - Update vault-plugin-auth-ssh to 0.3.1.
  - Require vault to be >= 1.15.


author: Dave Dykstra <dwd@fnal.gov> 1.17-1
changelog:
  - Add a patch of PR #90 to vault-plugin-secrets-oauthapp which adds caching
    of tokens exchanged via the /sts path and adds a minimum_seconds option to
    the API.
  - Give vault tokens the capabilities of deleting secrets and revoking
    themselves.
  - Update required vault to 1.17.
  - Update vault-plugin-auth-jwt to 0.21.0.
  - Update vault-plugin-auth-ssh to 0.3.2 which includes the patch for '@' 
    that was previously applied.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Restore patch #41 on vault-plugin-secrets-oauthapp which was accidentally
    dropped.
  - Update to latest commit on vault-plugin-auth-jwt because one of the
    other patches now depends on it in order to apply cleanly.


author: Dave Dykstra <dwd@fnal.gov> 1.19-1
changelog:
  - Replace vault with openbao-2.2.0 and remove vault-plugin-secrets-jwt
    (since the builtin version works with openbao).
  - Replace vault-plugin-secrets-oauthapp with openbao-plugin-secrets-oauthapp
    3.2.0 but still install it as vault-plugins-secrets-oauthapp for upgrade
    compatibility.
  - Update vault-plugin-auth-ssh to 0.3.4.


author: Dave Dykstra <dwd@fnal.gov> 2.0.0-1
changelog:
  - Remove the external auth/oidc plugin registration to switch to the
    builtin plugin.
  - Change to semantic versioning starting at 2.0.0.  Compared to 1.18,
    the removal of the external vault-plugin-secrets-jwt plugin causes
    some incompatibility and requires a careful upgrade path in HA
    installations (that is, upgrade all vault/openbao first).


author: Dave Dykstra <dwd@fnal.gov> 2.1.0-1
changelog:
  - Update to require openbao 2.3.2, which has been updated in preparation
    for moving it to EPEL by changing the service to run under the openbao
    user and group id instead of vault.


author: Edgar Fajardo <efajardo@cern.ch> 1.1.0-1
changelog:
  Updated to the 1.1.0 release. It could not be a pass through build since the dist was missing in the Release entry in the spec file


author: Justin Hiemstra <jhiemstra@wisc.edu> - 0.0.2-1
changelog:
  - v0.0.2 release of LotMan -- adds the ability to set sqlite timeouts
    and enables WAL mode for better concurrency.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 7.9.9-1
changelog:
  - Upgrade to Pelican 7.9.9
  - Require pelican version >= service version
  - Restart service if pelican or (for xrootd-requiring services) xrootd-server is upgraded
  - Require xrootd >= 5.7.0
  - Require xrootd-multiuser


author: Mátyás Selmeci <mselmeci@wisc.edu> - 7.16.1-1
changelog:
  - Upgrade to Pelican 7.16.1 (SOFTWARE-6152)
  - Require "pelican-server" for the cache and origin (SOFTWARE-6152)


author: Mátyás Selmeci <mselmeci@wisc.edu> - 7.16.6-1
changelog:
  - Upgrade to Pelican 7.16.6 (SOFTWARE-6152)
  - Require xrootd-s3-http where available
  - Drop explicit dependency on xrootd since it is already implied by pelican-server
  - Instruct user to specify Cache.StorageLocation in cache config


author: Mátyás Selmeci <mselmeci@wisc.edu> - 25-1
changelog:
  - Replace with metapackage containing configuration for using the pelican-*.service files.
    Includes migration instructions.

