<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="126">
<package pkgid="dadce783de9e4dd215fb3b2bbcc3e7c0648f0409522caaaea7f931f649a395d0" name="keylime" arch="src">
  <version epoch="0" ver="7.14.3" rel="138.2"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="7e14ed15648a8c92afa98bb93badb708178eb32b34a2c89efa91c285ff695df6" name="keylime-config" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="138.2"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="90b8f96f92a2e88b4867f4e90907faac9db4799bf2566fadb4603a1f50a23110" name="keylime-firewalld" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="138.2"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="10e75830dcd2907bd77ed27bb18991620f894a11ec430620f0c98ced4220cfe1" name="keylime-ima-policy" arch="aarch64">
  <version epoch="0" ver="0.2.9+49" rel="279.9"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="3122cf042c70f46086776ec8914ff189728f91b113b7e9bd523f1a618bdeba85" name="keylime-ima-policy" arch="armv7hl">
  <version epoch="0" ver="0.2.9+49" rel="279.9"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="da65845afb644c18ade8ffcc6740746abea08c9e0f236c37a89421fdaa652b1c" name="keylime-logrotate" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="138.2"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="fb4f58f1dd81923417f74140b36aca2e153c0767a006cbe04db0e08779399cf3" name="keylime-registrar" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="138.2"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="99786bf5d2ffc061d0a7c81ec3e38f73c5f8f90cd8342c9dd8b7d3eab21104ad" name="keylime-tenant" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="138.2"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="269072229c014d3d12181ee505d6e8922ededf5b621d7c4c676ed09875599d60" name="keylime-tpm_cert_store" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="138.2"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="5c529b7d188b0a864703ba3c822c6db1985fed648949f6a057f1538e768a9c0f" name="keylime-verifier" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="138.2"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="2b426927cadd34d0902782edb618741cd634845c43d6e78a1ce535d7804213a7" name="libtss2-esys0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="de529910ba1025db0cdd7a82f86bcac4f0f80b54a2439749e1234fc4781b7144" name="libtss2-esys0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="74af325f528eec0b9307bc0ff1b09d6ab17be8caf161f6adc03d2b601abe7f6e" name="libtss2-esys0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="4213c029f286387cb695d569e60905eb8270e23c1cdc0912ef8546c843f4fc5a" name="libtss2-esys0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="98f9bfdfe3a823960f0a001a992e7d7b164df89c1f8d76cf0a6f56af85141e35" name="libtss2-fapi-common" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="a68c7706300356453700bd95f04d9b35778398c8c6fd7aa0492e759fb0be55bc" name="libtss2-fapi-common" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="735dde22bee2513f1a319cdf3b205fdc1fe30698e6bda3ffe87d2da1a8f7fc2b" name="libtss2-fapi1" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="87286a02d03ceb805949965883520ab5976a2abdf1b320113dac7636599dedc8" name="libtss2-fapi1" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="8a544dd9468738e6c2733c3f7fa096136b35a89e7066d582d58bd472c9f3f938" name="libtss2-fapi1-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="59158d787b48a3905db1d4a0dcba2dccc2bb07430e2f841278db258d42c2aeb1" name="libtss2-fapi1-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="86ac2b06b84158b4536030c0774807bf77ce1567f3227f2562309a4435f9d902" name="libtss2-mu0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="eb93b64cb7c0cd1bf2205ef92f681f961c3564ded791091044c20a34c258f388" name="libtss2-mu0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="095bcdb4c68431cd4669b29f17bac024ee73ab5e0bcf79304120d4f94aa98d33" name="libtss2-mu0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="3c53ee6d3e3a5493ffbf33c76d5ae1eba1784d9b4f9e3b33e2456db9165c9dcc" name="libtss2-mu0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="314c4ee038f8f566f2f529ed2a83d637cb251f56712a94bf1f36bdbb52050eed" name="libtss2-policy0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="f447a816db0219969c2fe37634cdd26c8016c224936000962fbc23838dfe57e2" name="libtss2-policy0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="117feb3280ba136ba39c7049d097adc110d94050bfe32da52b9931a4bdbcd5fb" name="libtss2-policy0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="a9e2ce0ddd22a6d5e2667f1649e152301774bfb8095ea7412cb81af5255a2541" name="libtss2-policy0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="448baa4e2cc03144ea4104551f9fe5537a73bbc9d5cf6371cf21607babe7900c" name="libtss2-rc0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="a3692ecc6d4da8f2c48839610f5ec526975b01250726a900a36c2aaf0e8a0920" name="libtss2-rc0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="d965cfda8929b0da7d73af859ab18665e5d8c3faabee688234fc83d49ab16e01" name="libtss2-rc0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="ea75ed898ce759066042e14c440b117b9bda4cfa60097f651703b9eaec922414" name="libtss2-rc0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="3296cbf9d8c9c1fd2c7a83bb68d26f72f6521fb377efe51b3d7bb869850adeb1" name="libtss2-sys1" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="c12908d23fbf1f6a8dbf0d2feb49fe6aeb475d6eb29be6b6a8aeb32a0bb99388" name="libtss2-sys1" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="d275c9b7b98f0c0827dc1a1223ed8fa68b2a9f2891d2716c10095f04a8ed232a" name="libtss2-sys1-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="40d6b29f10bd49b354d06887260f9ca48b294fe06c495257da42fe704bf8d304" name="libtss2-sys1-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="5585767664f4bd0df7e8fefea06447ea3b24e417981aed5d7030a0ae97f0e73b" name="libtss2-tcti-cmd0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="b6b0a50ac3b97b110b309655fc5a2d809292542b4eb05814d590c22814ea848f" name="libtss2-tcti-cmd0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="f85d8c9b08a9a363dc1096d9fbcb12eda17eb23e3b07992056ea4f8ee9663a2f" name="libtss2-tcti-cmd0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="244659cf1321ae99c3de6957cc499c9639bf712cc7a051b75fe60fdc8ad97b58" name="libtss2-tcti-cmd0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="f3ca81db0344aadbd21d072a5da77fde50fdfa55b8fed159596f489962db7e17" name="libtss2-tcti-device0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="71f3c9566eb1d3e0abb34f3eb63e4f5d76d537232a7ff3714a85e68352490111" name="libtss2-tcti-device0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="878c82852fd08943784ade153162472fea8254e532b51a2f76bc8b19067b0191" name="libtss2-tcti-device0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="bedbc75d14e313ff935d0eb914afc21b3283e749321fd52f9bf82f672499d828" name="libtss2-tcti-device0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="7037ed353506bcbd013ba57cdea886674e9f630f1cb34695e1c2f50a2f297ea4" name="libtss2-tcti-i2c-helper0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="78ed3ba85f4b45992d1a102685293e52a93e8da16a94b2481035e110de2e66cd" name="libtss2-tcti-i2c-helper0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="e4185fe58fdc329147a9e6fdc9fdfa511a745b94e2a5c688175b2cf9a2675485" name="libtss2-tcti-i2c-helper0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="cc47c7a568d19cb86f9a0cb9833677d02df35736a0e17f6b49727630ea8937e4" name="libtss2-tcti-i2c-helper0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="d9595dd5e14b458c8c798c183f00e94a8fa50b2ce139905dca68fc3635de1051" name="libtss2-tcti-mssim0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="bd07784955202f0f895e6ef00ea83b1d2ec7a304f5226a43908d4969cf2e9b43" name="libtss2-tcti-mssim0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="705fb36b4754ab66b02005aab9dd77e1a2eae5a521d4abb6adbdc6406c39ea39" name="libtss2-tcti-mssim0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="d0574a1b92992864ba99c09086bc868c6818cc1a611c602d6e212286f970e1d7" name="libtss2-tcti-mssim0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="1af31e9ac98e797dcc8637117344221226c4c5183453abcb19a895d40fb20191" name="libtss2-tcti-pcap0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="73f703ee3ad06c010b7cd5fc23078dc5c6211b98f92262163b53a9d6d4738c0a" name="libtss2-tcti-pcap0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="6d3b0355ef91e667d7ec1db93317631df4046682068c9ea12332f03ed4f4bbe7" name="libtss2-tcti-pcap0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="987396b76d87798609a9f1c1685461024121024ccd51870f4e47f2c7070474c6" name="libtss2-tcti-pcap0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="fc1af1d84f1e0b4251ec7e9a9553c2896dd513c939c40cb1067440555445fe42" name="libtss2-tcti-spi-helper0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="ed98855d93fe2ed977f6306e41a96abb1a187e6b2bb9d89cf54ee0b07e078593" name="libtss2-tcti-spi-helper0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="b80af4cb76135099aea49d87e7200eca32234fe32134267da974d4357724c0c4" name="libtss2-tcti-spi-helper0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="feaf444b9463a73d7176f1565a2b57e7dab42bdb9bc1294830c16f3162cc6258" name="libtss2-tcti-spi-helper0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="90cf37ba21962c8fadb07bf970d66aa2f30e79be7fd42c9a0fbe33039382a964" name="libtss2-tcti-spidev0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="beeece4e537fcd3943dacc5d104015341fc6e5460867f772036348c6bba80683" name="libtss2-tcti-spidev0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="8c8dadcebd34772d9018f7c9b162598b90879f1861c8ddf19f43f3bc6528c34b" name="libtss2-tcti-spidev0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="7b3b288184ac0702f8a58bc37a1ba6d446fbcb3ae8e17e17ee94ccdf180c847a" name="libtss2-tcti-spidev0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="1afa564dfb9cbeca7d92d184830cd2a8e091cb3f928f32b4347c0f60766d0aa7" name="libtss2-tcti-swtpm0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="ea5496bd0d34149df6e8394f769d6e32fead2d89121beb3592957d72aa892218" name="libtss2-tcti-swtpm0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="a03bfe65f3fce8256af3e8ed956123ad4ce5d41b0819e83f529b7499515c9aae" name="libtss2-tcti-swtpm0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="39f67f075f9a7b95be4371df27f6de78ac22ba72708cc2c1fceade19155623e5" name="libtss2-tcti-swtpm0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="b4bdc83274b6f28bf6151be9070dc084858fe54871329eaad3b5cabd4ed1e1af" name="libtss2-tcti-tabrmd0" arch="aarch64">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="4f035d6d471788c5fe5f335d37dd4c5d9b348fc77399e0ac667738e44916c429" name="libtss2-tcti-tabrmd0" arch="armv7hl">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="76a624c71d22bf4d485f18ccf15624491cc12cb618519e39e2592eb42a4d9cd4" name="libtss2-tcti-tabrmd0-debuginfo" arch="aarch64">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="34d1e13ce76910895cf3607c205af97ae40b99f84f938b6adba002665055b5b5" name="libtss2-tcti-tabrmd0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="88a18df4500e0c2c35d73eb9b78a4bcd277e8798c6e943be6e31a4337938f4d2" name="libtss2-tctildr0" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="ac0101ccea932aca1609084164c9f81a4796fa3cf5205b80b44134fb7d73a6ce" name="libtss2-tctildr0" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="50612d632efff4a2b4d293d9afee1696e9e203faaf5697fd58b45e21382eb2ce" name="libtss2-tctildr0-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="997cc279cf9177279971e24fbbe431384cfb08504359e3aa2ab979a4e4cd0961" name="libtss2-tctildr0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="793a4775e380a530d4eafdef27db8d756dca1778f95fc8b3241c6bebc78b6ee5" name="python313-keylime" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="138.2"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="1b2fe09c2a718831ea5ee3ff817db22a3801278356e1466868d5bed3407b8a06" name="python314-keylime" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="138.2"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="496516c3127f888bd5cf5c70c5cc2d7b7ebc126386b740c98f95436ab33f5458" name="rust-keylime" arch="aarch64">
  <version epoch="0" ver="0.2.9+49" rel="279.9"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="d520063df6515c1cf3e4a5e561e63e4c29ddca65f28ba869c4c8c74e0862bb7a" name="rust-keylime" arch="armv7hl">
  <version epoch="0" ver="0.2.9+49" rel="279.9"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="684a1da167a72bf2c128f5dfc1f0cc20175463a80ee92d145c1c1e17f7b8fe2b" name="rust-keylime" arch="src">
  <version epoch="0" ver="0.2.9+49" rel="279.9"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="5d1d601a3e0b068697ce7018c18a6ef3304a0ef943cf7f77887ba3a93c01f901" name="rust-keylime-debuginfo" arch="aarch64">
  <version epoch="0" ver="0.2.9+49" rel="279.9"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="29dd9aefe0908b445dd876a78644ec476a3253c93e28cfe9d05c9efbd7ce3c9e" name="rust-keylime-debuginfo" arch="armv7hl">
  <version epoch="0" ver="0.2.9+49" rel="279.9"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="c8bd3f0f95cd3073801a6583672d224f3e474dee9f3c4dd4820dfd566ac4bc5b" name="rust-keylime-debugsource" arch="aarch64">
  <version epoch="0" ver="0.2.9+49" rel="279.9"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="1361d4abeb292dbfc3844ca10b345fe21b19fedef55e1f57ca437d826cdf4f6b" name="rust-keylime-debugsource" arch="armv7hl">
  <version epoch="0" ver="0.2.9+49" rel="279.9"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="7484999b660166cfde648275f31f7999541ef7b5817e5976902f7274e07988d0" name="tpm2-0-tss" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="b1ce77c751fabcaa53bc3c69842df739981ffe5bb594b02c9cfaa3935e094b90" name="tpm2-0-tss" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="a5ed5262f9b574a07d493983e19071ae7f749d7fe316a54012b5fd5c52e1f2d8" name="tpm2-0-tss" arch="src">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 3.2.0
  + Fixed
  * FAPI: fix curl_url_set call
  * FAPI: Fix usage of curl url (Should fix Ubuntu 22.04)
  * Fix buffer upcast leading to misalignment
  * Fix check whether SM3 is available
  * Update git.mk to support R/O src-dir
  * Fixed file descriptor leak when tcti initialization failed.
  * 32 Bit builds of the integration tests.
  * Primary key creation, in some cases the unique field was not
    cleared before calling create primary.
  * Primary keys was used for signing the object were cleared after
    loading. So access e.g. to the certificate did not work.
  * Primary keys created with Fapi_Create with an auth value, the
    auth_value was not used in inSensitive to recreate the primary
    key. Now the auth value callback is used to initialize
    inSensitive.
  * The not possible usage of policies for primary keys generated
    with Fapi_CreatePrimary has been fixed.
  * An infinite loop when parsing erroneous JSON was fixed in FAPI.
  * A buffer overflow in ESAPI xor parameter obfuscation was fixed.
  * Certificates could be read only once in one application The
    setting the init state of the state automaton for getting
    certificates was fixed.
  * A double free when executing policy action was fixed.
  * A leak in Fapi_Quote was fixed.
  * The wrong file locking in FAPI IO was fixed.
  * Enable creation of tss group and user on systems with busybox
    for fapi.
  * One fapi integration test did change the auth value of the
    storage hierarchy.
  * A leak in fapi crypto with ossl3 was fixed.
  * Add initial camelia support to FAPI
  * Fix tests of fapi PCR
  * Fix tests of ACT functionality if not supported by pTPM
  * Fix compiler (unused) warning when building without debug
    logging
  * Fix leaks in error cases of integration tests
  * Fix memory leak after ifapi_init_primary_finish failed
  * Fix double-close of stream in FAPI
  * Fix segfault when ESYS_TR_NONE is passed to Esys_TR_GetName
  * Fix the authorization of hierarchy objects used in policy
    secret.
  * Fix check of qualifying data in Fapi_VerifyQuote.
  * Fix some leaks in FAPI error cases.
  * Make scripts compatible with non-posix shells where test does
    not know -a and -o.
  * Fix usage of variable not initialized when fapi keystore is
    empty.
  + Added
  * Add additional IFX root CAs
  * Added support for SM2, SM3 and SM4.
  * Added support for OpenSSL 3.0.0.
  * Added authPolicy field to the TPMU_CAPABILITIES union.
  * Added actData field to the TPMU_CAPABILITIES union.
  * Added TPM2_CAP_AUTH_POLICIES
  * Added TPM2_CAP_ACT constants.
  * Added updates to the marshalling and unmarshalling of the
    TPMU_CAPABILITIES union.
  * Added updated to the FAPI serializations and deserializations of
    the TPMU_CAPABILITIES union and associated types.
  * Add CODE_OF_CONDUCT
  * tcti-mssim and tcti-swtpm gained support for UDX communication
  * Missing constant for TPM2_RH_PW
  + Removed
  * Removed support for OpenSSL &lt; 1.1.0.
  * Marked TPMS_ALGORITHM_DESCRIPTION and corresponding MU routines
    as deprecated.
  * Those were errorous typedefs that are not use and not useful. So
    we will remove this with 3.3
  * Marked TPM2_RS_PW as deprecated. Use TPM2_RH_PW instead.
- Update to 3.1.1
  + Fixed
  * Fixed file descriptor leak when tcti initialization failed.
  * Primary key creation, in some cases the unique field was not
    cleared before calling create primary.
  * Primary keys was used for signing the object were cleared after
    loading. So access e.g. to the certificate did not work.
  * Primary keys created with Fapi_Create with an auth value, the
    auth_value was not used in inSensitive to recreate the primary
    key. Now the auth value callback is used to initialize
    inSensitive.
  * The not possible usage of policies for primary keys generated
    with Fapi_CreatePrimary has been fixed.
  * An infinite loop when parsing erroneous JSON was fixed in FAPI.
  * A buffer overflow in ESAPI xor parameter obfuscation was fixed.
  * Certificates could be read only once in one application The
    setting the init state of the state automaton for getting
    certificates was fixed.
  * A double free when executing policy action was fixed.
  * A leak in Fapi_Quote was fixed.
  * The wrong file locking in FAPI IO was fixed.
  * One fapi integration test did change the auth value of the
    storage hierarchy.
  * Fix test of FAPI PCR
  * Fix leaks in error cases of integration tests
  * Fix segfault when ESYS_TR_NONE is passed to Esys_TR_GetName
  * Fix the authorization of hierarchy objects used in policy
    secret.
  * Fix check of qualifying data in Fapi_VerifyQuote.
  * Fix some leaks in FAPI error cases.
  * Fix usage of variable not initialized when fapi keystore is
    empty.
  + Added
  * Add additional IFX root CAs</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="3ddbb753ae4e1a3ecbce82311168b43cb2cb1472c54dae6553818de42935bd96" name="tpm2-0-tss-debugsource" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="6a8314cf8f89dd642994a747e720d7c7b0b99ba2a311141366c52e74222e8d20" name="tpm2-0-tss-debugsource" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="7821475667e068d6992eb1fe6635fafe40b2ddb79a0fa0a278500dc7d7926369" name="tpm2-0-tss-devel" arch="aarch64">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="62e9302d909e3f771c3d06e44abfdfea01f8db25eb43c953f7f51b8bbc4b200c" name="tpm2-0-tss-devel" arch="armv7hl">
  <version epoch="0" ver="4.1.3" rel="161.10"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="b2ce729800c35147fb3d78164bef8246cb2523c5840bbef1ede2102650175507" name="tpm2-pkcs11" arch="aarch64">
  <version epoch="0" ver="1.9.1" rel="38.7"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1629633600">- Use definite tense in %description.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to 1.7.0
  + DB Schema Change from 5 to 7.
  * Backup your DB before upgrading
  + Fixed compilation issues with GCC11.
  + Fixed errors on releases due to newer compilers from failing by
    only adding -Werror for non-release builds.
  + Fixed error message when the DB is too new in tpm2_ptool.
  + Added support for tpm2_ptool import with ssh-keygen format
    keys. Note: Requires cryptography &gt;= 3.0.
  + Changed default long level from error to warning.
  + Added better error message for FAPI backend errors along with
    docs/FAPI.md document.
  + Changed tpm2_ptool make --algorithm optional.
  + Fixed error message of wrong attribute name on expected attribute
    check to be false.
  + Added support for ECDSA 256, 384 and 512.
