# changelog

author: Dave Dykstra <dwd@fnal.gov> 0.9-1
changelog:
  - Add missing '/' to the beginning of the DN used as the username for
      myproxy and printed out the -v option
  - Add --listinstitutions option


author: Dave Dykstra <dwd@fnal.gov> 1.7-1
changelog:
  - Fix man page description of --idplisturl
  - Do many changes in response to a code review:
    - change default python to the system python in /usr/bin
    - always cleanly shutdown SSL connections to avoid truncation attacks
    - support all TLS versions, not just v1.0
    - disable the possibility of SSL compression to avoid CRIME attack
    - disable SSL ciphers known to be insecure
    - document the fact that CRLs are not actually checked (this is deemed
      to be an acceptable risk)
    - set a timeout on SSL connections to 15 seconds
    - change the message digest on proxies from sha1 to sha256
    - sanitize user input sent directly to myproxy (that is, the username)
    - change maximum proxy duration to a million seconds (277 hours) and
      maximum certificate duration to 10000 hours, leaving the defaults
      as they were
    - disable support for http:// URLs; everything has to be https:// (or
      in some cases file://)
    - use effective uid rather than real uid for the %uid macro
    - use mkstemp() to create the output in a temporary file, in order to
      avoid race conditions where another process could be reading the
      file as cigetcert creates it
    - catch any errors writing the output file to avoid a stack trace
    - add some explanatory comments to the source code
  - Add support for Debian
    - Allow alternate default cafile of /etc/ssl/certs/ca-certificates.crt
    - Only use SSL.Connection.settimeout if it is present


author: Dave Dykstra <dwd@fnal.gov> 1.8-1
changelog:
  - Allow a previous output file to have additional proxy layers added
    on to it when checking to see if it is still valid.  That is, strip
    off any number of /CN=[0-9]+ or /CN=proxy patterns appended to the
    certificate subject.  In particular this is useful for when someone
    does voms-proxy-init -noregen after a previous run of cigetcert.


author: Dave Dykstra <dwd@fnal.gov> 1.10-1
changelog:
  - Change default --minhours value from 12 to 1.
  - If the formula calculating the remaining hours in the myproxy cert
      (%hours - %proxyhours - %minhours) comes out to a value lower
      than %minhours, set it to %minhours


author: Dave Dykstra <dwd@fnal.gov> 1.11-1
changelog:
  - If the requested --hours is fractional, round the hours of the
    original certificate up to the next whole number rather than down.
    In this case generate a proxy with the requested fractional hours.


author: Dave Dykstra <dwd@fnal.gov> 1.13-1
changelog:
  - Choose a prefix for the temp output file in the same directory as the
    output file to avoid renaming across filesystems.


author: Dave Dykstra <dwd@fnal.gov> 1.14-1
changelog:
  - Limit the number of proxy levels stripped off of %certsubject to 5.
    This is to catch programming errors where people call voms-proxy-init
    -noregen after every call to cigetcert, even when cigetcert determines
    that the previous proxy can be reused.


author: Dave Dykstra <dwd@fnal.gov> 1.15-1
changelog:
  - Fix bug that caused the proxy to be stored into MyProxy under the DN
    of a previous certificate (if it existed but could not be reused)
    rather than the newly generated one.


author: Dave Dykstra <dwd@fnal.gov> 1.16-1
changelog:
  - Fix typo in the variable name added in the last version.  This was
    not noticed because it was caught in an exception and caused it to
    always behave as if a previous proxy stored in myproxy could not be
    used.


author: Dave Dykstra <dwd@fnal.gov> 1.2-1
changelog:
  - Try kerberos authentication first by default when the institution's
    IdP is known to support it, without a --kerberos option.
  - Add --nokerberos option.
  - Add support for additional default options in $CIGETCERTOPTS.
  - Use getpwuid() instead of $LOGNAME for current user name.
  - Avoid stack trace crash on el5 when previous outfile is empty.
  - Avoid stack trace when password prompt is interrupted.
  - Add wrapper script to unset PYTHONPATH and LD_LIBRARY_PATH.
  - Pre-compile cigetcert python source.


author: Dave Dykstra <dwd@fnal.gov> 1.18-1
changelog:
  - Make source code completely compatible with python3
  - Fix check for more than 5 proxy levels to apply when verbose option
    is not set


author: Dave Dykstra <dwd@fnal.gov> 1.19-1
changelog:
  - Add setup.py for making a standard python installation
  - Use ssl.get_default_verify_paths() to find default CA paths, when possible
  - Make --listinstitutions compatible with python3


author: Dave Dykstra <dwd@fnal.gov> 1.20-1
changelog:
  - Add make sources target for koji build
  - Add make srpm target for copr build
  - Support port numbers in https urls
  - Return all received cookies in the final getcert step
  - Add sending Server Name Indication on https connections


author: Pat Riehecky <riehecky@fnal.gov> 1.0-3
changelog:
  - Sets up mod_userdir with no indexes too
  - Now leaves a comment behind saying what it did
  - Now archives httpd.conf before making the edits


author: Pat Riehecky <riehecky@fnal.gov> 1.0-4
changelog:
  - Comment addition is now in its own block so that failure
     to leave a comment doesn't prevent the config changes
     from happening.


