<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="19">
<package pkgid="1f13d4cbfbe19f4916c03d199a530e84ffc7032f9acc1cfc2e04941c08cf03bc" name="flatpak" arch="aarch64">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="e0551f772f0b94fb17b3219206f6ddcbb993e603088fae168604e5158cfa9cc8" name="flatpak" arch="armv7hl">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="7085d8e362201de2939213527316cff7c5e880260576b5b023468475e7d1416e" name="flatpak" arch="src">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="942317c18dac3a82263a4225986060ba6a32c8ee408d8270ab476f6f9e3b8f42" name="flatpak-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="a60bfc82cf2426035494658c9bf49a227ea2a433c74f9c1b467d7d90f0efff2e" name="flatpak-debuginfo" arch="armv7hl">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="8f5864b22fab2731c889f26660fb19b3470e7f2f072055f18b8ccd5d00b82f11" name="flatpak-debugsource" arch="aarch64">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="c5bd1dff49e02e39e96b21a2df211ba4b7b1c8a61f80ab8e5cde633df48bc338" name="flatpak-debugsource" arch="armv7hl">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="6cf63b793234e7b408d49f79c4560a5a7411f75d2fba45644144591fa89a7e37" name="flatpak-devel" arch="aarch64">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="2eec9c7e9523b72aa8209cf8f71a6b502773290aa53c14e015d11bbd204ddc72" name="flatpak-devel" arch="armv7hl">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="363301d2df784c03416dec79d71a4e4215ae9bc368be684b3996a94935e08526" name="flatpak-zsh-completion" arch="aarch64">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="5d4fbe4712297cc39d3b4208f03d6f7451fe875b1322ad925ceb6e7fdc28ecba" name="flatpak-zsh-completion" arch="armv7hl">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="2c475b5237b348849581cbe14c4b4b4380585a2f716c2dd6682bfc89ff099de9" name="libflatpak0" arch="aarch64">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="cfaf71f18e830774a3f698abf9d3bbf106571baf4befba1c0ad0fd7c313cb520" name="libflatpak0" arch="armv7hl">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="c5d956a8c50d77712e6ec70bef879ea3ce2926e2cf6764c6f74eb6a42bd3f4a4" name="libflatpak0-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="5882674a85206499899412e097d189a05930dc39b48c0cb7e9bd481901df2292" name="libflatpak0-debuginfo" arch="armv7hl">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="c97beb2e8d8868aa1bd131a6c79af2cac3218f1f0c3180796f9c44e10726430a" name="system-user-flatpak" arch="aarch64">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="a29e1708b73b936add73c73c767234a7a62128262ed993dbab17984740990a5d" name="system-user-flatpak" arch="armv7hl">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="4df2831d2a38b0bd159e357b10364b73ef1a88db06bb29897834ed6671f11651" name="typelib-1_0-Flatpak-1_0" arch="aarch64">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
<package pkgid="fc5fff928b95a8da11f454df12eb0cd7f2769c47a1ea34c3c608c43c96cd05eb" name="typelib-1_0-Flatpak-1_0" arch="armv7hl">
  <version epoch="0" ver="1.12.7" rel="163.1"/>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1619524800">- Update to version 1.11.1:
  + New features:
  - All instances of the same app-ID share their /tmp directory
  - All instances of the same app-ID share their $XDG_RUNTIME_DIR
  - Instances of the same app-ID can optionally share their
    /dev/shm directory (enabled by a new --allow flag,
  - -allow=per-app-dev-shm)
  - Allow a subsandbox to have a different /usr and/or /app.
  - Steam will use this to launch games with its own container
    runtime as /usr (the "Steam Linux Runtime" mechanism).
  - enter: Improve support for TUI programs like gdb
  - build-update-repo: Add a higher-performance reimplementation
    of ostree prune specialized for archive-mode repositories
  + Bug fixes:
  - Fix deploys of local remotes in system-helper
  - Fix test failures on non-x86_64 systems
  - Fix two intermittent test failures
  - Make polkit queries non-interactive when operating in
    non-interactive mode
  - Use a local main-context when using libsoup in a thread
  - create-usb: Skip copying extra-data flatpaks
  - OCI: Switch to pax-format tar archives
  - history: Handle transaction log entries with empty REF field
  - portal: Fix flatpak-spawn --clear-env on OSs where flatpak
    is not on the fallback PATH, such as NixOS
  - Fix various issues detected by scan-build
  + Internal changes:
  - Use GNU bison to build parse-datetime.y
  - Add information about security support and security
    vulnerability reporting (see SECURITY.md)
  - Move all git submodules into subprojects/ directory
  - Several sockets are now created in /run/flatpak in the
    sandbox, with symbolic links in $XDG_RUNTIME_DIR</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1624017600">- Update to version 1.11.2:
  + Bug fixes:
  - Fix logic error when migrating AppStream XML
  - Improve error-checking
  - Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  - Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    which caused "Steam Linux Runtime" containers to fail to start
  - Avoid a crash when looking up summary for a ref without an arch
  - Improve handling of refs belonging to more than one
    architecture, e.g. for cross-compilation
  - Don't abort uninstall if deploy metadata is missing
  - Don't fail transaction if searching for dependencies fails
    in one remote
  - Fix test failure when running tests as root
  - Improve error message for 'sudo flatpak run'
  + Internal changes:
  - Improve printf format string validation
  - Improve test coverage
  - Reduce risk of accidentally hard-coding x86 in the tests</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1624017601">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="andy great &lt;andythe_great@pm.me&gt;" date="1629892800">- Update to version 1.11.3.