  + Fixed a bug in the Python code DB upgrade path from 4 to 5 where
    it didn't add AES mode CTR to CKA_ALLOWED_MECHANISMS.
  + Added tpm2_ptool support for ECC key size 192.
  + Added support passwordless login for tokens, ie not setting
    CKF_LOGIN_REQUIRED.
  + Fixed Running integration tests when Java version has the -ea,
    like on Debian 11 and OpenJDK 17.
  + Added support for HMAC keys using tpm2_ptool and the C_Sign and
    C_Verify interfaces. The following interfaces in ptool have
    support:
  * addkey: previous working versions of tpm2-tools will support
    this.
  * link: previous working versions of tpm2-tools will support this.
  * import: requires tpm2-tools 5.2+ for support.
  + Fixed leaking of temp file descriptors in tpm2_ptool.
  + Fixed wrong free in tpm code, should use Esys_Free.
  + Fixed a space formatting issue in tpm2_ptool verify.
  + Fixed leaked file descriptor in tpm2_ptool.
  + Fixed a few suspicious sizeof usages in str_padded_copy
  + Fixed a memory leak of the token list on a failure condition in
    initialization.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1634731201">- Add keyring &amp; use source verification</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1645876800">- Use hardlinks in %fdupes for python files</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 1.8.0
  + Fixed
  * Fix GetRandom Memory Leak
  * Fix some spelling mistakes
  * Fix unit test test_parser
  * Fix importing of RSA private key through pkcs11 interface should
    fail.
  * Fix ECDSA signature length calculation.
  * Fix memory leak of tokens.
  * Fix suspicious sizeof usage in _str_padded_copy
  * Fix encoding errors when importing a certificate into the pkcs11
    store.
  * Fix try/finally scope issues in tpm2_ptool.
  * Fix, an OOB access in db upgrade path.
  * Fix ECDSA length calculation that was causing issues with Mutual
    TLS in Firefox and Chrome.
  + Changed
  * remove unused macro set_safe_rc
  + Added
  * Add support for OpenSSL 3. Note that calls through engine are no
    longer supported on OpenSSL3.
  * Add tpm2_ptool export commandlet for exporting token keys into
    PEM and TPM blob format.
- Add new dependencies to PyYAML, cryptography, pyasn1 and tpm2-pytss</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to 1.9.0
  + Fixed
  * Fix autoconf invocation on a release tarball not being a git
    repo for VERSION. VERSION file now generated and packaged as
    part of the release tarball from the git version information.
  * Fix TPM2_PKCS11_OWNER_AUTH not being used when a persistent SRK
    is needed in the C_InitToken path.
  * During an upgrade of the database to version 4, the config key
    'persistent' is added instead of 'transient', causing KeyError
    when using the upgraded database.
  * Leave the original db on upgrade failure, a bug caused the
    original db to be unlinked not the upgraded db.
  * A bug prevented the use of CreateLoaded if the TPM supports the
    command.
  * A bug when creating keys through the PKCS11 interface (not
    tpm2-ptool), the attributes for CKA_ALLOWED_MECHANISMS were
    encoded as a hex string and not a sequence of ints within the
    YAML. Correcting this will trigger a db upgrade to 8
  + Added
  * Env varibale PKCS11_SQL_LOCK to allow setting a lock directory,
    eg for temprary directory so lock files do not persist across
    reboots.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684411200">- Merge subpackages lib and devel into the main one</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1733918400">- Update to 1.9.1
  + Fixed
  * configure:
    Change mistaken += to =.
    use user supplied --prefix even when p11kit is detected.
  * Remove warning about unable to find FAPI when it's is not-compiled in and not chosen as the beckend.
  * Fix memory leaks in tpm_create_transient_primary_from_template.
  * Fix NULL pointer dereference in db.c on uses of CKA_ALLOWED_MECHANISMS.
  * Fix offset miscalculation in FAPI backend that was corrupting data.
  * Support CKM_ECDH1_DERIVE via C_DeriveKey.
  * Fix usages of tpm2-ptool for its wrapped tpm2_ptool in tests.
  * Fix failing db upgrades on double conversion to int.
  * Fix db lock file due to missing parenthesis and order of operations.
  * documentation:
    Fix use of objects where tokens was meant.
  + Changed
  * --enable-fapi to --with-fapi. Note this is not a major version bump as its internal to builders only. However --enable-fapi left in place for backwards compat.
  + Add maintainer public key:
    tpm2-pkcs11.keyring</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734004800">- Enable unit testing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1781092800">- Use pyproject macros to build and install the tools.</changelog>
</package>
<package pkgid="cb16455f22988d1686ed382eacd81eacbd37466e379cb552ad242359d04df8e6" name="tpm2-pkcs11" arch="armv7hl">
  <version epoch="0" ver="1.9.1" rel="38.7"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1629633600">- Use definite tense in %description.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to 1.7.0
  + DB Schema Change from 5 to 7.
  * Backup your DB before upgrading
  + Fixed compilation issues with GCC11.
  + Fixed errors on releases due to newer compilers from failing by
    only adding -Werror for non-release builds.
  + Fixed error message when the DB is too new in tpm2_ptool.
  + Added support for tpm2_ptool import with ssh-keygen format
    keys. Note: Requires cryptography &gt;= 3.0.
  + Changed default long level from error to warning.
  + Added better error message for FAPI backend errors along with
    docs/FAPI.md document.
  + Changed tpm2_ptool make --algorithm optional.
  + Fixed error message of wrong attribute name on expected attribute
    check to be false.
  + Added support for ECDSA 256, 384 and 512.
  + Fixed a bug in the Python code DB upgrade path from 4 to 5 where
    it didn't add AES mode CTR to CKA_ALLOWED_MECHANISMS.
  + Added tpm2_ptool support for ECC key size 192.
  + Added support passwordless login for tokens, ie not setting
    CKF_LOGIN_REQUIRED.
  + Fixed Running integration tests when Java version has the -ea,
    like on Debian 11 and OpenJDK 17.
  + Added support for HMAC keys using tpm2_ptool and the C_Sign and
    C_Verify interfaces. The following interfaces in ptool have
    support:
  * addkey: previous working versions of tpm2-tools will support
    this.
  * link: previous working versions of tpm2-tools will support this.
  * import: requires tpm2-tools 5.2+ for support.
  + Fixed leaking of temp file descriptors in tpm2_ptool.
  + Fixed wrong free in tpm code, should use Esys_Free.
  + Fixed a space formatting issue in tpm2_ptool verify.
  + Fixed leaked file descriptor in tpm2_ptool.
  + Fixed a few suspicious sizeof usages in str_padded_copy
  + Fixed a memory leak of the token list on a failure condition in
    initialization.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1634731201">- Add keyring &amp; use source verification</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1645876800">- Use hardlinks in %fdupes for python files</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 1.8.0
  + Fixed
  * Fix GetRandom Memory Leak
  * Fix some spelling mistakes
  * Fix unit test test_parser
  * Fix importing of RSA private key through pkcs11 interface should
    fail.
  * Fix ECDSA signature length calculation.
  * Fix memory leak of tokens.
  * Fix suspicious sizeof usage in _str_padded_copy
  * Fix encoding errors when importing a certificate into the pkcs11
    store.
  * Fix try/finally scope issues in tpm2_ptool.
  * Fix, an OOB access in db upgrade path.
  * Fix ECDSA length calculation that was causing issues with Mutual
    TLS in Firefox and Chrome.
  + Changed
  * remove unused macro set_safe_rc
  + Added
  * Add support for OpenSSL 3. Note that calls through engine are no
    longer supported on OpenSSL3.
  * Add tpm2_ptool export commandlet for exporting token keys into
    PEM and TPM blob format.
- Add new dependencies to PyYAML, cryptography, pyasn1 and tpm2-pytss</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to 1.9.0
  + Fixed
  * Fix autoconf invocation on a release tarball not being a git
    repo for VERSION. VERSION file now generated and packaged as
    part of the release tarball from the git version information.
  * Fix TPM2_PKCS11_OWNER_AUTH not being used when a persistent SRK
    is needed in the C_InitToken path.
  * During an upgrade of the database to version 4, the config key
    'persistent' is added instead of 'transient', causing KeyError
    when using the upgraded database.
  * Leave the original db on upgrade failure, a bug caused the
    original db to be unlinked not the upgraded db.
  * A bug prevented the use of CreateLoaded if the TPM supports the
    command.
  * A bug when creating keys through the PKCS11 interface (not
    tpm2-ptool), the attributes for CKA_ALLOWED_MECHANISMS were
    encoded as a hex string and not a sequence of ints within the
    YAML. Correcting this will trigger a db upgrade to 8
  + Added
  * Env varibale PKCS11_SQL_LOCK to allow setting a lock directory,
    eg for temprary directory so lock files do not persist across
    reboots.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684411200">- Merge subpackages lib and devel into the main one</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1733918400">- Update to 1.9.1
  + Fixed
  * configure:
    Change mistaken += to =.
    use user supplied --prefix even when p11kit is detected.
  * Remove warning about unable to find FAPI when it's is not-compiled in and not chosen as the beckend.
  * Fix memory leaks in tpm_create_transient_primary_from_template.
  * Fix NULL pointer dereference in db.c on uses of CKA_ALLOWED_MECHANISMS.
  * Fix offset miscalculation in FAPI backend that was corrupting data.
  * Support CKM_ECDH1_DERIVE via C_DeriveKey.
  * Fix usages of tpm2-ptool for its wrapped tpm2_ptool in tests.
  * Fix failing db upgrades on double conversion to int.
  * Fix db lock file due to missing parenthesis and order of operations.
  * documentation:
    Fix use of objects where tokens was meant.
  + Changed
  * --enable-fapi to --with-fapi. Note this is not a major version bump as its internal to builders only. However --enable-fapi left in place for backwards compat.
  + Add maintainer public key:
    tpm2-pkcs11.keyring</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734004800">- Enable unit testing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1781092800">- Use pyproject macros to build and install the tools.</changelog>
</package>
<package pkgid="8e2e61f068ae1732bafb9d2d9a6e39372b671caf0029a584a83f4e6df52707c8" name="tpm2-pkcs11" arch="src">
  <version epoch="0" ver="1.9.1" rel="38.7"/>
  <changelog author="Alexander Evseev &lt;aevseev@gmail.com&gt; - 1.3.1" date="1596456000">- First build. Version - 1.3.1</changelog>
  <changelog author="Alexander Evseev &lt;aevseev@gmail.com&gt; - 1.4.0" date="1599652800">- New upstream version - 1.4.0</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1629460800">- Clean spec file
- Use better source URL
- Split library
- Don't package .la files
- Create store directory
- Move devel library to devel subpackage</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1629547200">- Build and install python tools</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1629633600">- Use definite tense in %description.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to 1.7.0
  + DB Schema Change from 5 to 7.
  * Backup your DB before upgrading
  + Fixed compilation issues with GCC11.
  + Fixed errors on releases due to newer compilers from failing by
    only adding -Werror for non-release builds.
  + Fixed error message when the DB is too new in tpm2_ptool.
  + Added support for tpm2_ptool import with ssh-keygen format
    keys. Note: Requires cryptography &gt;= 3.0.
  + Changed default long level from error to warning.
  + Added better error message for FAPI backend errors along with
    docs/FAPI.md document.
  + Changed tpm2_ptool make --algorithm optional.
  + Fixed error message of wrong attribute name on expected attribute
    check to be false.
  + Added support for ECDSA 256, 384 and 512.
  + Fixed a bug in the Python code DB upgrade path from 4 to 5 where
    it didn't add AES mode CTR to CKA_ALLOWED_MECHANISMS.
  + Added tpm2_ptool support for ECC key size 192.
  + Added support passwordless login for tokens, ie not setting
    CKF_LOGIN_REQUIRED.
  + Fixed Running integration tests when Java version has the -ea,
    like on Debian 11 and OpenJDK 17.
  + Added support for HMAC keys using tpm2_ptool and the C_Sign and
    C_Verify interfaces. The following interfaces in ptool have
    support:
  * addkey: previous working versions of tpm2-tools will support
    this.
  * link: previous working versions of tpm2-tools will support this.
  * import: requires tpm2-tools 5.2+ for support.
  + Fixed leaking of temp file descriptors in tpm2_ptool.
  + Fixed wrong free in tpm code, should use Esys_Free.
  + Fixed a space formatting issue in tpm2_ptool verify.
  + Fixed leaked file descriptor in tpm2_ptool.
  + Fixed a few suspicious sizeof usages in str_padded_copy
  + Fixed a memory leak of the token list on a failure condition in
    initialization.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1634731201">- Add keyring &amp; use source verification</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1645876800">- Use hardlinks in %fdupes for python files</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 1.8.0
  + Fixed
  * Fix GetRandom Memory Leak
  * Fix some spelling mistakes
  * Fix unit test test_parser
  * Fix importing of RSA private key through pkcs11 interface should
    fail.
  * Fix ECDSA signature length calculation.
  * Fix memory leak of tokens.
  * Fix suspicious sizeof usage in _str_padded_copy
  * Fix encoding errors when importing a certificate into the pkcs11
    store.
  * Fix try/finally scope issues in tpm2_ptool.
  * Fix, an OOB access in db upgrade path.
  * Fix ECDSA length calculation that was causing issues with Mutual
    TLS in Firefox and Chrome.
  + Changed
  * remove unused macro set_safe_rc
  + Added
  * Add support for OpenSSL 3. Note that calls through engine are no
    longer supported on OpenSSL3.
  * Add tpm2_ptool export commandlet for exporting token keys into
    PEM and TPM blob format.
- Add new dependencies to PyYAML, cryptography, pyasn1 and tpm2-pytss</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to 1.9.0
  + Fixed
  * Fix autoconf invocation on a release tarball not being a git
    repo for VERSION. VERSION file now generated and packaged as
    part of the release tarball from the git version information.
  * Fix TPM2_PKCS11_OWNER_AUTH not being used when a persistent SRK
    is needed in the C_InitToken path.
  * During an upgrade of the database to version 4, the config key
    'persistent' is added instead of 'transient', causing KeyError
    when using the upgraded database.
  * Leave the original db on upgrade failure, a bug caused the
    original db to be unlinked not the upgraded db.
  * A bug prevented the use of CreateLoaded if the TPM supports the
    command.
  * A bug when creating keys through the PKCS11 interface (not
    tpm2-ptool), the attributes for CKA_ALLOWED_MECHANISMS were
    encoded as a hex string and not a sequence of ints within the
    YAML. Correcting this will trigger a db upgrade to 8
  + Added
  * Env varibale PKCS11_SQL_LOCK to allow setting a lock directory,
    eg for temprary directory so lock files do not persist across
    reboots.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684411200">- Merge subpackages lib and devel into the main one</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1733918400">- Update to 1.9.1
  + Fixed
  * configure:
    Change mistaken += to =.
    use user supplied --prefix even when p11kit is detected.
  * Remove warning about unable to find FAPI when it's is not-compiled in and not chosen as the beckend.
  * Fix memory leaks in tpm_create_transient_primary_from_template.
  * Fix NULL pointer dereference in db.c on uses of CKA_ALLOWED_MECHANISMS.
  * Fix offset miscalculation in FAPI backend that was corrupting data.
  * Support CKM_ECDH1_DERIVE via C_DeriveKey.
  * Fix usages of tpm2-ptool for its wrapped tpm2_ptool in tests.
  * Fix failing db upgrades on double conversion to int.
  * Fix db lock file due to missing parenthesis and order of operations.
  * documentation:
    Fix use of objects where tokens was meant.
  + Changed
  * --enable-fapi to --with-fapi. Note this is not a major version bump as its internal to builders only. However --enable-fapi left in place for backwards compat.
  + Add maintainer public key:
    tpm2-pkcs11.keyring</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734004800">- Enable unit testing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1781092800">- Use pyproject macros to build and install the tools.</changelog>
</package>
<package pkgid="c2679ca32bdb8d0021460bf9f21828675b46acbba96acd22ef86f4cdf3d45b8a" name="tpm2-pkcs11-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.9.1" rel="38.7"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1629633600">- Use definite tense in %description.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to 1.7.0
  + DB Schema Change from 5 to 7.
  * Backup your DB before upgrading
  + Fixed compilation issues with GCC11.
  + Fixed errors on releases due to newer compilers from failing by
    only adding -Werror for non-release builds.
  + Fixed error message when the DB is too new in tpm2_ptool.
  + Added support for tpm2_ptool import with ssh-keygen format
    keys. Note: Requires cryptography &gt;= 3.0.
  + Changed default long level from error to warning.
  + Added better error message for FAPI backend errors along with
    docs/FAPI.md document.
  + Changed tpm2_ptool make --algorithm optional.
  + Fixed error message of wrong attribute name on expected attribute
    check to be false.
  + Added support for ECDSA 256, 384 and 512.
  + Fixed a bug in the Python code DB upgrade path from 4 to 5 where
    it didn't add AES mode CTR to CKA_ALLOWED_MECHANISMS.
  + Added tpm2_ptool support for ECC key size 192.
  + Added support passwordless login for tokens, ie not setting
    CKF_LOGIN_REQUIRED.
  + Fixed Running integration tests when Java version has the -ea,
    like on Debian 11 and OpenJDK 17.
  + Added support for HMAC keys using tpm2_ptool and the C_Sign and
    C_Verify interfaces. The following interfaces in ptool have
    support:
  * addkey: previous working versions of tpm2-tools will support
    this.
  * link: previous working versions of tpm2-tools will support this.
  * import: requires tpm2-tools 5.2+ for support.
  + Fixed leaking of temp file descriptors in tpm2_ptool.
  + Fixed wrong free in tpm code, should use Esys_Free.
  + Fixed a space formatting issue in tpm2_ptool verify.
  + Fixed leaked file descriptor in tpm2_ptool.
  + Fixed a few suspicious sizeof usages in str_padded_copy
  + Fixed a memory leak of the token list on a failure condition in
    initialization.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1634731201">- Add keyring &amp; use source verification</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1645876800">- Use hardlinks in %fdupes for python files</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 1.8.0
  + Fixed
  * Fix GetRandom Memory Leak
  * Fix some spelling mistakes
  * Fix unit test test_parser
  * Fix importing of RSA private key through pkcs11 interface should
    fail.
  * Fix ECDSA signature length calculation.
  * Fix memory leak of tokens.
  * Fix suspicious sizeof usage in _str_padded_copy
  * Fix encoding errors when importing a certificate into the pkcs11
    store.
  * Fix try/finally scope issues in tpm2_ptool.
  * Fix, an OOB access in db upgrade path.
  * Fix ECDSA length calculation that was causing issues with Mutual
    TLS in Firefox and Chrome.
  + Changed
  * remove unused macro set_safe_rc
  + Added
  * Add support for OpenSSL 3. Note that calls through engine are no
    longer supported on OpenSSL3.
  * Add tpm2_ptool export commandlet for exporting token keys into
    PEM and TPM blob format.
- Add new dependencies to PyYAML, cryptography, pyasn1 and tpm2-pytss</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to 1.9.0
  + Fixed
  * Fix autoconf invocation on a release tarball not being a git
    repo for VERSION. VERSION file now generated and packaged as
    part of the release tarball from the git version information.
  * Fix TPM2_PKCS11_OWNER_AUTH not being used when a persistent SRK
    is needed in the C_InitToken path.
  * During an upgrade of the database to version 4, the config key
    'persistent' is added instead of 'transient', causing KeyError
    when using the upgraded database.
  * Leave the original db on upgrade failure, a bug caused the
    original db to be unlinked not the upgraded db.
  * A bug prevented the use of CreateLoaded if the TPM supports the
    command.
  * A bug when creating keys through the PKCS11 interface (not
    tpm2-ptool), the attributes for CKA_ALLOWED_MECHANISMS were
    encoded as a hex string and not a sequence of ints within the
    YAML. Correcting this will trigger a db upgrade to 8
  + Added
  * Env varibale PKCS11_SQL_LOCK to allow setting a lock directory,
    eg for temprary directory so lock files do not persist across
    reboots.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684411200">- Merge subpackages lib and devel into the main one</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1733918400">- Update to 1.9.1
  + Fixed
  * configure:
    Change mistaken += to =.
    use user supplied --prefix even when p11kit is detected.
