# changelog

author: Mátyás Selmeci <mselmeci@wisc.edu> - 8-1
changelog:
  - Use distro version as the version to satisfy dependencies of buildsys-build and buildsys-srpm-build
  - Don't define %rhel and %el{8,9,10} - we get those from the OS


author: Brian Lin <blin@cs.wisc.edu.> - 2.8.4-1
changelog:
  - HTCondor AP and CE probes now drop privileges to the 'condor' user
    if run as 'root' (SOFTWARE-5531)
  - Improve logging and failure modes when encountering unwriteable
    directories (SOFTWARE-5531)


author: Matt Westphall <westphall@wisc.edu.> - 2.8.5-1
changelog:
  - Log gratia probe failures to aid debugging (SOFTWARE-6037)
  - Fix NameError in post-install script (SOFTWARE-5558)


author: Matt Westphall <westphall@wisc.edu.> - 2.9.1-1
changelog:
  - Advertise the following ClassAd attributes in condor-ap (SOFTWARE-6257):
  - OSG_INSTITUTION_ID, MachineAttrOSG_INSTITUTION_ID0,  
  - GLIDEIN_Site, MachineAttrName0, MachineAttrGLIDEIN_ResourceName0, MachineAttrGLIDEIN_Site0


author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Update httokensh to by default set the minimum vault token time to live to
    6 days, and to make sure that the background refresh never gets a new vault
    token.
  - Changed the preferred name of httokendecode to htdecodetoken, keeping
    links in the opposite direction.
  - Add man pages for httokensh, htdestroytoken, and htdecodetoken.


author: Dave Dykstra <dwd@fnal.gov> 2.0-1
changelog:
  - Replace use of m2crypto and pyOpenSSL with urllib3
  - Replace use of pykerberos with gssapi
  - Use standard Requires for Python modules instead of PyInstaller
  - Add --vaultcertname option to specify an alternative certificate name.
    That used to be an additional optional meaning of the --vaultalias option,
    but urllib3 requires only one name to match.
  - Add setuptools build infrastructure
  - Refactor htgettoken script into module with entry point.
    This enables invoking htgettoken as `htgettoken.main()` from Python.
  - Use wheels to build/install Python package, which simplified the entry
    points and improves (slightly) the metadata
  - Fix the httokensh background process's check for its parent process.
    That is only a backup in case only the parent process is hard-killed,
    because normally the parent process kills the background process when
    the parent exits.
  - Use newer `sts` secrets API for token exchanges.
  - Fix the `-o`/`--outfile` option to work with relative paths. 
  - Change the `--nobearertoken` option to always get and save a vault token.


author: Dave Dykstra <dwd@fnal.gov> 2.0-2
changelog:
  - Fix broken httokendecode symlink.
  - Use python wheels to build/install on el9.  It didn't work on el8 so
    the use of wheels was removed at the last minute before the 2.0-1
    release (without removing it from the changelog like it should have).


author: Dave Dykstra <dwd@fnal.gov> 2.1-1
changelog:
  - Fix htdecodetoken to work with token files that do not end in a newline.
  - Support args in htgettoken.main() Python entry point.


author: Dave Dykstra <dwd@fnal.gov> 2.2-1
changelog:
  - Add BuildRequires python3-devel to generate correct Python metadata.
  - Remove explicit Requires for python dependencies, rely on Python metadata.
  - Always build with wheels.
  - Remove Python root logger configuration.


author: Dave Dykstra <dwd@fnal.gov> 2.4-1
changelog:
  - Add the new -s and -f options to the htdecodetoken usage summary.
  - Add a -v option to htdecodetoken to show the token source.