  - Replace osdf-*.service files with symlinks to the corresponding pelican-*.service files;
    replace /etc/pelican/osdf-*.yaml files with symlinks to the corresponding pelican-*.yaml files


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4-1
changelog:
  - Remove osg-release requirement; ignore missing compat packages; only try to
    update packages that are installed (SOFTWARE-2146)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6-1
changelog:
  - Replace references to OSG Twiki with links to current docs (SOFTWARE-3083)
  - Replace help email (SOFTWARE-3015)


author: Brian Lin <blin@cs.wisc.edu> 1.1.6-1
changelog:
  - Change software.grid.iu.edu to repo.grid.iu.edu in osg-ca-scripts (SOFTWARE-2666)
  - Remove unsupported compat links for old OpenSSL hashes
  - Added `ITB` options back to help text


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.0.0-1
changelog:
  - Drop lcmaps-db-templates dependency (SOFTWARE-4503)
  - Turn osg-configure-misc into a dummy package (SOFTWARE-4507)
  - Rename 30-gip.ini to 31-cluster.ini and osg-configure-gip to osg-configure-cluster (SOFTWARE-4485)
  - Deprecate RSV  (SOFTWARE-4511)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.1.0-0.15
changelog:
  - Depend on /usr/bin/condor_remote_cluster instead of condor-bosco (SOFTWARE-4973)
  - Split libs into separate RPM
  - Add osg-ce-attributes-generator (SOFTWARE-4895)
  - Don't require base osg-configure package in osg-configure-siteinfo and osg-configure-cluster
    because they can also be used by osg-ce-attributes-generator
  - Advertise batch system used by bosco (SOFTWARE-3720)


author: Mátyás Selmeci <matyas@cs.wisc.edu> 4.2.0-1
changelog:
  - Turn osg-configure-rsv into a dummy package (SOFTWARE-4511)
  - Add "queue" to OSG_ResourceCatalog for Pilot sections (SOFTWARE-5881)


author: Brian Lin <blin@cs.wisc.edu> - 3.6.0
changelog:
  - Add configuration file for osg-incommon-cert-request (SOFTWARE-5668)
  - Update default CSR key length to 4096, add CLI option (SOFTWARE-5651)


author: Brian Lin <blin@cs.wisc.edu> - 3.6.1
changelog:
  - Fix bug with default CA config file option (SOFTWARE-5668)
  - Update default InCommon IGTF CA IDs to point to CA 3


author: Dave Dykstra <dwd@fnal.gov> - 3.7.0
changelog:
  - Convert osg-incommon-cert-request to use urllib3 instead of M2crypto
    for its https connection, to make it work properly on EL9.


author: Dave Dykstra <dwd@fnal.gov> - 3.7.2
changelog:
  - Fix bug in invocation of urllib3.request() in restclient's get_request();
    it was passing headers as the 4th parameter instead of identifying it
    by name.  Broke retrieval of cert with osg-incommon-cert-request in
    some cases.


author: Matyas Selmeci <matyas@cs.wisc.edu> 1.3.0-1
changelog:
  - Add SELinux audit logs to osg-system-profiler and URL support to
    osg-system-profiler-viewer (SOFTWARE-2275)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.4.0-1
changelog:
  - Include dump of tomcat server config (SOFTWARE-1099)
  - Create osg-profile.txt in temp dir, do not include old profiles in
    directory dumps (SOFTWARE-1773)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.1-1
changelog:
  - Drop osg-version check (SOFTWARE-2916)
  - Update instructions for getting help (SOFTWARE-2908)
  - Don't include logs for deprecated software (SOFTWARE-2905)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.3-1
changelog:
  - Drop unused files:
      - httpcert.pem
      - tomcat config
      - edg-mkgridmap.log
      - bestman2 logs


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6.0-1
changelog:
  - Query multiple python executables, not just `which python` (which may not exist on EL8) (SOFTWARE-4146)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.7.0-1
changelog:
  - Convert osg-system-profiler-viewer to Python 3
  - Add XRootD cconfig dumps (SOFTWARE-4933)
  - Print crypto policy if available (SOFTWARE-5330)
  - Fix email address in help message


author: Brian Lin <blin@cs.wisc.edu> - 0.8.1-1
changelog:
  - Add the --pw-store option to the invocation of oidc-add and add a default
    scope of blank if no scopes are configured.  These are needed for the
    CILogon issuer (SOFTWARE-4983).


author: Carl Edquist <edquist@cs.wisc.edu> - 0.8.2-1
changelog:
  - Increase renewal frequency to ensure continual validity (SOFTWARE-5137)
  - Fix password file handling for restricted permissions in setup script (#17)
  - Use newer --pw-file option for oidc-add (SOFTWARE-5050)
  - Bump version requirement for oidc-agent package (SOFTWARE-5050)


author: Dave Dykstra - 0.9.0-1
changelog:
  - Require oidc-agent-cli-5.1.0, and use a new oidc-add --skip-check option
    there to avoid trying to get an access token at load time.  This avoids
    a 'No scopes found' error when the token issuer returns different scopes
    than requested (e.g. wlcg.capabilityset which returns a set of scopes).