  * Remove warning about unable to find FAPI when it's is not-compiled in and not chosen as the beckend.
  * Fix memory leaks in tpm_create_transient_primary_from_template.
  * Fix NULL pointer dereference in db.c on uses of CKA_ALLOWED_MECHANISMS.
  * Fix offset miscalculation in FAPI backend that was corrupting data.
  * Support CKM_ECDH1_DERIVE via C_DeriveKey.
  * Fix usages of tpm2-ptool for its wrapped tpm2_ptool in tests.
  * Fix failing db upgrades on double conversion to int.
  * Fix db lock file due to missing parenthesis and order of operations.
  * documentation:
    Fix use of objects where tokens was meant.
  + Changed
  * --enable-fapi to --with-fapi. Note this is not a major version bump as its internal to builders only. However --enable-fapi left in place for backwards compat.
  + Add maintainer public key:
    tpm2-pkcs11.keyring</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734004800">- Enable unit testing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1781092800">- Use pyproject macros to build and install the tools.</changelog>
</package>
<package pkgid="171fcffd98b25794cf04dbf72d437109d1d47da766d4b265c86a6e2eda402860" name="tpm2-pkcs11-debuginfo" arch="armv7hl">
  <version epoch="0" ver="1.9.1" rel="38.7"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1629633600">- Use definite tense in %description.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to 1.7.0
  + DB Schema Change from 5 to 7.
  * Backup your DB before upgrading
  + Fixed compilation issues with GCC11.
  + Fixed errors on releases due to newer compilers from failing by
    only adding -Werror for non-release builds.
  + Fixed error message when the DB is too new in tpm2_ptool.
  + Added support for tpm2_ptool import with ssh-keygen format
    keys. Note: Requires cryptography &gt;= 3.0.
  + Changed default long level from error to warning.
  + Added better error message for FAPI backend errors along with
    docs/FAPI.md document.
  + Changed tpm2_ptool make --algorithm optional.
  + Fixed error message of wrong attribute name on expected attribute
    check to be false.
  + Added support for ECDSA 256, 384 and 512.
  + Fixed a bug in the Python code DB upgrade path from 4 to 5 where
    it didn't add AES mode CTR to CKA_ALLOWED_MECHANISMS.
  + Added tpm2_ptool support for ECC key size 192.
  + Added support passwordless login for tokens, ie not setting
    CKF_LOGIN_REQUIRED.
  + Fixed Running integration tests when Java version has the -ea,
    like on Debian 11 and OpenJDK 17.
  + Added support for HMAC keys using tpm2_ptool and the C_Sign and
    C_Verify interfaces. The following interfaces in ptool have
    support:
  * addkey: previous working versions of tpm2-tools will support
    this.
  * link: previous working versions of tpm2-tools will support this.
  * import: requires tpm2-tools 5.2+ for support.
  + Fixed leaking of temp file descriptors in tpm2_ptool.
  + Fixed wrong free in tpm code, should use Esys_Free.
  + Fixed a space formatting issue in tpm2_ptool verify.
  + Fixed leaked file descriptor in tpm2_ptool.
  + Fixed a few suspicious sizeof usages in str_padded_copy
  + Fixed a memory leak of the token list on a failure condition in
    initialization.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1634731201">- Add keyring &amp; use source verification</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1645876800">- Use hardlinks in %fdupes for python files</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 1.8.0
  + Fixed
  * Fix GetRandom Memory Leak
  * Fix some spelling mistakes
  * Fix unit test test_parser
  * Fix importing of RSA private key through pkcs11 interface should
    fail.
  * Fix ECDSA signature length calculation.
  * Fix memory leak of tokens.
  * Fix suspicious sizeof usage in _str_padded_copy
  * Fix encoding errors when importing a certificate into the pkcs11
    store.
  * Fix try/finally scope issues in tpm2_ptool.
  * Fix, an OOB access in db upgrade path.
  * Fix ECDSA length calculation that was causing issues with Mutual
    TLS in Firefox and Chrome.
  + Changed
  * remove unused macro set_safe_rc
  + Added
  * Add support for OpenSSL 3. Note that calls through engine are no
    longer supported on OpenSSL3.
  * Add tpm2_ptool export commandlet for exporting token keys into
    PEM and TPM blob format.
- Add new dependencies to PyYAML, cryptography, pyasn1 and tpm2-pytss</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to 1.9.0
  + Fixed
  * Fix autoconf invocation on a release tarball not being a git
    repo for VERSION. VERSION file now generated and packaged as
    part of the release tarball from the git version information.
  * Fix TPM2_PKCS11_OWNER_AUTH not being used when a persistent SRK
    is needed in the C_InitToken path.
  * During an upgrade of the database to version 4, the config key
    'persistent' is added instead of 'transient', causing KeyError
    when using the upgraded database.
  * Leave the original db on upgrade failure, a bug caused the
    original db to be unlinked not the upgraded db.
  * A bug prevented the use of CreateLoaded if the TPM supports the
    command.
  * A bug when creating keys through the PKCS11 interface (not
    tpm2-ptool), the attributes for CKA_ALLOWED_MECHANISMS were
    encoded as a hex string and not a sequence of ints within the
    YAML. Correcting this will trigger a db upgrade to 8
  + Added
  * Env varibale PKCS11_SQL_LOCK to allow setting a lock directory,
    eg for temprary directory so lock files do not persist across
    reboots.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684411200">- Merge subpackages lib and devel into the main one</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1733918400">- Update to 1.9.1
  + Fixed
  * configure:
    Change mistaken += to =.
    use user supplied --prefix even when p11kit is detected.
  * Remove warning about unable to find FAPI when it's is not-compiled in and not chosen as the beckend.
  * Fix memory leaks in tpm_create_transient_primary_from_template.
  * Fix NULL pointer dereference in db.c on uses of CKA_ALLOWED_MECHANISMS.
  * Fix offset miscalculation in FAPI backend that was corrupting data.
  * Support CKM_ECDH1_DERIVE via C_DeriveKey.
  * Fix usages of tpm2-ptool for its wrapped tpm2_ptool in tests.
  * Fix failing db upgrades on double conversion to int.
  * Fix db lock file due to missing parenthesis and order of operations.
  * documentation:
    Fix use of objects where tokens was meant.
  + Changed
  * --enable-fapi to --with-fapi. Note this is not a major version bump as its internal to builders only. However --enable-fapi left in place for backwards compat.
  + Add maintainer public key:
    tpm2-pkcs11.keyring</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734004800">- Enable unit testing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1781092800">- Use pyproject macros to build and install the tools.</changelog>
</package>
<package pkgid="0ecfad18b83034b299f517cfd64cf8e9672251d44d29aae4b4c41c012bc0d08c" name="tpm2-pkcs11-debugsource" arch="aarch64">
  <version epoch="0" ver="1.9.1" rel="38.7"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1629633600">- Use definite tense in %description.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to 1.7.0
  + DB Schema Change from 5 to 7.
  * Backup your DB before upgrading
  + Fixed compilation issues with GCC11.
  + Fixed errors on releases due to newer compilers from failing by
    only adding -Werror for non-release builds.
  + Fixed error message when the DB is too new in tpm2_ptool.
  + Added support for tpm2_ptool import with ssh-keygen format
    keys. Note: Requires cryptography &gt;= 3.0.
  + Changed default long level from error to warning.
  + Added better error message for FAPI backend errors along with
    docs/FAPI.md document.
  + Changed tpm2_ptool make --algorithm optional.
  + Fixed error message of wrong attribute name on expected attribute
    check to be false.
  + Added support for ECDSA 256, 384 and 512.
  + Fixed a bug in the Python code DB upgrade path from 4 to 5 where
    it didn't add AES mode CTR to CKA_ALLOWED_MECHANISMS.
  + Added tpm2_ptool support for ECC key size 192.
  + Added support passwordless login for tokens, ie not setting
    CKF_LOGIN_REQUIRED.
  + Fixed Running integration tests when Java version has the -ea,
    like on Debian 11 and OpenJDK 17.
  + Added support for HMAC keys using tpm2_ptool and the C_Sign and
    C_Verify interfaces. The following interfaces in ptool have
    support:
  * addkey: previous working versions of tpm2-tools will support
    this.
  * link: previous working versions of tpm2-tools will support this.
  * import: requires tpm2-tools 5.2+ for support.
  + Fixed leaking of temp file descriptors in tpm2_ptool.
  + Fixed wrong free in tpm code, should use Esys_Free.
  + Fixed a space formatting issue in tpm2_ptool verify.
  + Fixed leaked file descriptor in tpm2_ptool.
  + Fixed a few suspicious sizeof usages in str_padded_copy
  + Fixed a memory leak of the token list on a failure condition in
    initialization.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1634731201">- Add keyring &amp; use source verification</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1645876800">- Use hardlinks in %fdupes for python files</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 1.8.0
  + Fixed
  * Fix GetRandom Memory Leak
  * Fix some spelling mistakes
  * Fix unit test test_parser
  * Fix importing of RSA private key through pkcs11 interface should
    fail.
  * Fix ECDSA signature length calculation.
  * Fix memory leak of tokens.
  * Fix suspicious sizeof usage in _str_padded_copy
  * Fix encoding errors when importing a certificate into the pkcs11
    store.
  * Fix try/finally scope issues in tpm2_ptool.
  * Fix, an OOB access in db upgrade path.
  * Fix ECDSA length calculation that was causing issues with Mutual
    TLS in Firefox and Chrome.
  + Changed
  * remove unused macro set_safe_rc
  + Added
  * Add support for OpenSSL 3. Note that calls through engine are no
    longer supported on OpenSSL3.
  * Add tpm2_ptool export commandlet for exporting token keys into
    PEM and TPM blob format.
- Add new dependencies to PyYAML, cryptography, pyasn1 and tpm2-pytss</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to 1.9.0
  + Fixed
  * Fix autoconf invocation on a release tarball not being a git
    repo for VERSION. VERSION file now generated and packaged as
    part of the release tarball from the git version information.
  * Fix TPM2_PKCS11_OWNER_AUTH not being used when a persistent SRK
    is needed in the C_InitToken path.
  * During an upgrade of the database to version 4, the config key
    'persistent' is added instead of 'transient', causing KeyError
    when using the upgraded database.
  * Leave the original db on upgrade failure, a bug caused the
    original db to be unlinked not the upgraded db.
  * A bug prevented the use of CreateLoaded if the TPM supports the
    command.
  * A bug when creating keys through the PKCS11 interface (not
    tpm2-ptool), the attributes for CKA_ALLOWED_MECHANISMS were
    encoded as a hex string and not a sequence of ints within the
    YAML. Correcting this will trigger a db upgrade to 8
  + Added
  * Env varibale PKCS11_SQL_LOCK to allow setting a lock directory,
    eg for temprary directory so lock files do not persist across
    reboots.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684411200">- Merge subpackages lib and devel into the main one</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1733918400">- Update to 1.9.1
  + Fixed
  * configure:
    Change mistaken += to =.
    use user supplied --prefix even when p11kit is detected.
  * Remove warning about unable to find FAPI when it's is not-compiled in and not chosen as the beckend.
  * Fix memory leaks in tpm_create_transient_primary_from_template.
  * Fix NULL pointer dereference in db.c on uses of CKA_ALLOWED_MECHANISMS.
  * Fix offset miscalculation in FAPI backend that was corrupting data.
  * Support CKM_ECDH1_DERIVE via C_DeriveKey.
  * Fix usages of tpm2-ptool for its wrapped tpm2_ptool in tests.
  * Fix failing db upgrades on double conversion to int.
  * Fix db lock file due to missing parenthesis and order of operations.
  * documentation:
    Fix use of objects where tokens was meant.
  + Changed
  * --enable-fapi to --with-fapi. Note this is not a major version bump as its internal to builders only. However --enable-fapi left in place for backwards compat.
  + Add maintainer public key:
    tpm2-pkcs11.keyring</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734004800">- Enable unit testing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1781092800">- Use pyproject macros to build and install the tools.</changelog>
</package>
<package pkgid="475af42187f064f7c63cc238b811c152bd09cdbc4e9aab0d4e1690927c5433a0" name="tpm2-pkcs11-debugsource" arch="armv7hl">
  <version epoch="0" ver="1.9.1" rel="38.7"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1629633600">- Use definite tense in %description.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to 1.7.0
  + DB Schema Change from 5 to 7.
  * Backup your DB before upgrading
  + Fixed compilation issues with GCC11.
  + Fixed errors on releases due to newer compilers from failing by
    only adding -Werror for non-release builds.
  + Fixed error message when the DB is too new in tpm2_ptool.
  + Added support for tpm2_ptool import with ssh-keygen format
    keys. Note: Requires cryptography &gt;= 3.0.
  + Changed default long level from error to warning.
  + Added better error message for FAPI backend errors along with
    docs/FAPI.md document.
  + Changed tpm2_ptool make --algorithm optional.
  + Fixed error message of wrong attribute name on expected attribute
    check to be false.
  + Added support for ECDSA 256, 384 and 512.
  + Fixed a bug in the Python code DB upgrade path from 4 to 5 where
    it didn't add AES mode CTR to CKA_ALLOWED_MECHANISMS.
  + Added tpm2_ptool support for ECC key size 192.
  + Added support passwordless login for tokens, ie not setting
    CKF_LOGIN_REQUIRED.
  + Fixed Running integration tests when Java version has the -ea,
    like on Debian 11 and OpenJDK 17.
  + Added support for HMAC keys using tpm2_ptool and the C_Sign and
    C_Verify interfaces. The following interfaces in ptool have
    support:
  * addkey: previous working versions of tpm2-tools will support
    this.
  * link: previous working versions of tpm2-tools will support this.
  * import: requires tpm2-tools 5.2+ for support.
  + Fixed leaking of temp file descriptors in tpm2_ptool.
  + Fixed wrong free in tpm code, should use Esys_Free.
  + Fixed a space formatting issue in tpm2_ptool verify.
  + Fixed leaked file descriptor in tpm2_ptool.
  + Fixed a few suspicious sizeof usages in str_padded_copy
  + Fixed a memory leak of the token list on a failure condition in
    initialization.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1634731201">- Add keyring &amp; use source verification</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1645876800">- Use hardlinks in %fdupes for python files</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 1.8.0
  + Fixed
  * Fix GetRandom Memory Leak
  * Fix some spelling mistakes
  * Fix unit test test_parser
  * Fix importing of RSA private key through pkcs11 interface should
    fail.
  * Fix ECDSA signature length calculation.
  * Fix memory leak of tokens.
  * Fix suspicious sizeof usage in _str_padded_copy
  * Fix encoding errors when importing a certificate into the pkcs11
    store.
  * Fix try/finally scope issues in tpm2_ptool.
  * Fix, an OOB access in db upgrade path.
  * Fix ECDSA length calculation that was causing issues with Mutual
    TLS in Firefox and Chrome.
  + Changed
  * remove unused macro set_safe_rc
  + Added
  * Add support for OpenSSL 3. Note that calls through engine are no
    longer supported on OpenSSL3.
  * Add tpm2_ptool export commandlet for exporting token keys into
    PEM and TPM blob format.
- Add new dependencies to PyYAML, cryptography, pyasn1 and tpm2-pytss</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to 1.9.0
  + Fixed
  * Fix autoconf invocation on a release tarball not being a git
    repo for VERSION. VERSION file now generated and packaged as
    part of the release tarball from the git version information.
  * Fix TPM2_PKCS11_OWNER_AUTH not being used when a persistent SRK
    is needed in the C_InitToken path.
  * During an upgrade of the database to version 4, the config key
    'persistent' is added instead of 'transient', causing KeyError
    when using the upgraded database.
  * Leave the original db on upgrade failure, a bug caused the
    original db to be unlinked not the upgraded db.
  * A bug prevented the use of CreateLoaded if the TPM supports the
    command.
  * A bug when creating keys through the PKCS11 interface (not
    tpm2-ptool), the attributes for CKA_ALLOWED_MECHANISMS were
    encoded as a hex string and not a sequence of ints within the
    YAML. Correcting this will trigger a db upgrade to 8
  + Added
  * Env varibale PKCS11_SQL_LOCK to allow setting a lock directory,
    eg for temprary directory so lock files do not persist across
    reboots.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684411200">- Merge subpackages lib and devel into the main one</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1733918400">- Update to 1.9.1
  + Fixed
  * configure:
    Change mistaken += to =.
    use user supplied --prefix even when p11kit is detected.
  * Remove warning about unable to find FAPI when it's is not-compiled in and not chosen as the beckend.
  * Fix memory leaks in tpm_create_transient_primary_from_template.
  * Fix NULL pointer dereference in db.c on uses of CKA_ALLOWED_MECHANISMS.
  * Fix offset miscalculation in FAPI backend that was corrupting data.
  * Support CKM_ECDH1_DERIVE via C_DeriveKey.
  * Fix usages of tpm2-ptool for its wrapped tpm2_ptool in tests.
  * Fix failing db upgrades on double conversion to int.
  * Fix db lock file due to missing parenthesis and order of operations.
  * documentation:
    Fix use of objects where tokens was meant.
  + Changed
  * --enable-fapi to --with-fapi. Note this is not a major version bump as its internal to builders only. However --enable-fapi left in place for backwards compat.
  + Add maintainer public key:
    tpm2-pkcs11.keyring</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734004800">- Enable unit testing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1781092800">- Use pyproject macros to build and install the tools.</changelog>
</package>
<package pkgid="f404b3933708ea58f7dc984dc7bfd9fbb0efdde9179077dd7bbde04294b413a4" name="tpm2-tss-engine" arch="aarch64">
  <version epoch="0" ver="1.2.0" rel="37.21"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="c5514df38d15496afa91d9c5e090ff8a2122fa58759b1cbc90fd8713eb3ba534" name="tpm2-tss-engine" arch="armv7hl">
  <version epoch="0" ver="1.2.0" rel="37.21"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="73a36c00cf9015c635e82813c3d56328524d4413afdc6aaeae7575267340a8a6" name="tpm2-tss-engine" arch="src">
  <version epoch="0" ver="1.2.0" rel="37.21"/>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1545652800">- Initial import
  * version 0.0+git20181128.c9061a7
  * FATE 325619</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1548244800">- Update to version 0+git20190115.6cfaeb7:
  * Initialize/Finalize TCTI based on opts
  * init_tpm_parent: use ESYS_AUXCONTEXT as 1st argument
  * init_tpm_key: use ESYS_AUXCONTEXT as 1st argument
  * tpm2-tss-engine-ecc.c: use ESYS_AUXCONTEXT
  * tpm2-tss-engine-rsa.c: use ESYS_AUXCONTEXT
  * tpm2-tss-engine-rand.c: use ESYS_AUXCONTEXT
  * tpm2tss_tpm2data_readtpm: use ESYS_AUXCONTEXT
  * tpm2-tss-engine-common.(c/h): Add ESYS_AUXCONTEXT
  * Set TCTI option through an environment variable
  * Add new engine control to set the TCTI option</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1548244801">- Build bash-completion as noarch.</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1548936000">- Now tpm2-tss-engine-bash-completion auto-installs only when bash-completion
  is present.
- Changed author of comment dated "Wed Jan 23 04:39:01 UTC 2019" from
  opensuse-packaging@opensuse.org to me.</changelog>
  <changelog author="jsikes@suse.de" date="1551614400">- Update to version 0+git20190222.cef2c43:
  * build: install existing man pages even if pandoc is not available
  * Updated organizational files in preparation for release
  * Add configure switch for unit and integration tests
  * Silence clang warning on field initializers
  * Fix parallel connections to TPM.
  * Fix segfault on non-null auth'd persistent keys.