author: Olga Terlyga <terlyga@fnal.gov> 5.3-1.5
changelog:
  - Removed i-krb-6/8/17 from the list of KDCs
  - Edited [capath] section to reflect direct(only) trust between Windows domain and MIT realm
  - Added pingdev.fnal.gov and prinprod.fnal.gov to [domain_realm] section
  - Removed non-existent dns records from [domain_realm] section
  - Removed [instancemapping] section since there is no Fermi AFS


author: Pat Riehecky <riehecky@fnal.gov> - 1.0-2
changelog:
  - Moved Bonnie's changes into SL_gdm_no_user_list
  - yum groups doesn't like pulling packages from repos without comps
  -- so using this as a "metapackage" to pull in the SL package and make yum happy


author: Pat Riehecky <riehecky@fnal.gov> 1.0-3.4
changelog:
  - Include link-local addresses in the restricted list
  -- This way IPv6 link local is protected even on site


author: Pat Riehecky <riehecky@fnal.gov> 1.0-5
changelog:
  - Force authselect config on EL8+ when config status is messed up
  - Better use of socket actived sssd settings


author: Dave Dykstra <dwd@fnal.gov> 3.0-1
changelog:
  - Initial rpm packaging.  The numbering is starting with 3.0 to be 
    greater than the latest krb5-fermi-getcert, the package that this
    is replacing.


author: Connie Sieh <csieh@fnal.gov> 0.9.9-14
changelog:
  - replaced "ifconfig" to "ip addr" in z_ocs.inventory.client.cron
  - ifconfig did not work with infiniband


author: Pat Riehecky <riehecky@fnal.gov> 0.9.9-15
changelog:
  - added missing dependency on /bin/mail
  - added /usr/lib/perl5/vendor_perl to @INC for non SLF systems (patch)
  - added /usr/share/perl5/vendor_perl to @INC for non SLF systems (patch)


author: Pat Riehecky <riehecky@fnal.gov> 0.9.9-16
changelog:
  - made /etc/sysconfig/ocsinventory-fermi for control values
  - merged Connie's 'ip addr' patch for the cronjob
  - added requirement for iproute and iputils
  - added extra check for DNS resolution
  - added syntax check for cronjob at build time


author: Connie Sieh <csieh@fnal.gov> 0.9.9-17
changelog:
  - On SLF 6 some systems now use a name other than ethx for ethernet
  - On Dell systems in particular  em1 is used 
  - Symptom of this was no "NETWORKS" entry sent to server


author: Connie Sieh <csieh@fnal.gov> 0.9.9-19
changelog:
  - added ability to use a proxy via <PROXY>proxyurl<\PROXY> entry to
  - /etc/ocsinventory/ocsinv.conf
  - Also can define proxy with environment variable http_proxy
  - http_proxy overrides <PROXY>proxyurl<\PROXY> 
  - proxy has to be defined with full url -- http://proxyserver:port


author: Connie Sieh <csieh@fnal.gov> 0.9.9-24
changelog:
  - Changed from using "ifconfig" to "ip" for NETWORKS as more consistent between
  - versions.  This allows for same version for 5, 6 and 7


author: Connie Sieh <csieh@fnal.gov> 0.9.9-25
changelog:
  - Changed from hardcoding what interfaces we will look at to finding all
  - that are UP and have either a ipv4 or ipv6 address


author: Connie Sieh <csieh@fnal.gov> 3.4-2
changelog:
  - Made the spec file generic.  Removed the references to CMS
  - Changed the rsync to a cp so we are not dependent on rsync


author: Pat Riehecky <riehecky@fnal.gov> - 2.6.0-2
changelog:
  - Return to Fedora
  - Use systemd timers rather than cron for regular runs
  - Add a handful of possible timers users might want


author: Paul Howarth <paul@city-fan.org> - 1.219-3
changelog:
  - Change license to "BSD and MIT"
    https://lists.fedoraproject.org/pipermail/legal/2013-August/002226.html
  - Drop EL-5 compatibility (#998143)


author: Tom "spot" Callaway <tcallawa@redhat.com> - 6.0.1-1
changelog:
  - update to 6.0.1, which removed all occurrences of the "locked" attribute, 
    deprecated in perl 5.12.0
  - okay to use Socket6 now.


author: Paul Howarth <paul@city-fan.org> - 0.48-1
changelog:
  - Update to 0.48
    - Make module thread-safe on linux (CPAN RT#38709)
    - New constructor flag enable_ttys, which when set to 0 disables traversing
      the device tree
    - New maintainer JSWARTZ
    - Fix reading process command lines (CPAN RT#51470)
    - Fixes for non-threaded perls (CPAN RT#41397, CPAN RT#46861, CPAN RT#58236)
    - Fix file descriptor leak (CPAN RT#69397)
    - Fix unsafe use of /tmp (CPAN RT#72862, CVE-2011-4363)
    - Various fixes for non-linux operating systems
    - Fix byte order tag in cache file (CPAN RT#72862)
    - Fixes to stay accurate on machines with many CPUs (CPAN RT#82175), to
      include system time into calculations (CPAN RT#80391) and others
      (CPAN RT#81312, CPAN RT#82175 and CPAN RT#80391)
    - Fix unknown process states for debian kernels (CPAN RT#71976)
    - Added tests
  - Drop ARG_MAX patch, no longer needed
  - Don't use macros for commands
  - Don't need to remove empty directories from the buildroot
  - Don't ship empty TODO file
  - Drop %defattr, redundant since rpm 4.4
  - Specify all dependencies
  - Add %{?perl_default_filter}