author: Dave Dykstra <dwd@fnal.gov> 2.5-1
changelog:
  - Add htdestroytoken -f option to force a removal of a refresh token in
    vault.
  - Add htgettoken --novaulttoken option as an alias for --noiodc, --nossh,
    and --nokerberos.
  - Again fix --showbearerurl to work in combination with --nobearertoken.
    That was fixed in 1.17 but broke in 1.21 and 2.0.
  - Fix httokensh to pay attention to htgettoken options in $HTGETTOKENOPTS.
  - Fix httokensh to correctly locate the log file if a -o or --outfile
    is given, instead of writing to ".log" in the current directory.
  - Fix httokensh to not pass on a --vaulttokenminttl option to the background
    htgettoken command, to make the vault token last as long as possible since
    it doesn't get renewed.


author: Dave Dykstra <dwd@fnal.gov> 2.6-1
changelog:
  - Have htdecodetoken take advantage of new scitokens-verify ability
    to read from stdin, when available.
  - Add support in htdestroytoken -f for getting a CA cert directory
    from ${X509_CERT_DIR:-/etc/grid-security/certificates} or from 
    a --capath option, and to get a CA cert file from a --cafile option,
    mirroring the behavior of htgettoken.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Restore patch #41 on vault-plugin-secrets-oauthapp which was accidentally
    dropped.
  - Update to latest commit on vault-plugin-auth-jwt because one of the
    other patches now depends on it in order to apply cleanly.


author: Dave Dykstra <dwd@fnal.gov> 1.19-1
changelog:
  - Replace vault with openbao-2.2.0 and remove vault-plugin-auth-jwt
    (since the builtin version works with openbao).
  - Replace vault-plugin-secrets-oauthapp with openbao-plugin-secrets-oauthapp
    3.2.0 but still install it as vault-plugins-secrets-oauthapp for upgrade
    compatibility.
  - Update vault-plugin-auth-ssh to 0.3.4.


author: Dave Dykstra <dwd@fnal.gov> 2.0.0-1
changelog:
  - Remove the external auth/oidc plugin registration to switch to the
    builtin plugin.
  - Change to semantic versioning starting at 2.0.0.  Compared to 1.18,
    the removal of the external vault-plugin-auth-jwt plugin causes
    some incompatibility and requires a careful upgrade path in HA
    installations (that is, upgrade all vault/openbao first).


author: Dave Dykstra <dwd@fnal.gov> 2.1.0-1
changelog:
  - Update to require openbao 2.3.2, which has been updated in preparation
    for moving it to EPEL by changing the service to run under the openbao
    user and group id instead of vault.


author: Dave Dykstra <dwd@fnal.gov> 2.1.0-3
changelog:
  - Avoid showing a disturbing error message from find if the vault user id
    does not exist, by redirecting stderr from find to /dev/null.


author: Dave Dykstra <dwd@fnal.gov> 2.2.0-1
changelog:
  - Change the startup loop when joining a raft cluster to wait for a leader
    to be chosen, not just a non-zero exit code from list-peers.
  - Remove inclusion of golang source code.
  - Update minimum required openbao to 2.5.0.
  - Update minimum required openbao-vault-plugin-oauthapp to 3.3.0.


author: Dave Dykstra <dwd@fnal.gov> 2.4.0-1
changelog:
  - Fix rate limiting configuration to work in a cluster when the leader is
    not the first machine (that is, the master).
  - Delete the "disable_mlock" configuration option in vault.hcl because
    openbao does not support it.
  - Update minimum required openbao to 2.6.0.


author: Dave Dykstra <dwd@fnal.gov> 2.4.1-1
changelog:
  - Enable new openbao 2.6 option allow_slashes_in_identity_templates
    for kerberos.  This allows multipart kerberos principals to be used
    again.
  - Disable reads from standby nodes for now, until consistency control is
    made available.
  - Increase the timeout on config.sh.
  - Update minimum openbao to 2.6.1.
  - Update openbao-plugin-secrets-oauthapp to 3.4.0 and add a patch for
    PR 28 to vault-plugin-auth-ssh.