  * Update tests to also run on physical TPMs
  * build: install aclocal files
  * build: update for ax_code_coverage.m4 version 2019.01.06
  * ECDSA truncation and s_server test</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="90d70c3e995b65a928be9d85531bfae4f81107f57a51cbd9e75dd0b06cd6a88b" name="tpm2-tss-engine-bash-completion" arch="noarch">
  <version epoch="0" ver="1.2.0" rel="37.21"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="3325e5b518ca1349dcc5bb94f58d1008737f6fb740f8a60d20ab551dd980bb5a" name="tpm2-tss-engine-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.2.0" rel="37.21"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="e4754e7b6f20f7e60035e7a88e723ec9f5a40a6b03d976d4cb2fb81897a0ea2f" name="tpm2-tss-engine-debuginfo" arch="armv7hl">
  <version epoch="0" ver="1.2.0" rel="37.21"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="30d4261f1f7e942e8332d70aaa8e97c7ab17d511aa46c5003b163f4b73b7d748" name="tpm2-tss-engine-debugsource" arch="aarch64">
  <version epoch="0" ver="1.2.0" rel="37.21"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="49b59c62b736cb333a5530e38d294214a535125f5cfde090fda08d42f85b4649" name="tpm2-tss-engine-debugsource" arch="armv7hl">
  <version epoch="0" ver="1.2.0" rel="37.21"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="1dae6b8ed6f7182392d534c02eb9b4e0dd5d0570debcd15013fa852e7f840d82" name="tpm2-tss-engine-devel" arch="aarch64">
  <version epoch="0" ver="1.2.0" rel="37.21"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="a048262ef9b5b95f1df908a286b242726b23d1bcc0dcceaea6f8a1555650724d" name="tpm2-tss-engine-devel" arch="armv7hl">
  <version epoch="0" ver="1.2.0" rel="37.21"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="c725d35aab993fcd86bdba0a7e230526d39755e0943ae1c09954b3a8c832f1e6" name="tpm2.0-abrmd" arch="aarch64">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="e7b14f981f0258fc00df95a56f578ee44583958faaabcf874e8eef91a6d85f61" name="tpm2.0-abrmd" arch="armv7hl">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="06efcf390e54841c69264ea6790968ec7d7ddbf0de9ede99baca79cc3b092198" name="tpm2.0-abrmd" arch="src">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="mgerstner &lt;matthias.gerstner@suse.com&gt;" date="1566820800">- update to version 2.1.1:
  - changes in version 2.1.1:
  - Unit tests accessing dbus have been fixed to use mock functions. Unit
    tests no longer depend on dbus.
  - Race condition between client connections and dbus proxy object
    creation by registering bus name after instantiation of the proxy object.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to version 2.3.0:
  - changes in version 2.3.0:
  - Add '--enable-debug' flag to configure script to simplify debug builds.
    This relies on the AX_CHECK_ENABLE_DEBUG autoconf archive macro.
  - Replaced custom dynamic TCTI loading code with libtss2-tctildr from
    upstream tpm2-tss repo. (requires tpm2-0-tss version 2.3.0)
  - Explicitly set '-O2' optimization when using FORTIFY_SOURCE as required.
  - changes in version 2.2.0:
  - New configuration option `--disable-defaultflags/ added. This is
    for use for packaging for targets that do not support the default
    compilation / linking flags.
  - Use private dependencies properly in pkg-config metadata for TCTI.
  - Refactor daemon main module to enable better handling of error
    conditions and enable more thorough unit testing.
  - Updated dependencies to ensure compatibility with pkg-config fixes
    in tpm2-tss.
  - Fixed bug causing TCTI to block when used by libtss2-sys built with
    partial reads enabled.
  - Removed unnecessary libs / flags for pthreads in the TCTI pkg-config.
  - Output from configure script now accurately describes the state of the
    flags that govern the integration tests.
- drop fix_dlopen.patch: no longer necessary since abrmd not uses the tctildr
  shared library. This one hopefully now does the right thing.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1603368000">- update to version 2.3.3:
  - changes in version 2.3.1:
  - Fixed handle resource leak exhausting TPM resources.
  - changes in version 2.3.2:
  - Added cirrus CI specific config files to enable FreeBSD builds.
  - Changed test scripts to be more portable.
  - Changed include header paths specific to FreeBSD.
  - changes in version 2.3.1:
  - Provide meaningful exit codes on initialization failures.
  - Prevent systemd from starting the daemon before udev changes ownership
    of the TPM device node.
  - Prevent systemd from starting the daemon if there is no TPM device node.
  - Prevent systemd from restarting the daemon if it fails.
  - Add SELinux policy to allow daemon to resolve names.
  - Add SELinux policy boolean (disabled by default) to allow daemon to
    connect to all unreserved ports.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1623240000">- Requires libtss2-tcti-{device0,tabrmd0} (bsc#1187077).
  In MicroOS systems the recommendations are not installed, making the
  service fail to initialize: Failed to instantiate TCTI</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1626264000">- Update to version 2.4.0:
  - Service start depends on systemd device unit: dev-tpm0.device.
  - Numerous memory leaks.
  - udev settle service deprecation warnings.
  - StandardOutput=syslog deprecation warnings.
- Add selinux module files
- Move dbus files out of /etc</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1626523200">- Move selinux devel file to devel subpackage</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_tpm2-abrmd.service.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1638187200">- Warp selinux into a bcond</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1638964800">- Version 2.4.0
  + remover syslog deprecation warning (bsc#1185154)
  + cover update to 2.3.3 (jsc#SLE-17366)
  + contains reload fix (bsc#1166936)
  + fix tcti loading using short / long names (bsc#1159176)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1649073600">- dbus-access.patch: restrict D-Bus access to tpm2-abrmd to members of the tss
  group (bsc#1197532). This prevents arbitrary users from meddling with TPM
  state and thus potential denial-of-service vectors.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="c41de2cf0567c7bd31df28ccb85c6182ce8afd946251393ae12b2d41522f9700" name="tpm2.0-abrmd-debuginfo" arch="aarch64">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="c8f2a5faae3045bfaf4c5ffeee97247c107b908b195e1a49cd7dfec08b2b9434" name="tpm2.0-abrmd-debuginfo" arch="armv7hl">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="11ef7b17395f6c3323becd37ff34174f08671f99d7717f1006e3eea1931b19b3" name="tpm2.0-abrmd-debugsource" arch="aarch64">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="eecd793b6848d9cd94aeb283cfb3cb63e581c6a91637d939c99ac1b3d98a59cf" name="tpm2.0-abrmd-debugsource" arch="armv7hl">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="733576e722a7a529b02dd6d43234460f812d60ffc945709ac98ab03b30a024a8" name="tpm2.0-abrmd-devel" arch="aarch64">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="6d46d692eef1824d97dcfa6bb9b79a45f641bdd6a64638cd95f11e560ab5e926" name="tpm2.0-abrmd-devel" arch="armv7hl">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="2451497b38c662708693721004cae5d0db63bc2f097ad0b733fd55f9ac62ed3d" name="tpm2.0-abrmd-selinux" arch="noarch">
  <version epoch="0" ver="3.0.0" rel="112.28"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="ccc18b3d5419d9a9d2e5f7847366db0d3ba481fa503209f31c11c528c9ce2c00" name="tpm2.0-tools" arch="aarch64">
  <version epoch="0" ver="5.7" rel="133.7"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Add missing dependencies for testing.
- Add patch to properly skip getekcertificate if curl is missing
  0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657713600">- Add patch to fix leakage of TPM simulator process
  add_missing_shut_down_call_on_cleanup.patch
- Add patch to fix fapi-quote-verify[_ecc].sh test
  fix_check_of_qualifying_data.patch
- Enable test execution by default</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657800000">- Disable tests in some architectures (ppc, ppc64, s390x)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Update to version 5.4
  + Added:
  * tpm2_policyrestart: Added option --cphash to output the cpHash
    for the command PM2_CC_PolicyRestart.
  * tpm2_policynvwritten: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyNvWritten.
  * tpm2_policylocality: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyLocality.
  * tpm2_policycountertimer: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCounterTimer.
  * tpm2_policycommandcode: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCommandCode.
  * tpm2_policypassword: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyPassword.
  * tpm2_policyauthvalue: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthValue.
  * tpm2_policyauthorize: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthorize.
  * tpm2_print: Support printing serialized ESYS_TR's
  * tpm2_create: Add a clarifying message to usage of -c when
    TPM2_CreateLoaded is not supported.
  * tpm2_getcap: Add support for vendor agnostic
    capabilites. Requires tpm2-tss version 4.0 and higher to enable.
  * Add a script, check_endorsement_cert.sh, to validate the
    endorsement certificate chain. It takes two inputs - A
    TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate
    specified in that order as arguments.
- Update to version 5.3
  +  Features:
  * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to
    this change the tool parsed no-man as an unrecognized option and
    errored out. Now it lists all the available tool options.
  * tpm2_encodeobject: New tool to encode TPM2 object. It takes
    public and private portions of an object and encode them in a
    combined PEM form called tssprivkey used by tpm2-tss-engine and
    other applications.
  * Support alternative ECC curves for which default EK templates
    exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
  * tools/misc/tpm2_checkquote: add sm2 verification of signature.
  * crypto: support the TPM2_ECC_SM2_P256 curveID.
  * fapi: add new command to enable the use of fapi objects for tpm2
    tools. The new command tss2_gettpm2object was added. With this
    command context files which can be used for tpm2 tool commands
    can be created.
  * Support for sign and verify with sm2 algorithms.
  * tools/tpm2_startauthsession: add sym-algorithm argument for
    supported symmetric algorithm.
  * Attestation (certify, command audit, sessionaudit and quote):
    add scheme argument for supported signature schemes. This also
    enable support for SM signing.
  * tpm2_flushcontext: support all options at a time. Support the
  - t/-l/-s options all at once so folks don't have to call it
    multiple times.
  * tools/tpm2_nvread: add human readable output for NV content
    Enable parsing and YAML-style output for the different NV index
    types.
  * New event types in tpm2_eventlog:
    EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2,
    EV_EFI_VARIABLE_BOOT2
  * VERSION: add version file - Generate the version file with
    bootstrap and include in the DIST tarball so endusers can call
    autoreconf on a dist tarball which doesn't have git. This
    alleviates git describe errors on release tarballs in the
    autoreconf case.
  * import: support restricted parents - Support a restricted parent
    with an aes128cfb symmetric parameter.
  * tpm2_load - Added capability to load pem files in
    TSS2-Private-Key format for interoperability with
    tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and
    tpm2-pytss.
  * tpm2_print - Added capability to parse out and print the public
    portion of a TSS Private Key in the PEM format with the arg
    option TSSPRIVKEY_OBJ.
  * tpm2_loadexternal: Added support to tpm2_loadexternal for
    parsing and loading the public portion of a TSS2 Privkey PEM
    file. The path to the PEM file must be specified using the -r
    option while skipping the -G option for key type.
  * Support added for calculating cpHash, rpHash, sessions for
    parameter encryption and auditing in: tpm2_nvwrite,
    tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock,
    tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic.
  * Support added for calculating cpHash in: tpm2_clear,
    tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign,
    tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt,
    tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary,
    tpm2_quote, tpm2_policysecret, tpm2_policynv,
    tpm2_policyauthorizenv, tpm2_import, tpm2_hmac,
    tpm2_hierarchycontrol, tpm2_load, tpm2_gettime,
    tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest,
    tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen,
    tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext,
    tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread.
  * Support for using tcti=none for cpHash calculations to avoid
    invoking checks for active TPM in: tpm2_nvreadpublic,
    tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock,
    tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite.
  + Known issue:
  * FAPI tools will not work on 32bit user-static qemu on 64bit host
    because readdir returns NULL. Follow the issue on
    https://gitlab.com/qemu-project/qemu/-/issues/263
  + Bug fixes:
  * tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
  * Fix tssprivkey formatted PEM generation and load errors on 32
    bit systems.
  * CI: Add testing of 32bit systems with multiarch/qemu-user-static
    containers.
  * tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad
    handles.
  * tools/tpm2_nvextend: fix for ESYS_TR handle not being used in
    calculating the object name.
  * tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must
    be re-instantiated on each iteration of the read/ write when
    size exceeds the allowed operating size
    (TPM2_PT_NV_BUFFER_MAX). However, information on the compounded
    policies cannot be retrieved from the only policy digest read
    from the session and hence the session cannot be
    re-instantiated. To avoid this scenario only a single iteration
    is allowed when policy authorization is in use.
  * Fix argument parsing in tpm2_policylocality to fix an issue
    causing almost always to generate PolicyLocality(0). There was a
    logical inversion that caused almost any argument (including
    invalid ones) to be interpreted as zero, except “zero" would be
    interpreted as one.
  * test/fapi/fapi-quote-verify.sh Fix check of qualifying
    data. Because of a bug in Fapi_VerifyQuote the qualifying data
    was not checked correctly. Errors that were not recognized
    before occur now. The order of the tests was cleaned up and for
    every quote and verify quote now the correct combination of the
    qualifying data and quote info containing the nonce is used.
  * tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating
    with the platform hierarchy.
  * tools/tpm2_getekcertificate: fixed the url link to
    ekop.intel.com. There were two places where the fix was needed:
    o In the tool source code where a forward slash was always
    appended irrespective of it already being part of the link
    specified by the user and
    o In the integration test where curl tests the link to the
    ekop.intel.com backend. It now requires the full link to
    include the base64 encoded ek pub hash.
  * tools/tpm2_tool.c: Fix an issue where LOG_WARN is always
    displayed Despite setting the 'quiet' flag with -Q.
  * fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an
    optional parameter. If pcrLog is not used as parameter currently
    the pcr log is still calculated in Fapi_Quote. To avoid this
    calculation a NULL pointer will be passed to Fapi_Quote if the
    parameter pcrLog is not passed. So tss2_quote can be executed
    for a user which has no access rights to the files with the
    system measurements.
  * import: fix bug on using scheme wherein if scheme is specified
    in the template, the openssl load functions clobber the scheme
    value and set it to TPM2_ALG_NULL.
  * tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and
    verifysignature bugs : (1.) sm2 sign could not get output
    signature. (2.) sm2 verify tss format signature failed.
  * lib/tpm2.c: added workaround for a system api bug where in the
    flush handle is erroneously placed in the handle area instead of
    the parameter area.
  * nvreadpublic: drop ntoh on attributes The attributes get
    marshalled to correct endianess by libmu and don’t need to be
    changed again.
  * Removing unused '-i' option from tpm2_print
  * tpm2_policyor: fix unallocated policy list The TPML_DIGEST
    policy list was calloc'd for some reason, however it could just
    be statically allocated in the context. The side effect is that
    when no options or arguments were given a NPD occured when
    checking the count of the policy list.
  * tools/tpm2_certify: fix man page for short options and add tests
    The short options for the signing-key-auth and
    certified-key-auth were swapped. The case fix in the man page
    makes it less intuitive but have to go through with the change
    so that we don't break any existing scripts. This change does
    not affect the long options. Tests have been added to ensure the
    functionality.
  + CI:
  * ci: add ubuntu-22.04. This also requires the min tpm2-tss
    version to be at 3.2.0 to support the openSSL major version 3.
  * cirrus.yml: update freebsd version to 13.1
  * .ci/download-deps.sh: update tpm2-abrmd dependency version to
    2.4.1
- Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
  (merged)
- Drop add_missing_shut_down_call_on_cleanup.patch (merged)
- Drop fix_check_of_qualifying_data.patch (merged)
- Add echo_tcti_call_python3_binary.patch (upstreamed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1672833600">- Re-disable tests in PPC, PPC64 and S390X and reference issues about
  endianness unsafe API</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to version 5.5
  + Added:
  * tpm2_createek: SM2 EK Support
  * misc: SM2 support to internal OSSL format key routines. Fixes
  - -format flags for conversions.
  + Fixed:
  * echo_tcti.py: set to use python3 named executable in shebang.
- Drop already merged patches
  + fix_bogus_warning.patch
  + echo_tcti_call_python3_binary.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684324800">- Disable tests.  Some tests randomly fails, maybe dependening on the
  OBS worker assigned during the build (not confirmed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1703160000">- Update to version 5.6
  + tpm2_eventlog:
  * add H-CRTM event support
  * add support of efivar versions less than 38
  * Add support to check for efivar/efivar.h manually
  * Minor formatting fixes
  * tpm2_eventlog: add support for replay with different
    StartupLocality
  * Fix pcr extension for EV_NO_ACTION
  * Extend test of yaml string representation
  * Use helper for printing a string dump
  * Fix upper bound on unique data size
  * Fix YAML string formatting
  + tpm2_policy:
  * Add support for parsing forward seal TPM values
  * Use forward seal values in creating policies
  * Move dgst_size in evaluate_populate_pcr_digests()
  * Allow more than 8 PCRs for sealing
  * Move dgst_size in evaluate_populate_pcr_digests
  * Allow more than 8 PCRs for sealing
  * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more
    PCRs
  + tpm2_encryptdecrypt: Fix pkcs7 padding stripping
  + tpm2_duplicate:
  * Support -a option for attributes
  * Add --key-algorithm option
  + tpm2_encodeobject: Use the correct -O option instead of -C
  + tpm2_unseal: Add qualifier static to enhance the privacy of unseal
    function
  + tpm2_sign:
  * Remove -m option which was added mistakenly
  * Revert sm2 sign and verifysignature
  + tpm2_createek:
  * Correct man page example
  * Fix usage of nonce
  * Fix integrating nonce
  + tpm2_clear: add more details about the action
  + tpm2_startauthsession: allow the file attribute for policy
    authorization.
  + tpm2_getekcertificate: Add AMD EK support
  + tpm2_ecdhzgen: Add public-key parameter
  + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure
  + Bug-fixes:
  * The readthedocs build failed with module 'jinja2' has no
    attribute 'contextfilter' a requirement file was added to fix
    this problem
  * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa
    implementation. This error can be avoided by switching off the
    optimization with pragma
  * Changed wrong function name of "Esys_Load" to "Esys_Load"
  * Function names beginning with Esys_ are wrongly written as Eys_
  * Reading and writing a serialized persistent ESYS_TR handles
  * cirrus-ci update image-family to freebsd-13-2 from 13-1
  + misc:
  * Change the default Python version to Python3 in the helper's
    code
  * Skip test which uses the sign operator for comparison in
    abrmd_policynv.sh
  * tools/tr_encode: Add a tool that can encode serialized ESYS_TR
    for persistent handles from the TPM2B_PUBLIC and the raw
    persistent TPM2_HANDLE
  * Add safe directory in config</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 5.7:
  + Security
  - Fixed CVE-2024-29038 (bsc#1223687)
  - Fixed CVE-2024-29039 (bsc#1223689)
  + Fixed
  - Fix eventlog test
  - Fix issues with reading NV indexes
  - Fix context save error on tpm2_create
  - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail
  - when attempting to context save a flushed session.
  - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.
  - tpm2_send: fix EOF detection on input stream.
  - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
  - Auth file: Ensure 0-termination when reading auths from a file.
  - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.
  - cirrus.yml fix tss compilation with libtpms for FreeBSD.
  - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.
  - options: fix TCTI handling to avoid failures for commands that should work with no options.
  - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.
  + Added
  - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option)
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
- tpm2-tools.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1778846400">- Remove dependency to the abrmd broker service</changelog>
</package>
<package pkgid="6cf8d8b4aa533833830f4e805a851ae47da222f9a50b55a46f7a5964e9eb587a" name="tpm2.0-tools" arch="armv7hl">
  <version epoch="0" ver="5.7" rel="133.7"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Add missing dependencies for testing.
- Add patch to properly skip getekcertificate if curl is missing
  0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657713600">- Add patch to fix leakage of TPM simulator process
  add_missing_shut_down_call_on_cleanup.patch
- Add patch to fix fapi-quote-verify[_ecc].sh test
  fix_check_of_qualifying_data.patch
- Enable test execution by default</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657800000">- Disable tests in some architectures (ppc, ppc64, s390x)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Update to version 5.4
  + Added:
  * tpm2_policyrestart: Added option --cphash to output the cpHash
    for the command PM2_CC_PolicyRestart.