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.3.0-1
changelog:
  - Add osg-release requirement
  - Allow taking osg repo definition from osg-release installed in a tarball client (SOFTWARE-2527)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 23-5
changelog:
  - Log DNs of incoming certificates (SOFTWARE-5370); raise required XRootD version to 1:5.6.0 for the feature


author: Mats Rynge <rynge@isi.edu> 1.7-1
changelog:
  - Moved to the new ospool.osg-htc.org central managers in high
    availability setup
  - Removed pre-9.0 HTCondor config - this is no longer
    supported by the OSPool (IDTOKENS only)
  - Change the VO override to the lowercase "osg" (SOFTWARE-4905)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.8-1
changelog:
  - Include the package version in the schedd classad (SOFTWARE-5105)
  - Disable .sif images on 3.x kernels (OSPOOL-18)
  - Improve OS_VERSION handling
  - Drop Map* ProbeConfig overrides (SOFTWARE-5042)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.0.1-1.1
changelog:
  - Build for OSG; add setuptools_scm build dependency (SOFTWARE-4877)
    Ignore byte-compile errors: they fail on Python 2 code in the examples


author: Mátyás Selmeci <mselmeci@wisc.edu> - 138-1
changelog:
  - Add new CERN IAM endpoint for CMS (SOFTWARE-6072)
  - Remove lcg-voms2.cern.ch and voms2.cern.ch LSC files and vomses entries (SOFTWARE-6072)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.4.0-2
changelog:
  - Add python3-condor and python3-xrootd build dependencies so we don't build RPMs for repos
    which they can't be installed from.


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 3.5.0-1
changelog:
  - Have the authfile updater get a grid-mapfile from Topology for
    stash-cache-auth and stash-origin-auth (SOFTWARE-5467)


author: Matt Westphall <westphall@wisc.edu> - 3.6.0-1
changelog:
  - Make redirector line in cache config customizable (SOFTWARE-5641)
  - check for *.local files in /etc/xrootd in authfile-updater (SOFTWARE-5597)


author: Mátyás Selmeci <mselmeci@wisc.edu> - 4.1.0-1
changelog:
  - Enable ARM builds (except for xcache-consistency-check) (SOFTWARE-6057)
  - Dummy out xcache-consistency-check on OSG 25 and newer (SOFTWARE-6054)
  - Fix makefile for EL10 (Python 3.12) support


author: Brian Bockelman <bbockelman@morgridge.org> 1.4.0-1
changelog:
  - Add experimental support for s3://-style URLs.
  - Delay initialization of thread pools until the first file is opened.
  - Cleanly shutdown helper threads when plugin is unloaded, reducing
    the chance of a segfault when a CLI or unit test is shutting down.
  - Fix a few minor memory leaks and race conditions uncovered by
    AddressSanitizer.


author: Brian Bockelman <bbockelman@morgridge.org> 1.5.2-1
changelog:
  - Add infrastructure for automating GitHub releases from a pushed tag
  - Automatically build as part of a release.


author: Brian Bockelman <bbockelman@morgridge.org> 1.5.5-1
changelog:
  - Fix a bug that could trigger a deadlock when a busy plugin is unable
    to continue an ongoing prefetch request.


author: Brian Bockelman <bbockelman@morgridge.org> 1.5.6-1
changelog:
  - Fix a bug that could cause the client to stop processing new requests
    if a significant number (approximately 16k) of operations have
    expired since process startup.


author: Brian Bockelman <bbockelman@morgridge.org> - 0.0.9-1
changelog:
  - Fix permission issues for prestage when used with token auth
  - Add support for re-exec'ing the xrootd binary, allowing it to reload
    the configuration in-place
  - Add a signal handler that prints out stack traces on crash


author: Brian Bockelman <bbockelman@morgridge.org> - 0.0.10-1
changelog:
  - Fix bug preventing prestaging token from being passed to the filesystem
    layer
  - Workaround fact pre-read isn't implemented in XrdPss
  - Add regression tests corresponding to the above two issues