author: Mátyás Selmeci <mselmeci@wisc.edu> - 1.144-2
changelog:
  - Add symlinks for Let's Encrypt YE/YR Certificates (SOFTWARE-6384)
  - Get Let's Encrypt certificates from https://github.com/opensciencegrid/letsencrypt-certificates at v0.6.1


author: Matyas Selmeci <matyas@cs.wisc.edu> 1.3.0-1
changelog:
  - Add SELinux audit logs to osg-system-profiler and URL support to
    osg-system-profiler-viewer (SOFTWARE-2275)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.4.0-1
changelog:
  - Include dump of tomcat server config (SOFTWARE-1099)
  - Create osg-profile.txt in temp dir, do not include old profiles in
    directory dumps (SOFTWARE-1773)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.1-1
changelog:
  - Drop osg-version check (SOFTWARE-2916)
  - Update instructions for getting help (SOFTWARE-2908)
  - Don't include logs for deprecated software (SOFTWARE-2905)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.4.3-1
changelog:
  - Drop unused files:
      - httpcert.pem
      - tomcat config
      - edg-mkgridmap.log
      - bestman2 logs


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.6.0-1
changelog:
  - Query multiple python executables, not just `which python` (which may not exist on EL8) (SOFTWARE-4146)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 1.7.0-1
changelog:
  - Convert osg-system-profiler-viewer to Python 3
  - Add XRootD cconfig dumps (SOFTWARE-4933)
  - Print crypto policy if available (SOFTWARE-5330)
  - Fix email address in help message


author: Brian Lin <blin@cs.wisc.edu> - 0.8.1-1
changelog:
  - Add the --pw-store option to the invocation of oidc-add and add a default
    scope of blank if no scopes are configured.  These are needed for the
    CILogon issuer (SOFTWARE-4983).


author: Carl Edquist <edquist@cs.wisc.edu> - 0.8.2-1
changelog:
  - Increase renewal frequency to ensure continual validity (SOFTWARE-5137)
  - Fix password file handling for restricted permissions in setup script (#17)
  - Use newer --pw-file option for oidc-add (SOFTWARE-5050)
  - Bump version requirement for oidc-agent package (SOFTWARE-5050)


author: Dave Dykstra - 0.9.0-1
changelog:
  - Require oidc-agent-cli-5.1.0, and use a new oidc-add --skip-check option
    there to avoid trying to get an access token at load time.  This avoids
    a 'No scopes found' error when the token issuer returns different scopes
    than requested (e.g. wlcg.capabilityset which returns a set of scopes).


author: Dave Dykstra - 1.0.0-1
changelog:
  - Add "--client-credentials" option to osg-token-renewer-setup which configures
    a mode that directly connects with grant_type=client_credentials to an Oauth
    token endpoint to fetch access tokens.
  - Move all the files into a osg-token-renewer-client subpackage that does
    not require the oidc-agent package.  When oidc-agent is not installed, only
    the client credentials mode works.
  - Change the group of the /etc/osg/tokens directory to osg-token-svc and make
    the directory fully accessible to the osg-token-svc group. This enabled
    removing the extra capabilities given to the systemd service, making it a
    little more secure.


author: Mats Rynge <rynge@isi.edu> 1.7-1
changelog:
  - Moved to the new ospool.osg-htc.org central managers in high
    availability setup
  - Removed pre-9.0 HTCondor config - this is no longer
    supported by the OSPool (IDTOKENS only)
  - Change the VO override to the lowercase "osg" (SOFTWARE-4905)


author: Carl Edquist <edquist@cs.wisc.edu> - 1.8-1
changelog:
  - Include the package version in the schedd classad (SOFTWARE-5105)
  - Disable .sif images on 3.x kernels (OSPOOL-18)
  - Improve OS_VERSION handling
  - Drop Map* ProbeConfig overrides (SOFTWARE-5042)


author: Mátyás Selmeci <matyas@cs.wisc.edu> - 5.0.1-1.1
changelog:
  - Build for OSG; add setuptools_scm build dependency (SOFTWARE-4877)
    Ignore byte-compile errors: they fail on Python 2 code in the examples