  * tpm2_policynvwritten: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyNvWritten.
  * tpm2_policylocality: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyLocality.
  * tpm2_policycountertimer: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCounterTimer.
  * tpm2_policycommandcode: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCommandCode.
  * tpm2_policypassword: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyPassword.
  * tpm2_policyauthvalue: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthValue.
  * tpm2_policyauthorize: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthorize.
  * tpm2_print: Support printing serialized ESYS_TR's
  * tpm2_create: Add a clarifying message to usage of -c when
    TPM2_CreateLoaded is not supported.
  * tpm2_getcap: Add support for vendor agnostic
    capabilites. Requires tpm2-tss version 4.0 and higher to enable.
  * Add a script, check_endorsement_cert.sh, to validate the
    endorsement certificate chain. It takes two inputs - A
    TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate
    specified in that order as arguments.
- Update to version 5.3
  +  Features:
  * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to
    this change the tool parsed no-man as an unrecognized option and
    errored out. Now it lists all the available tool options.
  * tpm2_encodeobject: New tool to encode TPM2 object. It takes
    public and private portions of an object and encode them in a
    combined PEM form called tssprivkey used by tpm2-tss-engine and
    other applications.
  * Support alternative ECC curves for which default EK templates
    exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
  * tools/misc/tpm2_checkquote: add sm2 verification of signature.
  * crypto: support the TPM2_ECC_SM2_P256 curveID.
  * fapi: add new command to enable the use of fapi objects for tpm2
    tools. The new command tss2_gettpm2object was added. With this
    command context files which can be used for tpm2 tool commands
    can be created.
  * Support for sign and verify with sm2 algorithms.
  * tools/tpm2_startauthsession: add sym-algorithm argument for
    supported symmetric algorithm.
  * Attestation (certify, command audit, sessionaudit and quote):
    add scheme argument for supported signature schemes. This also
    enable support for SM signing.
  * tpm2_flushcontext: support all options at a time. Support the
  - t/-l/-s options all at once so folks don't have to call it
    multiple times.
  * tools/tpm2_nvread: add human readable output for NV content
    Enable parsing and YAML-style output for the different NV index
    types.
  * New event types in tpm2_eventlog:
    EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2,
    EV_EFI_VARIABLE_BOOT2
  * VERSION: add version file - Generate the version file with
    bootstrap and include in the DIST tarball so endusers can call
    autoreconf on a dist tarball which doesn't have git. This
    alleviates git describe errors on release tarballs in the
    autoreconf case.
  * import: support restricted parents - Support a restricted parent
    with an aes128cfb symmetric parameter.
  * tpm2_load - Added capability to load pem files in
    TSS2-Private-Key format for interoperability with
    tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and
    tpm2-pytss.
  * tpm2_print - Added capability to parse out and print the public
    portion of a TSS Private Key in the PEM format with the arg
    option TSSPRIVKEY_OBJ.
  * tpm2_loadexternal: Added support to tpm2_loadexternal for
    parsing and loading the public portion of a TSS2 Privkey PEM
    file. The path to the PEM file must be specified using the -r
    option while skipping the -G option for key type.
  * Support added for calculating cpHash, rpHash, sessions for
    parameter encryption and auditing in: tpm2_nvwrite,
    tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock,
    tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic.
  * Support added for calculating cpHash in: tpm2_clear,
    tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign,
    tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt,
    tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary,
    tpm2_quote, tpm2_policysecret, tpm2_policynv,
    tpm2_policyauthorizenv, tpm2_import, tpm2_hmac,
    tpm2_hierarchycontrol, tpm2_load, tpm2_gettime,
    tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest,
    tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen,
    tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext,
    tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread.
  * Support for using tcti=none for cpHash calculations to avoid
    invoking checks for active TPM in: tpm2_nvreadpublic,
    tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock,
    tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite.
  + Known issue:
  * FAPI tools will not work on 32bit user-static qemu on 64bit host
    because readdir returns NULL. Follow the issue on
    https://gitlab.com/qemu-project/qemu/-/issues/263
  + Bug fixes:
  * tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
  * Fix tssprivkey formatted PEM generation and load errors on 32
    bit systems.
  * CI: Add testing of 32bit systems with multiarch/qemu-user-static
    containers.
  * tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad
    handles.
  * tools/tpm2_nvextend: fix for ESYS_TR handle not being used in
    calculating the object name.
  * tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must
    be re-instantiated on each iteration of the read/ write when
    size exceeds the allowed operating size
    (TPM2_PT_NV_BUFFER_MAX). However, information on the compounded
    policies cannot be retrieved from the only policy digest read
    from the session and hence the session cannot be
    re-instantiated. To avoid this scenario only a single iteration
    is allowed when policy authorization is in use.
  * Fix argument parsing in tpm2_policylocality to fix an issue
    causing almost always to generate PolicyLocality(0). There was a
    logical inversion that caused almost any argument (including
    invalid ones) to be interpreted as zero, except “zero" would be
    interpreted as one.
  * test/fapi/fapi-quote-verify.sh Fix check of qualifying
    data. Because of a bug in Fapi_VerifyQuote the qualifying data
    was not checked correctly. Errors that were not recognized
    before occur now. The order of the tests was cleaned up and for
    every quote and verify quote now the correct combination of the
    qualifying data and quote info containing the nonce is used.
  * tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating
    with the platform hierarchy.
  * tools/tpm2_getekcertificate: fixed the url link to
    ekop.intel.com. There were two places where the fix was needed:
    o In the tool source code where a forward slash was always
    appended irrespective of it already being part of the link
    specified by the user and
    o In the integration test where curl tests the link to the
    ekop.intel.com backend. It now requires the full link to
    include the base64 encoded ek pub hash.
  * tools/tpm2_tool.c: Fix an issue where LOG_WARN is always
    displayed Despite setting the 'quiet' flag with -Q.
  * fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an
    optional parameter. If pcrLog is not used as parameter currently
    the pcr log is still calculated in Fapi_Quote. To avoid this
    calculation a NULL pointer will be passed to Fapi_Quote if the
    parameter pcrLog is not passed. So tss2_quote can be executed
    for a user which has no access rights to the files with the
    system measurements.
  * import: fix bug on using scheme wherein if scheme is specified
    in the template, the openssl load functions clobber the scheme
    value and set it to TPM2_ALG_NULL.
  * tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and
    verifysignature bugs : (1.) sm2 sign could not get output
    signature. (2.) sm2 verify tss format signature failed.
  * lib/tpm2.c: added workaround for a system api bug where in the
    flush handle is erroneously placed in the handle area instead of
    the parameter area.
  * nvreadpublic: drop ntoh on attributes The attributes get
    marshalled to correct endianess by libmu and don’t need to be
    changed again.
  * Removing unused '-i' option from tpm2_print
  * tpm2_policyor: fix unallocated policy list The TPML_DIGEST
    policy list was calloc'd for some reason, however it could just
    be statically allocated in the context. The side effect is that
    when no options or arguments were given a NPD occured when
    checking the count of the policy list.
  * tools/tpm2_certify: fix man page for short options and add tests
    The short options for the signing-key-auth and
    certified-key-auth were swapped. The case fix in the man page
    makes it less intuitive but have to go through with the change
    so that we don't break any existing scripts. This change does
    not affect the long options. Tests have been added to ensure the
    functionality.
  + CI:
  * ci: add ubuntu-22.04. This also requires the min tpm2-tss
    version to be at 3.2.0 to support the openSSL major version 3.
  * cirrus.yml: update freebsd version to 13.1
  * .ci/download-deps.sh: update tpm2-abrmd dependency version to
    2.4.1
- Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
  (merged)
- Drop add_missing_shut_down_call_on_cleanup.patch (merged)
- Drop fix_check_of_qualifying_data.patch (merged)
- Add echo_tcti_call_python3_binary.patch (upstreamed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1672833600">- Re-disable tests in PPC, PPC64 and S390X and reference issues about
  endianness unsafe API</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to version 5.5
  + Added:
  * tpm2_createek: SM2 EK Support
  * misc: SM2 support to internal OSSL format key routines. Fixes
  - -format flags for conversions.
  + Fixed:
  * echo_tcti.py: set to use python3 named executable in shebang.
- Drop already merged patches
  + fix_bogus_warning.patch
  + echo_tcti_call_python3_binary.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684324800">- Disable tests.  Some tests randomly fails, maybe dependening on the
  OBS worker assigned during the build (not confirmed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1703160000">- Update to version 5.6
  + tpm2_eventlog:
  * add H-CRTM event support
  * add support of efivar versions less than 38
  * Add support to check for efivar/efivar.h manually
  * Minor formatting fixes
  * tpm2_eventlog: add support for replay with different
    StartupLocality
  * Fix pcr extension for EV_NO_ACTION
  * Extend test of yaml string representation
  * Use helper for printing a string dump
  * Fix upper bound on unique data size
  * Fix YAML string formatting
  + tpm2_policy:
  * Add support for parsing forward seal TPM values
  * Use forward seal values in creating policies
  * Move dgst_size in evaluate_populate_pcr_digests()
  * Allow more than 8 PCRs for sealing
  * Move dgst_size in evaluate_populate_pcr_digests
  * Allow more than 8 PCRs for sealing
  * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more
    PCRs
  + tpm2_encryptdecrypt: Fix pkcs7 padding stripping
  + tpm2_duplicate:
  * Support -a option for attributes
  * Add --key-algorithm option
  + tpm2_encodeobject: Use the correct -O option instead of -C
  + tpm2_unseal: Add qualifier static to enhance the privacy of unseal
    function
  + tpm2_sign:
  * Remove -m option which was added mistakenly
  * Revert sm2 sign and verifysignature
  + tpm2_createek:
  * Correct man page example
  * Fix usage of nonce
  * Fix integrating nonce
  + tpm2_clear: add more details about the action
  + tpm2_startauthsession: allow the file attribute for policy
    authorization.
  + tpm2_getekcertificate: Add AMD EK support
  + tpm2_ecdhzgen: Add public-key parameter
  + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure
  + Bug-fixes:
  * The readthedocs build failed with module 'jinja2' has no
    attribute 'contextfilter' a requirement file was added to fix
    this problem
  * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa
    implementation. This error can be avoided by switching off the
    optimization with pragma
  * Changed wrong function name of "Esys_Load" to "Esys_Load"
  * Function names beginning with Esys_ are wrongly written as Eys_
  * Reading and writing a serialized persistent ESYS_TR handles
  * cirrus-ci update image-family to freebsd-13-2 from 13-1
  + misc:
  * Change the default Python version to Python3 in the helper's
    code
  * Skip test which uses the sign operator for comparison in
    abrmd_policynv.sh
  * tools/tr_encode: Add a tool that can encode serialized ESYS_TR
    for persistent handles from the TPM2B_PUBLIC and the raw
    persistent TPM2_HANDLE
  * Add safe directory in config</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 5.7:
  + Security
  - Fixed CVE-2024-29038 (bsc#1223687)
  - Fixed CVE-2024-29039 (bsc#1223689)
  + Fixed
  - Fix eventlog test
  - Fix issues with reading NV indexes
  - Fix context save error on tpm2_create
  - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail
  - when attempting to context save a flushed session.
  - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.
  - tpm2_send: fix EOF detection on input stream.
  - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
  - Auth file: Ensure 0-termination when reading auths from a file.
  - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.
  - cirrus.yml fix tss compilation with libtpms for FreeBSD.
  - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.
  - options: fix TCTI handling to avoid failures for commands that should work with no options.
  - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.
  + Added
  - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option)
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
- tpm2-tools.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1778846400">- Remove dependency to the abrmd broker service</changelog>
</package>
<package pkgid="f2eb13ef2e1279f607c34a2fa0933ebeacbfa1726a7d4830f1c034eb869970f3" name="tpm2.0-tools" arch="src">
  <version epoch="0" ver="5.7" rel="133.7"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1623758400">- Disable lto to fix tpm2_checkquote error (boo#1187316)
- Update service file to point to the correct revision</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1623931200">- Add 0001-tpm2_checkquote-fix-uninitialized-variable.patch for a better
  fix of boo#1187316
- Re-enable lto</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1624017600">- Add 0001-tpm2_eventlog-read-eventlog-file-in-chunks.patch to fix the
  tpm2_eventlog command (boo#1187360)</changelog>
  <changelog author="Fabian Vogt &lt;fvogt@suse.com&gt;" date="1624881600">- update to version 5.1.1:
  - tpm2_import: fix fixed AES key CVE-2021-3565
  - tpm2_import used a fixed AES key for the inner wrapper, which means that
    a MITM attack would be able to unwrap the imported key. To fix this,
    ensure the key size is 16 bytes or bigger and use OpenSSL to generate a
    secure random AES key.
- Avoid pandoc build dependency, use prebuilt man pages everywhere
- Drop 0001-tpm2_import-fix-fixed-AES-key-CVE-2021-3565.patch, now upstream
- Drop _service, unused
- Drop unused unzip build dependency
- Drop autoreconfigure call, no longer necessary
- Use %autosetup
- Verify tarball signature
- Build against efivar
- Drop %check section, tests weren't built, so that was a noop</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1625745600">- prepare running the test suite via %check, but leave it commented out,
  because it is broken due to LTO linking.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1627560000">- Add 0001-tpm2_eventlog-fix-buffer-offset-when-reading-the-eve.patch to
  fix the offset of the read buffer</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to version 5.2:
  + tpm2_nvextend:
  * Added option -n, --name to specify the name of the nvindex in
    hex bytes. This is used when cpHash ought to be calculated
    without dispatching the TPM2_NV_Extend command to the TPM.
  + tpm2_nvread:
  * Added option --rphash=FILE to specify ile path to record the
    hash of the response parameters. This is commonly termed as
    rpHash.
  * Added option -n, --name to specify the name of the nvindex in
    hex bytes. This is used when cpHash ought to be calculated
    without dispatching the TPM2_NVRead command to the TPM.
  * Added option -S, --session to specify to specify an auxiliary
    session for auditing and or encryption/decryption of the
    parameters.
  + tpm2_nvsetbits:
  * Added option --rphash=FILE to specify file path to record the
    hash of the response parameters. This is commonly termed as
    rpHash.
  * Added option -S, --session to specify to specify an auxiliary
    session for auditing and or encryption/decryption of the
    parameters.
  * Added option -n, --name to specify the name of the nvindex in
    hex bytes. This is used when cpHash ought to be calculated
    without dispatching the TPM2_NV_SetBits command to the TPM.
  + tpm2_createprimary:
  * Support public-key output at creation time in various public-key
    formats.
  + tpm2_create:
  * Support public-key output at creation time in various public-key
    formats.
  + tpm2_print:
  * Support outputing public key in various public key formats over
    the default YAML output. Supports taking -u output from
    tpm2_create and converting it to a PEM or DER file format.
  + tpm2_import:
  * Add support for importing keys with sealed-data-blobs.
  + tpm2_rsaencrypt, tpm2_rsadecrypt:
  * Add support for specifying the hash algorithm with oaep.
  + tpm2_pcrread, tpm2_quote:
  * Add option -F, --pcrs_format to specify PCR format selection for
    the binary blob in the PCR output file. 'values' will output a
    binary blob of the PCR values. 'serialized' will output a binary
    blob of the PCR values in the form of serialized data structure
    in little endian format.
  + tpm2_eventlog:
  * Add support for decoding StartupLocality.
  * Add support for printing the partition information.
  * Add support for reading eventlogs longer than 64kb including
    from /sys/kernel/security/tpm0/binary_bios-measurements.
  + tpm2_duplicate:
  * Add option -L, --policy to specify an authorization policy to be
    associated with the duplicated object.
  * Added support for external key duplication without needing the
    TCTI.
  + tools:
  * Enhance error message on invalid passwords when sessions cannot
    be used.
  + lib/tpm2_options:
  * Add option to specify fake tcti which is required in cases where
    sapi ctx is required to be initialized for retrieving command
    parameters without invoking the tcti to talk to the TPM.
  + openssl:
  * Dropped support for OpenSSL &lt; 1.1.0
  * Add support for OpenSSL 3.0.0
  + Support added to make the repository documentation and man pages
    available live on readthedocs.
  + Bug-fixes:
  * tpm2_import: Don't allow setting passwords for imported object
    with -p option as the tool doesn't modify the TPM2B_SENSITIVE
    structure. Added appropriate logging to indicate using
    tpm2_changeauth after import.
  * lib/tpm2_util.c: The function to calculate pHash algorithm
    returned error when input session is a password session and the
    only session in the command.
  * lib/tpm2_alg_util.c: Fix an error where oaep was parsed under
    ECC.
  * tpm2_sign: Fix segfaults when tool does not find TPM resources
    (TPM or RM).
  * tpm2_makecredential: Fix an issue where reading input from stdin
    could result in unsupported data size larger than the largest
    digest size.
  * tpm2_loadexternal: Fix an issue where restricted attribute could
    not be set.
  * lib/tpm2_nv_util.h: The NV index size is dependent on different
    data sets read from the GetCapability structures because there
    is a dependency on the NV operation type: Define vs Read vs
    Write vs Extend. Fix a sane default in the case where
    GetCapability fails or fails to report the specific property/
    data set. This is especially true because some properties are
    TPM implementation dependent.
  * tpm2_createpolicy: Fix an issue where tool exited silently
    without reporting an error if wrong pcr string is specified.
  * lib/tpm2_alg_util: add error message on public init to prevent
    tools from dying silently, add an error message.
  * tpm2_import: fix an issue where an imported hmac object scheme
    was NULL. While allowed, it was inconsistent with other tools
    like tpm2_create which set the scheme as hmac-&gt;sha256 when
    generating a keyedhash object.
- Drop patches already in upstream:
  + 0001-tpm2_checkquote-fix-uninitialized-variable.patch
  + 0001-tpm2_eventlog-fix-buffer-offset-when-reading-the-eve.patch
  + 0001-tpm2_eventlog-read-eventlog-file-in-chunks.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1638187200">- Fix python3-PyYAML requirement
- Move the tests inside a bcond.  Disabled by default.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1638964800">- The update to 5.2 fill also jsc#SLE-9515 (4.1) and jsc#SLE-17366 (4.3.0)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657195200">- Disable LTO for 5.2, to fix tpm2_makecredential with "-T none"
  (bsc#1201291)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Add missing dependencies for testing.
- Add patch to properly skip getekcertificate if curl is missing
  0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657713600">- Add patch to fix leakage of TPM simulator process
  add_missing_shut_down_call_on_cleanup.patch
- Add patch to fix fapi-quote-verify[_ecc].sh test
  fix_check_of_qualifying_data.patch
- Enable test execution by default</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657800000">- Disable tests in some architectures (ppc, ppc64, s390x)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Update to version 5.4
  + Added:
  * tpm2_policyrestart: Added option --cphash to output the cpHash
    for the command PM2_CC_PolicyRestart.
  * tpm2_policynvwritten: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyNvWritten.
  * tpm2_policylocality: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyLocality.
  * tpm2_policycountertimer: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCounterTimer.
  * tpm2_policycommandcode: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCommandCode.
  * tpm2_policypassword: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyPassword.
  * tpm2_policyauthvalue: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthValue.
  * tpm2_policyauthorize: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthorize.
  * tpm2_print: Support printing serialized ESYS_TR's
  * tpm2_create: Add a clarifying message to usage of -c when
    TPM2_CreateLoaded is not supported.
  * tpm2_getcap: Add support for vendor agnostic
    capabilites. Requires tpm2-tss version 4.0 and higher to enable.
  * Add a script, check_endorsement_cert.sh, to validate the
    endorsement certificate chain. It takes two inputs - A
    TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate
    specified in that order as arguments.
- Update to version 5.3
  +  Features:
  * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to
    this change the tool parsed no-man as an unrecognized option and
    errored out. Now it lists all the available tool options.
  * tpm2_encodeobject: New tool to encode TPM2 object. It takes
    public and private portions of an object and encode them in a
    combined PEM form called tssprivkey used by tpm2-tss-engine and
    other applications.