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.8.3-1.1
changelog:
  - Update to XRootD 5.8.3 (SOFTWARE-6164)
      - Patches added:
          - 0009-Avoid-reference-beyond-end-of-table~80b938c.patch
          - 0010-XrdPfc-Ensure-a-reference-to-the-file-is-kept-when-s~aa225e2.patch
      - Patches kept:
          - 0001-Allow-hostname-used-by-XRootD-to-be-overridden-by-en~7c119b0.patch
          - 0002-XrdTls-Allow-disabling-of-X.509-client-auth~18e1c81.patch
          - 0003-XrdSciTokens-Handle-multiple-authorization-token-set~b82ddc3.patch
          - 0004-XrdHttp-Undo-HTTP-PUT-response-code-change~956b9fa.patch -> 0004-XrdHttp-Undo-HTTP-PUT-response-code-change~43ed40b.patch
          - 0006-Re-engineer-concurrency-limits-for-throttles~39fea57.patch
          - 0007-Modify-XrdThrottle-to-be-an-OSS-plugin~921fef5.patch
          - 0008-XRootD-s-xml-response-for-PROPFIND-will-now-include~aacf631.patch
      - Patches dropped:
          - 0005-XrdHttp-Fix-HTTP-protocol-errors-on-failure~4fb2221.patch
          - 0009-Fix-life-time-of-a-variable-used-for-signaling-that~286b8ca.patch
          - 0010-Correct-concurrency-and-state-tracking-around-Redriv~86d48f1.patch
          - 0011-Fix-race-conditions-around-use-of-ecMsg~803dc26.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.8.4-1.1
changelog:
  - Update to XRootD 5.8.4 (SOFTWARE-6187)
      - Patches added:
      - Patches kept:
          - 0001-Allow-hostname-used-by-XRootD-to-be-overridden-by-en~7c119b0.patch -> 0001-1-Allow-hostname-used-by-XRootD-to-be-overridden-by~7c119b0.patch
          - 0002-XrdTls-Allow-disabling-of-X.509-client-auth~18e1c81.patch -> 0002-4-XrdTls-Allow-disabling-of-X.509-client-auth~18e1c81.patch
          - 0003-XrdSciTokens-Handle-multiple-authorization-token-set~b82ddc3.patch -> 0003-6-XrdSciTokens-Handle-multiple-authorization-token-s~b82ddc3.patch
          - 0004-XrdHttp-Undo-HTTP-PUT-response-code-change~43ed40b.patch -> 0004-14-XrdHttp-Undo-HTTP-PUT-response-code-change~43ed40b.patch
          - 0006-Re-engineer-concurrency-limits-for-throttles~39fea57.patch -> 0005-23-Re-engineer-concurrency-limits-for-throttles~39fea57.patch
          - 0007-Modify-XrdThrottle-to-be-an-OSS-plugin~921fef5.patch -> 0006-23-Modify-XrdThrottle-to-be-an-OSS-plugin~921fef5.patch
          - 0008-XRootD-s-xml-response-for-PROPFIND-will-now-include~aacf631.patch -> 0007-25-XRootD-s-xml-response-for-PROPFIND-will-now-inclu~aacf631.patch
          - 0011-Enable-write-through-mode-for-cache~330eac1.patch -> 0008-32-Enable-write-through-mode-for-cache~330eac1.patch
      - Patches dropped:
          - 0009-Avoid-reference-beyond-end-of-table~80b938c.patch
          - 0010-XrdPfc-Ensure-a-reference-to-the-file-is-kept-when-s~aa225e2.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.8.4-1.3
changelog:
  - Add patches (SOFTWARE-6202):
      - 0009-34-Add-S3-as-a-permitted-proxy-protocol~b36d9b7.patch
      - 0010-36-Do-a-clean-TLS-shutdown-for-HTTPS~cdc53fe.patch
      - 0011-35-Make-HTTP-s-maximum-open-delay-configurable~3496b32.patch