  * Support alternative ECC curves for which default EK templates
    exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
  * tools/misc/tpm2_checkquote: add sm2 verification of signature.
  * crypto: support the TPM2_ECC_SM2_P256 curveID.
  * fapi: add new command to enable the use of fapi objects for tpm2
    tools. The new command tss2_gettpm2object was added. With this
    command context files which can be used for tpm2 tool commands
    can be created.
  * Support for sign and verify with sm2 algorithms.
  * tools/tpm2_startauthsession: add sym-algorithm argument for
    supported symmetric algorithm.
  * Attestation (certify, command audit, sessionaudit and quote):
    add scheme argument for supported signature schemes. This also
    enable support for SM signing.
  * tpm2_flushcontext: support all options at a time. Support the
  - t/-l/-s options all at once so folks don't have to call it
    multiple times.
  * tools/tpm2_nvread: add human readable output for NV content
    Enable parsing and YAML-style output for the different NV index
    types.
  * New event types in tpm2_eventlog:
    EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2,
    EV_EFI_VARIABLE_BOOT2
  * VERSION: add version file - Generate the version file with
    bootstrap and include in the DIST tarball so endusers can call
    autoreconf on a dist tarball which doesn't have git. This
    alleviates git describe errors on release tarballs in the
    autoreconf case.
  * import: support restricted parents - Support a restricted parent
    with an aes128cfb symmetric parameter.
  * tpm2_load - Added capability to load pem files in
    TSS2-Private-Key format for interoperability with
    tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and
    tpm2-pytss.
  * tpm2_print - Added capability to parse out and print the public
    portion of a TSS Private Key in the PEM format with the arg
    option TSSPRIVKEY_OBJ.
  * tpm2_loadexternal: Added support to tpm2_loadexternal for
    parsing and loading the public portion of a TSS2 Privkey PEM
    file. The path to the PEM file must be specified using the -r
    option while skipping the -G option for key type.
  * Support added for calculating cpHash, rpHash, sessions for
    parameter encryption and auditing in: tpm2_nvwrite,
    tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock,
    tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic.
  * Support added for calculating cpHash in: tpm2_clear,
    tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign,
    tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt,
    tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary,
    tpm2_quote, tpm2_policysecret, tpm2_policynv,
    tpm2_policyauthorizenv, tpm2_import, tpm2_hmac,
    tpm2_hierarchycontrol, tpm2_load, tpm2_gettime,
    tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest,
    tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen,
    tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext,
    tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread.
  * Support for using tcti=none for cpHash calculations to avoid
    invoking checks for active TPM in: tpm2_nvreadpublic,
    tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock,
    tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite.
  + Known issue:
  * FAPI tools will not work on 32bit user-static qemu on 64bit host
    because readdir returns NULL. Follow the issue on
    https://gitlab.com/qemu-project/qemu/-/issues/263
  + Bug fixes:
  * tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
  * Fix tssprivkey formatted PEM generation and load errors on 32
    bit systems.
  * CI: Add testing of 32bit systems with multiarch/qemu-user-static
    containers.
  * tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad
    handles.
  * tools/tpm2_nvextend: fix for ESYS_TR handle not being used in
    calculating the object name.
  * tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must
    be re-instantiated on each iteration of the read/ write when
    size exceeds the allowed operating size
    (TPM2_PT_NV_BUFFER_MAX). However, information on the compounded
    policies cannot be retrieved from the only policy digest read
    from the session and hence the session cannot be
    re-instantiated. To avoid this scenario only a single iteration
    is allowed when policy authorization is in use.
  * Fix argument parsing in tpm2_policylocality to fix an issue
    causing almost always to generate PolicyLocality(0). There was a
    logical inversion that caused almost any argument (including
    invalid ones) to be interpreted as zero, except “zero" would be
    interpreted as one.
  * test/fapi/fapi-quote-verify.sh Fix check of qualifying
    data. Because of a bug in Fapi_VerifyQuote the qualifying data
    was not checked correctly. Errors that were not recognized
    before occur now. The order of the tests was cleaned up and for
    every quote and verify quote now the correct combination of the
    qualifying data and quote info containing the nonce is used.
  * tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating
    with the platform hierarchy.
  * tools/tpm2_getekcertificate: fixed the url link to
    ekop.intel.com. There were two places where the fix was needed:
    o In the tool source code where a forward slash was always
    appended irrespective of it already being part of the link
    specified by the user and
    o In the integration test where curl tests the link to the
    ekop.intel.com backend. It now requires the full link to
    include the base64 encoded ek pub hash.
  * tools/tpm2_tool.c: Fix an issue where LOG_WARN is always
    displayed Despite setting the 'quiet' flag with -Q.
  * fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an
    optional parameter. If pcrLog is not used as parameter currently
    the pcr log is still calculated in Fapi_Quote. To avoid this
    calculation a NULL pointer will be passed to Fapi_Quote if the
    parameter pcrLog is not passed. So tss2_quote can be executed
    for a user which has no access rights to the files with the
    system measurements.
  * import: fix bug on using scheme wherein if scheme is specified
    in the template, the openssl load functions clobber the scheme
    value and set it to TPM2_ALG_NULL.
  * tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and
    verifysignature bugs : (1.) sm2 sign could not get output
    signature. (2.) sm2 verify tss format signature failed.
  * lib/tpm2.c: added workaround for a system api bug where in the
    flush handle is erroneously placed in the handle area instead of
    the parameter area.
  * nvreadpublic: drop ntoh on attributes The attributes get
    marshalled to correct endianess by libmu and don’t need to be
    changed again.
  * Removing unused '-i' option from tpm2_print
  * tpm2_policyor: fix unallocated policy list The TPML_DIGEST
    policy list was calloc'd for some reason, however it could just
    be statically allocated in the context. The side effect is that
    when no options or arguments were given a NPD occured when
    checking the count of the policy list.
  * tools/tpm2_certify: fix man page for short options and add tests
    The short options for the signing-key-auth and
    certified-key-auth were swapped. The case fix in the man page
    makes it less intuitive but have to go through with the change
    so that we don't break any existing scripts. This change does
    not affect the long options. Tests have been added to ensure the
    functionality.
  + CI:
  * ci: add ubuntu-22.04. This also requires the min tpm2-tss
    version to be at 3.2.0 to support the openSSL major version 3.
  * cirrus.yml: update freebsd version to 13.1
  * .ci/download-deps.sh: update tpm2-abrmd dependency version to
    2.4.1
- Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
  (merged)
- Drop add_missing_shut_down_call_on_cleanup.patch (merged)
- Drop fix_check_of_qualifying_data.patch (merged)
- Add echo_tcti_call_python3_binary.patch (upstreamed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1672833600">- Re-disable tests in PPC, PPC64 and S390X and reference issues about
  endianness unsafe API</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to version 5.5
  + Added:
  * tpm2_createek: SM2 EK Support
  * misc: SM2 support to internal OSSL format key routines. Fixes
  - -format flags for conversions.
  + Fixed:
  * echo_tcti.py: set to use python3 named executable in shebang.
- Drop already merged patches
  + fix_bogus_warning.patch
  + echo_tcti_call_python3_binary.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684324800">- Disable tests.  Some tests randomly fails, maybe dependening on the
  OBS worker assigned during the build (not confirmed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1703160000">- Update to version 5.6
  + tpm2_eventlog:
  * add H-CRTM event support
  * add support of efivar versions less than 38
  * Add support to check for efivar/efivar.h manually
  * Minor formatting fixes
  * tpm2_eventlog: add support for replay with different
    StartupLocality
  * Fix pcr extension for EV_NO_ACTION
  * Extend test of yaml string representation
  * Use helper for printing a string dump
  * Fix upper bound on unique data size
  * Fix YAML string formatting
  + tpm2_policy:
  * Add support for parsing forward seal TPM values
  * Use forward seal values in creating policies
  * Move dgst_size in evaluate_populate_pcr_digests()
  * Allow more than 8 PCRs for sealing
  * Move dgst_size in evaluate_populate_pcr_digests
  * Allow more than 8 PCRs for sealing
  * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more
    PCRs
  + tpm2_encryptdecrypt: Fix pkcs7 padding stripping
  + tpm2_duplicate:
  * Support -a option for attributes
  * Add --key-algorithm option
  + tpm2_encodeobject: Use the correct -O option instead of -C
  + tpm2_unseal: Add qualifier static to enhance the privacy of unseal
    function
  + tpm2_sign:
  * Remove -m option which was added mistakenly
  * Revert sm2 sign and verifysignature
  + tpm2_createek:
  * Correct man page example
  * Fix usage of nonce
  * Fix integrating nonce
  + tpm2_clear: add more details about the action
  + tpm2_startauthsession: allow the file attribute for policy
    authorization.
  + tpm2_getekcertificate: Add AMD EK support
  + tpm2_ecdhzgen: Add public-key parameter
  + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure
  + Bug-fixes:
  * The readthedocs build failed with module 'jinja2' has no
    attribute 'contextfilter' a requirement file was added to fix
    this problem
  * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa
    implementation. This error can be avoided by switching off the
    optimization with pragma
  * Changed wrong function name of "Esys_Load" to "Esys_Load"
  * Function names beginning with Esys_ are wrongly written as Eys_
  * Reading and writing a serialized persistent ESYS_TR handles
  * cirrus-ci update image-family to freebsd-13-2 from 13-1
  + misc:
  * Change the default Python version to Python3 in the helper's
    code
  * Skip test which uses the sign operator for comparison in
    abrmd_policynv.sh
  * tools/tr_encode: Add a tool that can encode serialized ESYS_TR
    for persistent handles from the TPM2B_PUBLIC and the raw
    persistent TPM2_HANDLE
  * Add safe directory in config</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 5.7:
  + Security
  - Fixed CVE-2024-29038 (bsc#1223687)
  - Fixed CVE-2024-29039 (bsc#1223689)
  + Fixed
  - Fix eventlog test
  - Fix issues with reading NV indexes
  - Fix context save error on tpm2_create
  - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail
  - when attempting to context save a flushed session.
  - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.
  - tpm2_send: fix EOF detection on input stream.
  - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
  - Auth file: Ensure 0-termination when reading auths from a file.
  - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.
  - cirrus.yml fix tss compilation with libtpms for FreeBSD.
  - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.
  - options: fix TCTI handling to avoid failures for commands that should work with no options.
  - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.
  + Added
  - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option)
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
- tpm2-tools.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1778846400">- Remove dependency to the abrmd broker service</changelog>
</package>
<package pkgid="07619f328607a845981650b7ba28a87a6b190b84ed4012a238068651f3d5bf62" name="tpm2.0-tools-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.7" rel="133.7"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Add missing dependencies for testing.
- Add patch to properly skip getekcertificate if curl is missing
  0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657713600">- Add patch to fix leakage of TPM simulator process
  add_missing_shut_down_call_on_cleanup.patch
- Add patch to fix fapi-quote-verify[_ecc].sh test
  fix_check_of_qualifying_data.patch
- Enable test execution by default</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657800000">- Disable tests in some architectures (ppc, ppc64, s390x)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Update to version 5.4
  + Added:
  * tpm2_policyrestart: Added option --cphash to output the cpHash
    for the command PM2_CC_PolicyRestart.
  * tpm2_policynvwritten: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyNvWritten.
  * tpm2_policylocality: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyLocality.
  * tpm2_policycountertimer: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCounterTimer.
  * tpm2_policycommandcode: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCommandCode.
  * tpm2_policypassword: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyPassword.
  * tpm2_policyauthvalue: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthValue.
  * tpm2_policyauthorize: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthorize.
  * tpm2_print: Support printing serialized ESYS_TR's
  * tpm2_create: Add a clarifying message to usage of -c when
    TPM2_CreateLoaded is not supported.
  * tpm2_getcap: Add support for vendor agnostic
    capabilites. Requires tpm2-tss version 4.0 and higher to enable.
  * Add a script, check_endorsement_cert.sh, to validate the
    endorsement certificate chain. It takes two inputs - A
    TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate
    specified in that order as arguments.
- Update to version 5.3
  +  Features:
  * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to
    this change the tool parsed no-man as an unrecognized option and
    errored out. Now it lists all the available tool options.
  * tpm2_encodeobject: New tool to encode TPM2 object. It takes
    public and private portions of an object and encode them in a
    combined PEM form called tssprivkey used by tpm2-tss-engine and
    other applications.
  * Support alternative ECC curves for which default EK templates
    exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
  * tools/misc/tpm2_checkquote: add sm2 verification of signature.
  * crypto: support the TPM2_ECC_SM2_P256 curveID.
  * fapi: add new command to enable the use of fapi objects for tpm2
    tools. The new command tss2_gettpm2object was added. With this
    command context files which can be used for tpm2 tool commands
    can be created.
  * Support for sign and verify with sm2 algorithms.
  * tools/tpm2_startauthsession: add sym-algorithm argument for
    supported symmetric algorithm.
  * Attestation (certify, command audit, sessionaudit and quote):
    add scheme argument for supported signature schemes. This also
    enable support for SM signing.
  * tpm2_flushcontext: support all options at a time. Support the
  - t/-l/-s options all at once so folks don't have to call it
    multiple times.
  * tools/tpm2_nvread: add human readable output for NV content
    Enable parsing and YAML-style output for the different NV index
    types.
  * New event types in tpm2_eventlog:
    EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2,
    EV_EFI_VARIABLE_BOOT2
  * VERSION: add version file - Generate the version file with
    bootstrap and include in the DIST tarball so endusers can call
    autoreconf on a dist tarball which doesn't have git. This
    alleviates git describe errors on release tarballs in the
    autoreconf case.
  * import: support restricted parents - Support a restricted parent
    with an aes128cfb symmetric parameter.
  * tpm2_load - Added capability to load pem files in
    TSS2-Private-Key format for interoperability with
    tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and
    tpm2-pytss.
  * tpm2_print - Added capability to parse out and print the public
    portion of a TSS Private Key in the PEM format with the arg
    option TSSPRIVKEY_OBJ.
  * tpm2_loadexternal: Added support to tpm2_loadexternal for
    parsing and loading the public portion of a TSS2 Privkey PEM
    file. The path to the PEM file must be specified using the -r
    option while skipping the -G option for key type.
  * Support added for calculating cpHash, rpHash, sessions for
    parameter encryption and auditing in: tpm2_nvwrite,
    tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock,
    tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic.
  * Support added for calculating cpHash in: tpm2_clear,
    tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign,
    tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt,
    tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary,
    tpm2_quote, tpm2_policysecret, tpm2_policynv,
    tpm2_policyauthorizenv, tpm2_import, tpm2_hmac,
    tpm2_hierarchycontrol, tpm2_load, tpm2_gettime,
    tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest,
    tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen,
    tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext,
    tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread.
  * Support for using tcti=none for cpHash calculations to avoid
    invoking checks for active TPM in: tpm2_nvreadpublic,
    tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock,
    tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite.
  + Known issue:
  * FAPI tools will not work on 32bit user-static qemu on 64bit host
    because readdir returns NULL. Follow the issue on
    https://gitlab.com/qemu-project/qemu/-/issues/263
  + Bug fixes:
  * tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
  * Fix tssprivkey formatted PEM generation and load errors on 32
    bit systems.
  * CI: Add testing of 32bit systems with multiarch/qemu-user-static
    containers.
  * tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad
    handles.
  * tools/tpm2_nvextend: fix for ESYS_TR handle not being used in
    calculating the object name.
  * tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must
    be re-instantiated on each iteration of the read/ write when
    size exceeds the allowed operating size
    (TPM2_PT_NV_BUFFER_MAX). However, information on the compounded
    policies cannot be retrieved from the only policy digest read
    from the session and hence the session cannot be
    re-instantiated. To avoid this scenario only a single iteration
    is allowed when policy authorization is in use.
  * Fix argument parsing in tpm2_policylocality to fix an issue
    causing almost always to generate PolicyLocality(0). There was a
    logical inversion that caused almost any argument (including
    invalid ones) to be interpreted as zero, except “zero" would be
    interpreted as one.
  * test/fapi/fapi-quote-verify.sh Fix check of qualifying
    data. Because of a bug in Fapi_VerifyQuote the qualifying data
    was not checked correctly. Errors that were not recognized
    before occur now. The order of the tests was cleaned up and for
    every quote and verify quote now the correct combination of the
    qualifying data and quote info containing the nonce is used.
  * tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating
    with the platform hierarchy.
  * tools/tpm2_getekcertificate: fixed the url link to
    ekop.intel.com. There were two places where the fix was needed:
    o In the tool source code where a forward slash was always
    appended irrespective of it already being part of the link
    specified by the user and
    o In the integration test where curl tests the link to the
    ekop.intel.com backend. It now requires the full link to
    include the base64 encoded ek pub hash.
  * tools/tpm2_tool.c: Fix an issue where LOG_WARN is always
    displayed Despite setting the 'quiet' flag with -Q.
  * fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an
    optional parameter. If pcrLog is not used as parameter currently
    the pcr log is still calculated in Fapi_Quote. To avoid this
    calculation a NULL pointer will be passed to Fapi_Quote if the
    parameter pcrLog is not passed. So tss2_quote can be executed
    for a user which has no access rights to the files with the
    system measurements.
  * import: fix bug on using scheme wherein if scheme is specified
    in the template, the openssl load functions clobber the scheme
    value and set it to TPM2_ALG_NULL.
  * tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and
    verifysignature bugs : (1.) sm2 sign could not get output
    signature. (2.) sm2 verify tss format signature failed.
  * lib/tpm2.c: added workaround for a system api bug where in the
    flush handle is erroneously placed in the handle area instead of
    the parameter area.
  * nvreadpublic: drop ntoh on attributes The attributes get
    marshalled to correct endianess by libmu and don’t need to be
    changed again.
  * Removing unused '-i' option from tpm2_print
  * tpm2_policyor: fix unallocated policy list The TPML_DIGEST
    policy list was calloc'd for some reason, however it could just
    be statically allocated in the context. The side effect is that
    when no options or arguments were given a NPD occured when
    checking the count of the policy list.
  * tools/tpm2_certify: fix man page for short options and add tests
    The short options for the signing-key-auth and
    certified-key-auth were swapped. The case fix in the man page
    makes it less intuitive but have to go through with the change
    so that we don't break any existing scripts. This change does
    not affect the long options. Tests have been added to ensure the
    functionality.
  + CI:
  * ci: add ubuntu-22.04. This also requires the min tpm2-tss
    version to be at 3.2.0 to support the openSSL major version 3.
  * cirrus.yml: update freebsd version to 13.1
  * .ci/download-deps.sh: update tpm2-abrmd dependency version to
    2.4.1
- Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
  (merged)
- Drop add_missing_shut_down_call_on_cleanup.patch (merged)
- Drop fix_check_of_qualifying_data.patch (merged)
- Add echo_tcti_call_python3_binary.patch (upstreamed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1672833600">- Re-disable tests in PPC, PPC64 and S390X and reference issues about
  endianness unsafe API</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to version 5.5
  + Added:
  * tpm2_createek: SM2 EK Support
  * misc: SM2 support to internal OSSL format key routines. Fixes
  - -format flags for conversions.
  + Fixed:
  * echo_tcti.py: set to use python3 named executable in shebang.
- Drop already merged patches
  + fix_bogus_warning.patch
  + echo_tcti_call_python3_binary.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684324800">- Disable tests.  Some tests randomly fails, maybe dependening on the
  OBS worker assigned during the build (not confirmed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1703160000">- Update to version 5.6
  + tpm2_eventlog:
  * add H-CRTM event support
  * add support of efivar versions less than 38
  * Add support to check for efivar/efivar.h manually
  * Minor formatting fixes
  * tpm2_eventlog: add support for replay with different
    StartupLocality
  * Fix pcr extension for EV_NO_ACTION
  * Extend test of yaml string representation
  * Use helper for printing a string dump
  * Fix upper bound on unique data size
  * Fix YAML string formatting
  + tpm2_policy:
  * Add support for parsing forward seal TPM values
  * Use forward seal values in creating policies
  * Move dgst_size in evaluate_populate_pcr_digests()
  * Allow more than 8 PCRs for sealing
  * Move dgst_size in evaluate_populate_pcr_digests
  * Allow more than 8 PCRs for sealing
  * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more
    PCRs
  + tpm2_encryptdecrypt: Fix pkcs7 padding stripping
  + tpm2_duplicate:
  * Support -a option for attributes
  * Add --key-algorithm option
  + tpm2_encodeobject: Use the correct -O option instead of -C
  + tpm2_unseal: Add qualifier static to enhance the privacy of unseal
    function
  + tpm2_sign:
  * Remove -m option which was added mistakenly
  * Revert sm2 sign and verifysignature
  + tpm2_createek:
  * Correct man page example
  * Fix usage of nonce
  * Fix integrating nonce
  + tpm2_clear: add more details about the action
  + tpm2_startauthsession: allow the file attribute for policy
    authorization.
  + tpm2_getekcertificate: Add AMD EK support
  + tpm2_ecdhzgen: Add public-key parameter
  + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure
  + Bug-fixes:
  * The readthedocs build failed with module 'jinja2' has no
    attribute 'contextfilter' a requirement file was added to fix
    this problem
  * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa
    implementation. This error can be avoided by switching off the
    optimization with pragma
  * Changed wrong function name of "Esys_Load" to "Esys_Load"
  * Function names beginning with Esys_ are wrongly written as Eys_
  * Reading and writing a serialized persistent ESYS_TR handles
  * cirrus-ci update image-family to freebsd-13-2 from 13-1
  + misc:
  * Change the default Python version to Python3 in the helper's
    code
  * Skip test which uses the sign operator for comparison in
    abrmd_policynv.sh
  * tools/tr_encode: Add a tool that can encode serialized ESYS_TR
    for persistent handles from the TPM2B_PUBLIC and the raw
    persistent TPM2_HANDLE
  * Add safe directory in config</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 5.7:
  + Security
  - Fixed CVE-2024-29038 (bsc#1223687)
  - Fixed CVE-2024-29039 (bsc#1223689)
  + Fixed
  - Fix eventlog test
  - Fix issues with reading NV indexes
  - Fix context save error on tpm2_create
  - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail
  - when attempting to context save a flushed session.
  - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.
  - tpm2_send: fix EOF detection on input stream.
  - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
  - Auth file: Ensure 0-termination when reading auths from a file.
  - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.
  - cirrus.yml fix tss compilation with libtpms for FreeBSD.
  - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.
  - options: fix TCTI handling to avoid failures for commands that should work with no options.
  - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.
  + Added
  - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option)
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
- tpm2-tools.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1778846400">- Remove dependency to the abrmd broker service</changelog>
</package>
<package pkgid="18aa3053c1f7154b8b0cde9be7a8658081de293d31f28d26bb60cad24a2d8e88" name="tpm2.0-tools-debuginfo" arch="armv7hl">
  <version epoch="0" ver="5.7" rel="133.7"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Add missing dependencies for testing.
- Add patch to properly skip getekcertificate if curl is missing
  0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657713600">- Add patch to fix leakage of TPM simulator process
  add_missing_shut_down_call_on_cleanup.patch
- Add patch to fix fapi-quote-verify[_ecc].sh test
  fix_check_of_qualifying_data.patch
- Enable test execution by default</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657800000">- Disable tests in some architectures (ppc, ppc64, s390x)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Update to version 5.4
  + Added:
  * tpm2_policyrestart: Added option --cphash to output the cpHash
    for the command PM2_CC_PolicyRestart.
  * tpm2_policynvwritten: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyNvWritten.
  * tpm2_policylocality: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyLocality.
  * tpm2_policycountertimer: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCounterTimer.
  * tpm2_policycommandcode: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCommandCode.
  * tpm2_policypassword: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyPassword.
  * tpm2_policyauthvalue: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthValue.
  * tpm2_policyauthorize: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthorize.
  * tpm2_print: Support printing serialized ESYS_TR's
  * tpm2_create: Add a clarifying message to usage of -c when
    TPM2_CreateLoaded is not supported.
  * tpm2_getcap: Add support for vendor agnostic
    capabilites. Requires tpm2-tss version 4.0 and higher to enable.
  * Add a script, check_endorsement_cert.sh, to validate the
    endorsement certificate chain. It takes two inputs - A
    TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate
    specified in that order as arguments.
- Update to version 5.3
  +  Features:
  * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to
    this change the tool parsed no-man as an unrecognized option and
    errored out. Now it lists all the available tool options.
  * tpm2_encodeobject: New tool to encode TPM2 object. It takes
    public and private portions of an object and encode them in a
    combined PEM form called tssprivkey used by tpm2-tss-engine and
    other applications.
  * Support alternative ECC curves for which default EK templates
    exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
  * tools/misc/tpm2_checkquote: add sm2 verification of signature.
  * crypto: support the TPM2_ECC_SM2_P256 curveID.
  * fapi: add new command to enable the use of fapi objects for tpm2
    tools. The new command tss2_gettpm2object was added. With this
    command context files which can be used for tpm2 tool commands
    can be created.
  * Support for sign and verify with sm2 algorithms.
  * tools/tpm2_startauthsession: add sym-algorithm argument for
    supported symmetric algorithm.
  * Attestation (certify, command audit, sessionaudit and quote):
    add scheme argument for supported signature schemes. This also
    enable support for SM signing.
  * tpm2_flushcontext: support all options at a time. Support the
  - t/-l/-s options all at once so folks don't have to call it
    multiple times.
  * tools/tpm2_nvread: add human readable output for NV content
    Enable parsing and YAML-style output for the different NV index
    types.
  * New event types in tpm2_eventlog:
    EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2,
    EV_EFI_VARIABLE_BOOT2
  * VERSION: add version file - Generate the version file with
    bootstrap and include in the DIST tarball so endusers can call
    autoreconf on a dist tarball which doesn't have git. This
    alleviates git describe errors on release tarballs in the
    autoreconf case.
  * import: support restricted parents - Support a restricted parent
    with an aes128cfb symmetric parameter.
  * tpm2_load - Added capability to load pem files in
    TSS2-Private-Key format for interoperability with
    tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and
    tpm2-pytss.
  * tpm2_print - Added capability to parse out and print the public
    portion of a TSS Private Key in the PEM format with the arg
    option TSSPRIVKEY_OBJ.
  * tpm2_loadexternal: Added support to tpm2_loadexternal for
    parsing and loading the public portion of a TSS2 Privkey PEM
    file. The path to the PEM file must be specified using the -r
    option while skipping the -G option for key type.
  * Support added for calculating cpHash, rpHash, sessions for
    parameter encryption and auditing in: tpm2_nvwrite,
    tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock,
    tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic.
  * Support added for calculating cpHash in: tpm2_clear,
    tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign,
    tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt,
    tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary,
    tpm2_quote, tpm2_policysecret, tpm2_policynv,
    tpm2_policyauthorizenv, tpm2_import, tpm2_hmac,
    tpm2_hierarchycontrol, tpm2_load, tpm2_gettime,
    tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest,
    tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen,
    tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext,
    tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread.
  * Support for using tcti=none for cpHash calculations to avoid
    invoking checks for active TPM in: tpm2_nvreadpublic,
    tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock,
    tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite.
  + Known issue:
  * FAPI tools will not work on 32bit user-static qemu on 64bit host
    because readdir returns NULL. Follow the issue on
    https://gitlab.com/qemu-project/qemu/-/issues/263
  + Bug fixes:
  * tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
  * Fix tssprivkey formatted PEM generation and load errors on 32
    bit systems.
  * CI: Add testing of 32bit systems with multiarch/qemu-user-static
    containers.
  * tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad
    handles.
  * tools/tpm2_nvextend: fix for ESYS_TR handle not being used in
    calculating the object name.
  * tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must
    be re-instantiated on each iteration of the read/ write when
    size exceeds the allowed operating size
    (TPM2_PT_NV_BUFFER_MAX). However, information on the compounded
    policies cannot be retrieved from the only policy digest read
    from the session and hence the session cannot be
    re-instantiated. To avoid this scenario only a single iteration
    is allowed when policy authorization is in use.
  * Fix argument parsing in tpm2_policylocality to fix an issue
    causing almost always to generate PolicyLocality(0). There was a
    logical inversion that caused almost any argument (including
    invalid ones) to be interpreted as zero, except “zero" would be
    interpreted as one.
  * test/fapi/fapi-quote-verify.sh Fix check of qualifying
    data. Because of a bug in Fapi_VerifyQuote the qualifying data
    was not checked correctly. Errors that were not recognized
    before occur now. The order of the tests was cleaned up and for
    every quote and verify quote now the correct combination of the
    qualifying data and quote info containing the nonce is used.
  * tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating
    with the platform hierarchy.
  * tools/tpm2_getekcertificate: fixed the url link to
    ekop.intel.com. There were two places where the fix was needed:
    o In the tool source code where a forward slash was always
    appended irrespective of it already being part of the link
    specified by the user and
    o In the integration test where curl tests the link to the
    ekop.intel.com backend. It now requires the full link to
    include the base64 encoded ek pub hash.
  * tools/tpm2_tool.c: Fix an issue where LOG_WARN is always
    displayed Despite setting the 'quiet' flag with -Q.
  * fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an
    optional parameter. If pcrLog is not used as parameter currently
    the pcr log is still calculated in Fapi_Quote. To avoid this
    calculation a NULL pointer will be passed to Fapi_Quote if the
    parameter pcrLog is not passed. So tss2_quote can be executed
    for a user which has no access rights to the files with the
    system measurements.
  * import: fix bug on using scheme wherein if scheme is specified
    in the template, the openssl load functions clobber the scheme
    value and set it to TPM2_ALG_NULL.
  * tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and
    verifysignature bugs : (1.) sm2 sign could not get output
    signature. (2.) sm2 verify tss format signature failed.
  * lib/tpm2.c: added workaround for a system api bug where in the
    flush handle is erroneously placed in the handle area instead of
    the parameter area.
  * nvreadpublic: drop ntoh on attributes The attributes get
    marshalled to correct endianess by libmu and don’t need to be
    changed again.
  * Removing unused '-i' option from tpm2_print
  * tpm2_policyor: fix unallocated policy list The TPML_DIGEST
    policy list was calloc'd for some reason, however it could just
    be statically allocated in the context. The side effect is that
    when no options or arguments were given a NPD occured when
    checking the count of the policy list.
  * tools/tpm2_certify: fix man page for short options and add tests
    The short options for the signing-key-auth and
    certified-key-auth were swapped. The case fix in the man page
    makes it less intuitive but have to go through with the change
    so that we don't break any existing scripts. This change does
    not affect the long options. Tests have been added to ensure the
    functionality.
  + CI:
  * ci: add ubuntu-22.04. This also requires the min tpm2-tss
    version to be at 3.2.0 to support the openSSL major version 3.
  * cirrus.yml: update freebsd version to 13.1
  * .ci/download-deps.sh: update tpm2-abrmd dependency version to
    2.4.1
- Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
  (merged)
- Drop add_missing_shut_down_call_on_cleanup.patch (merged)
- Drop fix_check_of_qualifying_data.patch (merged)
- Add echo_tcti_call_python3_binary.patch (upstreamed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1672833600">- Re-disable tests in PPC, PPC64 and S390X and reference issues about
  endianness unsafe API</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to version 5.5
  + Added:
  * tpm2_createek: SM2 EK Support
  * misc: SM2 support to internal OSSL format key routines. Fixes
  - -format flags for conversions.
  + Fixed:
  * echo_tcti.py: set to use python3 named executable in shebang.
- Drop already merged patches
  + fix_bogus_warning.patch
  + echo_tcti_call_python3_binary.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684324800">- Disable tests.  Some tests randomly fails, maybe dependening on the
  OBS worker assigned during the build (not confirmed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1703160000">- Update to version 5.6
  + tpm2_eventlog:
  * add H-CRTM event support
  * add support of efivar versions less than 38
  * Add support to check for efivar/efivar.h manually
  * Minor formatting fixes
  * tpm2_eventlog: add support for replay with different
    StartupLocality
  * Fix pcr extension for EV_NO_ACTION
  * Extend test of yaml string representation
  * Use helper for printing a string dump
  * Fix upper bound on unique data size
  * Fix YAML string formatting
  + tpm2_policy:
  * Add support for parsing forward seal TPM values
  * Use forward seal values in creating policies
  * Move dgst_size in evaluate_populate_pcr_digests()
  * Allow more than 8 PCRs for sealing
  * Move dgst_size in evaluate_populate_pcr_digests
  * Allow more than 8 PCRs for sealing
  * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more
    PCRs
  + tpm2_encryptdecrypt: Fix pkcs7 padding stripping
  + tpm2_duplicate:
  * Support -a option for attributes
  * Add --key-algorithm option
  + tpm2_encodeobject: Use the correct -O option instead of -C
  + tpm2_unseal: Add qualifier static to enhance the privacy of unseal
    function
  + tpm2_sign:
  * Remove -m option which was added mistakenly
  * Revert sm2 sign and verifysignature
  + tpm2_createek:
  * Correct man page example
  * Fix usage of nonce
  * Fix integrating nonce
  + tpm2_clear: add more details about the action
  + tpm2_startauthsession: allow the file attribute for policy
    authorization.
  + tpm2_getekcertificate: Add AMD EK support
  + tpm2_ecdhzgen: Add public-key parameter
  + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure
  + Bug-fixes:
  * The readthedocs build failed with module 'jinja2' has no
    attribute 'contextfilter' a requirement file was added to fix
    this problem
  * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa
    implementation. This error can be avoided by switching off the
    optimization with pragma
  * Changed wrong function name of "Esys_Load" to "Esys_Load"
  * Function names beginning with Esys_ are wrongly written as Eys_
  * Reading and writing a serialized persistent ESYS_TR handles
  * cirrus-ci update image-family to freebsd-13-2 from 13-1
  + misc:
  * Change the default Python version to Python3 in the helper's
    code
  * Skip test which uses the sign operator for comparison in
    abrmd_policynv.sh
  * tools/tr_encode: Add a tool that can encode serialized ESYS_TR
    for persistent handles from the TPM2B_PUBLIC and the raw
    persistent TPM2_HANDLE
  * Add safe directory in config</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 5.7:
  + Security
  - Fixed CVE-2024-29038 (bsc#1223687)
  - Fixed CVE-2024-29039 (bsc#1223689)
  + Fixed
  - Fix eventlog test
  - Fix issues with reading NV indexes
  - Fix context save error on tpm2_create
  - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail
  - when attempting to context save a flushed session.
  - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.
  - tpm2_send: fix EOF detection on input stream.
  - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
  - Auth file: Ensure 0-termination when reading auths from a file.
  - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.
  - cirrus.yml fix tss compilation with libtpms for FreeBSD.
  - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.
  - options: fix TCTI handling to avoid failures for commands that should work with no options.
  - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.
  + Added
  - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option)
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
- tpm2-tools.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1778846400">- Remove dependency to the abrmd broker service</changelog>
</package>
<package pkgid="37ccbd70b0d4b8c03462a745273b47d595543547cec7ef2d8141ee879f897920" name="tpm2.0-tools-debugsource" arch="aarch64">
  <version epoch="0" ver="5.7" rel="133.7"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Add missing dependencies for testing.
- Add patch to properly skip getekcertificate if curl is missing
  0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657713600">- Add patch to fix leakage of TPM simulator process
  add_missing_shut_down_call_on_cleanup.patch
- Add patch to fix fapi-quote-verify[_ecc].sh test
  fix_check_of_qualifying_data.patch
- Enable test execution by default</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657800000">- Disable tests in some architectures (ppc, ppc64, s390x)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Update to version 5.4
  + Added:
  * tpm2_policyrestart: Added option --cphash to output the cpHash
    for the command PM2_CC_PolicyRestart.
  * tpm2_policynvwritten: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyNvWritten.
  * tpm2_policylocality: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyLocality.
  * tpm2_policycountertimer: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCounterTimer.
  * tpm2_policycommandcode: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCommandCode.
  * tpm2_policypassword: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyPassword.
  * tpm2_policyauthvalue: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthValue.
  * tpm2_policyauthorize: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthorize.
  * tpm2_print: Support printing serialized ESYS_TR's
  * tpm2_create: Add a clarifying message to usage of -c when
    TPM2_CreateLoaded is not supported.
  * tpm2_getcap: Add support for vendor agnostic
    capabilites. Requires tpm2-tss version 4.0 and higher to enable.
  * Add a script, check_endorsement_cert.sh, to validate the
    endorsement certificate chain. It takes two inputs - A
    TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate
    specified in that order as arguments.
- Update to version 5.3
  +  Features:
  * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to
    this change the tool parsed no-man as an unrecognized option and
    errored out. Now it lists all the available tool options.
  * tpm2_encodeobject: New tool to encode TPM2 object. It takes
    public and private portions of an object and encode them in a
    combined PEM form called tssprivkey used by tpm2-tss-engine and
    other applications.
  * Support alternative ECC curves for which default EK templates
    exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
  * tools/misc/tpm2_checkquote: add sm2 verification of signature.
  * crypto: support the TPM2_ECC_SM2_P256 curveID.
  * fapi: add new command to enable the use of fapi objects for tpm2
    tools. The new command tss2_gettpm2object was added. With this
    command context files which can be used for tpm2 tool commands
    can be created.
  * Support for sign and verify with sm2 algorithms.
  * tools/tpm2_startauthsession: add sym-algorithm argument for
    supported symmetric algorithm.
  * Attestation (certify, command audit, sessionaudit and quote):
    add scheme argument for supported signature schemes. This also
    enable support for SM signing.
  * tpm2_flushcontext: support all options at a time. Support the
  - t/-l/-s options all at once so folks don't have to call it
    multiple times.
  * tools/tpm2_nvread: add human readable output for NV content
    Enable parsing and YAML-style output for the different NV index
    types.
  * New event types in tpm2_eventlog:
    EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2,
    EV_EFI_VARIABLE_BOOT2
  * VERSION: add version file - Generate the version file with
    bootstrap and include in the DIST tarball so endusers can call
    autoreconf on a dist tarball which doesn't have git. This
    alleviates git describe errors on release tarballs in the
    autoreconf case.
  * import: support restricted parents - Support a restricted parent
    with an aes128cfb symmetric parameter.
  * tpm2_load - Added capability to load pem files in
    TSS2-Private-Key format for interoperability with
    tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and
    tpm2-pytss.
  * tpm2_print - Added capability to parse out and print the public
    portion of a TSS Private Key in the PEM format with the arg
    option TSSPRIVKEY_OBJ.
  * tpm2_loadexternal: Added support to tpm2_loadexternal for
    parsing and loading the public portion of a TSS2 Privkey PEM
    file. The path to the PEM file must be specified using the -r
    option while skipping the -G option for key type.
  * Support added for calculating cpHash, rpHash, sessions for
    parameter encryption and auditing in: tpm2_nvwrite,
    tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock,
    tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic.
  * Support added for calculating cpHash in: tpm2_clear,
    tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign,
    tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt,
    tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary,
    tpm2_quote, tpm2_policysecret, tpm2_policynv,
    tpm2_policyauthorizenv, tpm2_import, tpm2_hmac,
    tpm2_hierarchycontrol, tpm2_load, tpm2_gettime,
    tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest,
    tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen,
    tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext,
    tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread.
  * Support for using tcti=none for cpHash calculations to avoid
    invoking checks for active TPM in: tpm2_nvreadpublic,
    tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock,
    tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite.
  + Known issue:
  * FAPI tools will not work on 32bit user-static qemu on 64bit host
    because readdir returns NULL. Follow the issue on
    https://gitlab.com/qemu-project/qemu/-/issues/263
  + Bug fixes:
  * tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
  * Fix tssprivkey formatted PEM generation and load errors on 32
    bit systems.