author: Matt Westphall <westphall@wisc.edu> - 5.9.0-1.1
changelog:
  - Update to XRootD 5.9.0 (SOFTWARE-6187)
      - Patches added:
      - Patches kept:
          - 0001-1-Allow-hostname-used-by-XRootD-to-be-overridden-by~7c119b0.patch -> 0001-1-Allow-hostname-used-by-XRootD-to-be-overridden-by-~8d1252d.patch
          - 0003-6-XrdSciTokens-Handle-multiple-authorization-token-s~b82ddc3.patch -> 0002-6-XrdSciTokens-Handle-multiple-authorization-token-s~a0751f6.patch
          - 0004-14-XrdHttp-Undo-HTTP-PUT-response-code-change~43ed40b.patch -> 0003-14-XrdHttp-Undo-HTTP-PUT-response-code-change~43ed40b.patch
          - 0007-25-XRootD-s-xml-response-for-PROPFIND-will-now-inclu~aacf631.patch -> 0004-25-XRootD-s-xml-response-for-PROPFIND-will-now-inclu~aacf631.patch
          - 0008-32-Enable-write-through-mode-for-cache~330eac1.patch -> 0005-32-Enable-write-through-mode-for-cache~330eac1.patch
          - 0009-34-Add-S3-as-a-permitted-proxy-protocol~b36d9b7.patch -> 0006-34-Add-S3-as-a-permitted-proxy-protocol~b36d9b7.patch
          - 0012-37-Add-TPC-worker-pool~70720be.patch -> 0007-37-Add-TPC-worker-pool~0bcba8c.patch
      - Patches dropped:
          - 0002-4-XrdTls-Allow-disabling-of-X.509-client-auth~18e1c81.patch
          - 0005-23-Re-engineer-concurrency-limits-for-throttles~39fea57.patch
          - 0006-23-Modify-XrdThrottle-to-be-an-OSS-plugin~921fef5.patch
          - 0010-36-Do-a-clean-TLS-shutdown-for-HTTPS~cdc53fe.patch
          - 0011-35-Make-HTTP-s-maximum-open-delay-configurable~3496b32.patch


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.9.1-1.1
changelog:
  - Update to XRootD 5.9.1 (SOFTWARE-6260)
      - Patches added:
      - Patches kept:
          - 0001-1-Allow-hostname-used-by-XRootD-to-be-overridden-by-~8d1252d.patch -> 0001-1-Allow-hostname-used-by-XRootD-to-be-overridden-by~e13587e.patch
          - 0002-6-XrdSciTokens-Handle-multiple-authorization-token-s~a0751f6.patch -> 0002-6-XrdSciTokens-Handle-multiple-authorization-token-s~d8842b6.patch
          - 0003-14-XrdHttp-Undo-HTTP-PUT-response-code-change~43ed40b.patch -> 0003-14-XrdHttp-Undo-HTTP-PUT-response-code-change~73ddc83.patch
          - 0004-25-XRootD-s-xml-response-for-PROPFIND-will-now-inclu~aacf631.patch
          - 0005-32-Enable-write-through-mode-for-cache~330eac1.patch
          - 0006-34-Add-S3-as-a-permitted-proxy-protocol~b36d9b7.patch
          - 0007-37-Add-TPC-worker-pool~0bcba8c.patch -> 0007-37-Add-TPC-worker-pool~31dd3de.patch
      - Patches dropped:


author: Mátyás Selmeci <mselmeci@wisc.edu> - 5.9.1-1.3
changelog:
  - Add 0009-42-Full-pkcs11-integration~d92e458.patch (SOFTWARE-6280)
  - Add 0010-45-Revert-XrdHttp-Undo-HTTP-PUT-response-code-change~6d22469.patch (SOFTWARE-6280)


author: Carl Edquist <edquist@cs.wisc.edu> - 2.0.4-1
changelog:
  - Initialize crc32
  - Fix assert in el8 due to vector reserve
  - Reorder variables to address compiler warning/error


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 2.1.3-1
changelog:
  - Fail plugin initialization if we can't get the OSS (SOFTWARE-5388)
  - If user cannot be mapped to uid, continue as anonymous
  - Change from named daemon to exec