  * CI: Add testing of 32bit systems with multiarch/qemu-user-static
    containers.
  * tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad
    handles.
  * tools/tpm2_nvextend: fix for ESYS_TR handle not being used in
    calculating the object name.
  * tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must
    be re-instantiated on each iteration of the read/ write when
    size exceeds the allowed operating size
    (TPM2_PT_NV_BUFFER_MAX). However, information on the compounded
    policies cannot be retrieved from the only policy digest read
    from the session and hence the session cannot be
    re-instantiated. To avoid this scenario only a single iteration
    is allowed when policy authorization is in use.
  * Fix argument parsing in tpm2_policylocality to fix an issue
    causing almost always to generate PolicyLocality(0). There was a
    logical inversion that caused almost any argument (including
    invalid ones) to be interpreted as zero, except “zero" would be
    interpreted as one.
  * test/fapi/fapi-quote-verify.sh Fix check of qualifying
    data. Because of a bug in Fapi_VerifyQuote the qualifying data
    was not checked correctly. Errors that were not recognized
    before occur now. The order of the tests was cleaned up and for
    every quote and verify quote now the correct combination of the
    qualifying data and quote info containing the nonce is used.
  * tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating
    with the platform hierarchy.
  * tools/tpm2_getekcertificate: fixed the url link to
    ekop.intel.com. There were two places where the fix was needed:
    o In the tool source code where a forward slash was always
    appended irrespective of it already being part of the link
    specified by the user and
    o In the integration test where curl tests the link to the
    ekop.intel.com backend. It now requires the full link to
    include the base64 encoded ek pub hash.
  * tools/tpm2_tool.c: Fix an issue where LOG_WARN is always
    displayed Despite setting the 'quiet' flag with -Q.
  * fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an
    optional parameter. If pcrLog is not used as parameter currently
    the pcr log is still calculated in Fapi_Quote. To avoid this
    calculation a NULL pointer will be passed to Fapi_Quote if the
    parameter pcrLog is not passed. So tss2_quote can be executed
    for a user which has no access rights to the files with the
    system measurements.
  * import: fix bug on using scheme wherein if scheme is specified
    in the template, the openssl load functions clobber the scheme
    value and set it to TPM2_ALG_NULL.
  * tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and
    verifysignature bugs : (1.) sm2 sign could not get output
    signature. (2.) sm2 verify tss format signature failed.
  * lib/tpm2.c: added workaround for a system api bug where in the
    flush handle is erroneously placed in the handle area instead of
    the parameter area.
  * nvreadpublic: drop ntoh on attributes The attributes get
    marshalled to correct endianess by libmu and don’t need to be
    changed again.
  * Removing unused '-i' option from tpm2_print
  * tpm2_policyor: fix unallocated policy list The TPML_DIGEST
    policy list was calloc'd for some reason, however it could just
    be statically allocated in the context. The side effect is that
    when no options or arguments were given a NPD occured when
    checking the count of the policy list.
  * tools/tpm2_certify: fix man page for short options and add tests
    The short options for the signing-key-auth and
    certified-key-auth were swapped. The case fix in the man page
    makes it less intuitive but have to go through with the change
    so that we don't break any existing scripts. This change does
    not affect the long options. Tests have been added to ensure the
    functionality.
  + CI:
  * ci: add ubuntu-22.04. This also requires the min tpm2-tss
    version to be at 3.2.0 to support the openSSL major version 3.
  * cirrus.yml: update freebsd version to 13.1
  * .ci/download-deps.sh: update tpm2-abrmd dependency version to
    2.4.1
- Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
  (merged)
- Drop add_missing_shut_down_call_on_cleanup.patch (merged)
- Drop fix_check_of_qualifying_data.patch (merged)
- Add echo_tcti_call_python3_binary.patch (upstreamed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1672833600">- Re-disable tests in PPC, PPC64 and S390X and reference issues about
  endianness unsafe API</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to version 5.5
  + Added:
  * tpm2_createek: SM2 EK Support
  * misc: SM2 support to internal OSSL format key routines. Fixes
  - -format flags for conversions.
  + Fixed:
  * echo_tcti.py: set to use python3 named executable in shebang.
- Drop already merged patches
  + fix_bogus_warning.patch
  + echo_tcti_call_python3_binary.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684324800">- Disable tests.  Some tests randomly fails, maybe dependening on the
  OBS worker assigned during the build (not confirmed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1703160000">- Update to version 5.6
  + tpm2_eventlog:
  * add H-CRTM event support
  * add support of efivar versions less than 38
  * Add support to check for efivar/efivar.h manually
  * Minor formatting fixes
  * tpm2_eventlog: add support for replay with different
    StartupLocality
  * Fix pcr extension for EV_NO_ACTION
  * Extend test of yaml string representation
  * Use helper for printing a string dump
  * Fix upper bound on unique data size
  * Fix YAML string formatting
  + tpm2_policy:
  * Add support for parsing forward seal TPM values
  * Use forward seal values in creating policies
  * Move dgst_size in evaluate_populate_pcr_digests()
  * Allow more than 8 PCRs for sealing
  * Move dgst_size in evaluate_populate_pcr_digests
  * Allow more than 8 PCRs for sealing
  * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more
    PCRs
  + tpm2_encryptdecrypt: Fix pkcs7 padding stripping
  + tpm2_duplicate:
  * Support -a option for attributes
  * Add --key-algorithm option
  + tpm2_encodeobject: Use the correct -O option instead of -C
  + tpm2_unseal: Add qualifier static to enhance the privacy of unseal
    function
  + tpm2_sign:
  * Remove -m option which was added mistakenly
  * Revert sm2 sign and verifysignature
  + tpm2_createek:
  * Correct man page example
  * Fix usage of nonce
  * Fix integrating nonce
  + tpm2_clear: add more details about the action
  + tpm2_startauthsession: allow the file attribute for policy
    authorization.
  + tpm2_getekcertificate: Add AMD EK support
  + tpm2_ecdhzgen: Add public-key parameter
  + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure
  + Bug-fixes:
  * The readthedocs build failed with module 'jinja2' has no
    attribute 'contextfilter' a requirement file was added to fix
    this problem
  * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa
    implementation. This error can be avoided by switching off the
    optimization with pragma
  * Changed wrong function name of "Esys_Load" to "Esys_Load"
  * Function names beginning with Esys_ are wrongly written as Eys_
  * Reading and writing a serialized persistent ESYS_TR handles
  * cirrus-ci update image-family to freebsd-13-2 from 13-1
  + misc:
  * Change the default Python version to Python3 in the helper's
    code
  * Skip test which uses the sign operator for comparison in
    abrmd_policynv.sh
  * tools/tr_encode: Add a tool that can encode serialized ESYS_TR
    for persistent handles from the TPM2B_PUBLIC and the raw
    persistent TPM2_HANDLE
  * Add safe directory in config</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 5.7:
  + Security
  - Fixed CVE-2024-29038 (bsc#1223687)
  - Fixed CVE-2024-29039 (bsc#1223689)
  + Fixed
  - Fix eventlog test
  - Fix issues with reading NV indexes
  - Fix context save error on tpm2_create
  - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail
  - when attempting to context save a flushed session.
  - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.
  - tpm2_send: fix EOF detection on input stream.
  - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
  - Auth file: Ensure 0-termination when reading auths from a file.
  - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.
  - cirrus.yml fix tss compilation with libtpms for FreeBSD.
  - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.
  - options: fix TCTI handling to avoid failures for commands that should work with no options.
  - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.
  + Added
  - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option)
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
- tpm2-tools.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1778846400">- Remove dependency to the abrmd broker service</changelog>
</package>
<package pkgid="489ac0c6ab407c6db0146ef6b37943108aebe9ee4d77267f2ba79e78377f56fe" name="tpm2.0-tools-debugsource" arch="armv7hl">
  <version epoch="0" ver="5.7" rel="133.7"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Add missing dependencies for testing.
- Add patch to properly skip getekcertificate if curl is missing
  0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657713600">- Add patch to fix leakage of TPM simulator process
  add_missing_shut_down_call_on_cleanup.patch
- Add patch to fix fapi-quote-verify[_ecc].sh test
  fix_check_of_qualifying_data.patch
- Enable test execution by default</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657800000">- Disable tests in some architectures (ppc, ppc64, s390x)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Update to version 5.4
  + Added:
  * tpm2_policyrestart: Added option --cphash to output the cpHash
    for the command PM2_CC_PolicyRestart.
  * tpm2_policynvwritten: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyNvWritten.
  * tpm2_policylocality: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyLocality.
  * tpm2_policycountertimer: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCounterTimer.
  * tpm2_policycommandcode: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCommandCode.
  * tpm2_policypassword: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyPassword.
  * tpm2_policyauthvalue: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthValue.
  * tpm2_policyauthorize: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthorize.
  * tpm2_print: Support printing serialized ESYS_TR's
  * tpm2_create: Add a clarifying message to usage of -c when
    TPM2_CreateLoaded is not supported.
  * tpm2_getcap: Add support for vendor agnostic
    capabilites. Requires tpm2-tss version 4.0 and higher to enable.
  * Add a script, check_endorsement_cert.sh, to validate the
    endorsement certificate chain. It takes two inputs - A
    TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate
    specified in that order as arguments.
- Update to version 5.3
  +  Features:
  * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to
    this change the tool parsed no-man as an unrecognized option and
    errored out. Now it lists all the available tool options.
  * tpm2_encodeobject: New tool to encode TPM2 object. It takes
    public and private portions of an object and encode them in a
    combined PEM form called tssprivkey used by tpm2-tss-engine and
    other applications.
  * Support alternative ECC curves for which default EK templates
    exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
  * tools/misc/tpm2_checkquote: add sm2 verification of signature.
  * crypto: support the TPM2_ECC_SM2_P256 curveID.
  * fapi: add new command to enable the use of fapi objects for tpm2
    tools. The new command tss2_gettpm2object was added. With this
    command context files which can be used for tpm2 tool commands
    can be created.
  * Support for sign and verify with sm2 algorithms.
  * tools/tpm2_startauthsession: add sym-algorithm argument for
    supported symmetric algorithm.
  * Attestation (certify, command audit, sessionaudit and quote):
    add scheme argument for supported signature schemes. This also
    enable support for SM signing.
  * tpm2_flushcontext: support all options at a time. Support the
  - t/-l/-s options all at once so folks don't have to call it
    multiple times.
  * tools/tpm2_nvread: add human readable output for NV content
    Enable parsing and YAML-style output for the different NV index
    types.
  * New event types in tpm2_eventlog:
    EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2,
    EV_EFI_VARIABLE_BOOT2
  * VERSION: add version file - Generate the version file with
    bootstrap and include in the DIST tarball so endusers can call
    autoreconf on a dist tarball which doesn't have git. This
    alleviates git describe errors on release tarballs in the
    autoreconf case.
  * import: support restricted parents - Support a restricted parent
    with an aes128cfb symmetric parameter.
  * tpm2_load - Added capability to load pem files in
    TSS2-Private-Key format for interoperability with
    tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and
    tpm2-pytss.
  * tpm2_print - Added capability to parse out and print the public
    portion of a TSS Private Key in the PEM format with the arg
    option TSSPRIVKEY_OBJ.
  * tpm2_loadexternal: Added support to tpm2_loadexternal for
    parsing and loading the public portion of a TSS2 Privkey PEM
    file. The path to the PEM file must be specified using the -r
    option while skipping the -G option for key type.
  * Support added for calculating cpHash, rpHash, sessions for
    parameter encryption and auditing in: tpm2_nvwrite,
    tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock,
    tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic.
  * Support added for calculating cpHash in: tpm2_clear,
    tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign,
    tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt,
    tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary,
    tpm2_quote, tpm2_policysecret, tpm2_policynv,
    tpm2_policyauthorizenv, tpm2_import, tpm2_hmac,
    tpm2_hierarchycontrol, tpm2_load, tpm2_gettime,
    tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest,
    tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen,
    tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext,
    tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread.
  * Support for using tcti=none for cpHash calculations to avoid
    invoking checks for active TPM in: tpm2_nvreadpublic,
    tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock,
    tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite.
  + Known issue:
  * FAPI tools will not work on 32bit user-static qemu on 64bit host
    because readdir returns NULL. Follow the issue on
    https://gitlab.com/qemu-project/qemu/-/issues/263
  + Bug fixes:
  * tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
  * Fix tssprivkey formatted PEM generation and load errors on 32
    bit systems.
  * CI: Add testing of 32bit systems with multiarch/qemu-user-static
    containers.
  * tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad
    handles.
  * tools/tpm2_nvextend: fix for ESYS_TR handle not being used in
    calculating the object name.
  * tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must
    be re-instantiated on each iteration of the read/ write when
    size exceeds the allowed operating size
    (TPM2_PT_NV_BUFFER_MAX). However, information on the compounded
    policies cannot be retrieved from the only policy digest read
    from the session and hence the session cannot be
    re-instantiated. To avoid this scenario only a single iteration
    is allowed when policy authorization is in use.
  * Fix argument parsing in tpm2_policylocality to fix an issue
    causing almost always to generate PolicyLocality(0). There was a
    logical inversion that caused almost any argument (including
    invalid ones) to be interpreted as zero, except “zero" would be
    interpreted as one.
  * test/fapi/fapi-quote-verify.sh Fix check of qualifying
    data. Because of a bug in Fapi_VerifyQuote the qualifying data
    was not checked correctly. Errors that were not recognized
    before occur now. The order of the tests was cleaned up and for
    every quote and verify quote now the correct combination of the
    qualifying data and quote info containing the nonce is used.
  * tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating
    with the platform hierarchy.
  * tools/tpm2_getekcertificate: fixed the url link to
    ekop.intel.com. There were two places where the fix was needed:
    o In the tool source code where a forward slash was always
    appended irrespective of it already being part of the link
    specified by the user and
    o In the integration test where curl tests the link to the
    ekop.intel.com backend. It now requires the full link to
    include the base64 encoded ek pub hash.
  * tools/tpm2_tool.c: Fix an issue where LOG_WARN is always
    displayed Despite setting the 'quiet' flag with -Q.
  * fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an
    optional parameter. If pcrLog is not used as parameter currently
    the pcr log is still calculated in Fapi_Quote. To avoid this
    calculation a NULL pointer will be passed to Fapi_Quote if the
    parameter pcrLog is not passed. So tss2_quote can be executed
    for a user which has no access rights to the files with the
    system measurements.
  * import: fix bug on using scheme wherein if scheme is specified
    in the template, the openssl load functions clobber the scheme
    value and set it to TPM2_ALG_NULL.
  * tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and
    verifysignature bugs : (1.) sm2 sign could not get output
    signature. (2.) sm2 verify tss format signature failed.
  * lib/tpm2.c: added workaround for a system api bug where in the
    flush handle is erroneously placed in the handle area instead of
    the parameter area.
  * nvreadpublic: drop ntoh on attributes The attributes get
    marshalled to correct endianess by libmu and don’t need to be
    changed again.
  * Removing unused '-i' option from tpm2_print
  * tpm2_policyor: fix unallocated policy list The TPML_DIGEST
    policy list was calloc'd for some reason, however it could just
    be statically allocated in the context. The side effect is that
    when no options or arguments were given a NPD occured when
    checking the count of the policy list.
  * tools/tpm2_certify: fix man page for short options and add tests
    The short options for the signing-key-auth and
    certified-key-auth were swapped. The case fix in the man page
    makes it less intuitive but have to go through with the change
    so that we don't break any existing scripts. This change does
    not affect the long options. Tests have been added to ensure the
    functionality.
  + CI:
  * ci: add ubuntu-22.04. This also requires the min tpm2-tss
    version to be at 3.2.0 to support the openSSL major version 3.
  * cirrus.yml: update freebsd version to 13.1
  * .ci/download-deps.sh: update tpm2-abrmd dependency version to
    2.4.1
- Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
  (merged)
- Drop add_missing_shut_down_call_on_cleanup.patch (merged)
- Drop fix_check_of_qualifying_data.patch (merged)
- Add echo_tcti_call_python3_binary.patch (upstreamed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1672833600">- Re-disable tests in PPC, PPC64 and S390X and reference issues about
  endianness unsafe API</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to version 5.5
  + Added:
  * tpm2_createek: SM2 EK Support
  * misc: SM2 support to internal OSSL format key routines. Fixes
  - -format flags for conversions.
  + Fixed:
  * echo_tcti.py: set to use python3 named executable in shebang.
- Drop already merged patches
  + fix_bogus_warning.patch
  + echo_tcti_call_python3_binary.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684324800">- Disable tests.  Some tests randomly fails, maybe dependening on the
  OBS worker assigned during the build (not confirmed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1703160000">- Update to version 5.6
  + tpm2_eventlog:
  * add H-CRTM event support
  * add support of efivar versions less than 38
  * Add support to check for efivar/efivar.h manually
  * Minor formatting fixes
  * tpm2_eventlog: add support for replay with different
    StartupLocality
  * Fix pcr extension for EV_NO_ACTION
  * Extend test of yaml string representation
  * Use helper for printing a string dump
  * Fix upper bound on unique data size
  * Fix YAML string formatting
  + tpm2_policy:
  * Add support for parsing forward seal TPM values
  * Use forward seal values in creating policies
  * Move dgst_size in evaluate_populate_pcr_digests()
  * Allow more than 8 PCRs for sealing
  * Move dgst_size in evaluate_populate_pcr_digests
  * Allow more than 8 PCRs for sealing
  * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more
    PCRs
  + tpm2_encryptdecrypt: Fix pkcs7 padding stripping
  + tpm2_duplicate:
  * Support -a option for attributes
  * Add --key-algorithm option
  + tpm2_encodeobject: Use the correct -O option instead of -C
  + tpm2_unseal: Add qualifier static to enhance the privacy of unseal
    function
  + tpm2_sign:
  * Remove -m option which was added mistakenly
  * Revert sm2 sign and verifysignature
  + tpm2_createek:
  * Correct man page example
  * Fix usage of nonce
  * Fix integrating nonce
  + tpm2_clear: add more details about the action
  + tpm2_startauthsession: allow the file attribute for policy
    authorization.
  + tpm2_getekcertificate: Add AMD EK support
  + tpm2_ecdhzgen: Add public-key parameter
  + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure
  + Bug-fixes:
  * The readthedocs build failed with module 'jinja2' has no
    attribute 'contextfilter' a requirement file was added to fix
    this problem
  * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa
    implementation. This error can be avoided by switching off the
    optimization with pragma
  * Changed wrong function name of "Esys_Load" to "Esys_Load"
  * Function names beginning with Esys_ are wrongly written as Eys_
  * Reading and writing a serialized persistent ESYS_TR handles
  * cirrus-ci update image-family to freebsd-13-2 from 13-1
  + misc:
  * Change the default Python version to Python3 in the helper's
    code
  * Skip test which uses the sign operator for comparison in
    abrmd_policynv.sh
  * tools/tr_encode: Add a tool that can encode serialized ESYS_TR
    for persistent handles from the TPM2B_PUBLIC and the raw
    persistent TPM2_HANDLE
  * Add safe directory in config</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 5.7:
  + Security
  - Fixed CVE-2024-29038 (bsc#1223687)
  - Fixed CVE-2024-29039 (bsc#1223689)
  + Fixed
  - Fix eventlog test
  - Fix issues with reading NV indexes
  - Fix context save error on tpm2_create
  - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail
  - when attempting to context save a flushed session.
  - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.
  - tpm2_send: fix EOF detection on input stream.
  - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
  - Auth file: Ensure 0-termination when reading auths from a file.
  - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.
  - cirrus.yml fix tss compilation with libtpms for FreeBSD.
  - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.
  - options: fix TCTI handling to avoid failures for commands that should work with no options.
  - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.
  + Added
  - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option)
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
- tpm2-tools.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1778846400">- Remove dependency to the abrmd broker service</changelog>
</package>
</otherdata>