  * Bug fixes:
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox,
    fixing a regression introduced when CVE-2021-21261 was fixed in
    1.8.5 and 1.10.0
  * Update the included copy of bubblewrap (flatpak-bwrap) to 0.5.0
  * Better diagnostics when a --bind or other bind-mount fails
  * Create non-directories with safer permissions
  * Allow mounting an non-directory over an existing non-directory
  * Silence kernel messages for our bind-mounts
  * Improve ability to bind-mount directories on case-insensitive
    filesystems
  * Don't ask user which remote to download from if there is only
    one option
  * Internal changes:
  * Improve test coverage
  * Spelling fixes
  * Translation updates: Brazilian Portuguese, Russian, Spanish, Ukrainian</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633694400">- Update to version 1.12.0:
  + This is the first stable release in the 1.12.x series. The
    major changes in this series is the support for better control
    of sub-sandboxes, as used by the steam flatpak.
  + In addition, this release fixes a security vulnerability in the
    portal support. Some recently added syscalls were not blocked
    by the seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules (boo#1191507, CVE-2021-41133)
  + Some test fixes
  + Support for specifying the flatpak binary to use during exports
  + Install translations for all languages in the locale, not just
    the ones in LC_MESSAGES.
  + Fix progress reporting in flatpak fsck
  + Handle cases where /var/tmp is a symlink
  + Expose /etc/gai.conf to the sandbox
  + Fix the parental control checks for root
  + Handle missing /etc/ld.so.cache (musl)
  + Updated translations</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1633780800">- Update to version 1.12.1:
  + The security fix in the 1.12.0 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1634126400">- Update to 1.12.2:
  + Install translations referenced by LANG, LANGUAGE or LC_ALL
  + Fix error handling for the syscalls that are blocked when not
    using --devel
  + Improve diagnostic messages when seccomp rules cannot be
    applied
  + Updated translations.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1639051200">- Add patch support-new-pyparsing.patch:
  * Support pyparsing &gt;= 3.0.4.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1641988800">- Update to 1.12.3:
  + CVE-2021-43860: a malicious repository could have sent invalid
    application metadata in a way that hides some of the app
    permissions displayed during installation (boo#1194610)
  + CVE-2022-21682: flatpak-builder could allow
  - -mirror-screenshots-url commands to create directories outside
    of the build directory (boo#1194611)
  + Extra-data downloading now properly handles compressed
    content-encodings which fixes checksum verification
  + Note: In some corner case server setups this may require the
    extra-data checksum to be changed
  + Avoid unnecessary policy-kit dialog due to auto-pinning when
    installing runtimes
  + Better handling of updates of extensions that exist in multiple
    repositories
  + Fixed (initial) installation apps with renamed ids
  + Fixed regression in updates from no-enumerate remotes
  + We now verify checksums of summary caches, to better handle
    local file corruption
  + Improved cli output for non-terminal targets
  + Flatpak run --session-bus now works
  + Fix build with PyParsing &gt;= 3.0.4
  + Fixed "Since" annotations on FlatpakTransaction signals
  + bash auto completion now doesn't complete on command name
    aliases
  + Minor improvements to the search command
  + Minor improvements to the list command
  + Minor improvements to the repair command
  + Add more tests
  + Updated translations.
- Drop support-new-pyparsing.patch: Fixed upstream.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1642507200">- Update to 1.12.4:
  + reverting non-backwards-compatible behaviour changes in the
    solution previously chosen for CVE-2022-21682 (boo#1194611)
    Fix will be in flatpak-builder 1.2.2.
  + Clarify documentation of --nofilesystem
  + Improve unit test coverage around --filesystem and
  - -nofilesystem
  + Restore compatibility with older appstream-glib versions,
    fixing a regression in 1.12.3</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1644580800">- Update to version 1.12.5:
  + Detect and remove left-over data from
    /var/lib/flatpak/appstream
  + Fix display bugs in flatpak history
  + Don't set up an unnecessary polkit agent for flatpak history
  + Don't propagate GStreamer-related environment variables into
    sandbox
  + Updated translations.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1644753600">- drop apparently unused libdwarf buildrequires</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1645531200">- Update to version 1.12.6:
  + Fix a bug that sometimes caused repo corruption in case
    downloads are interrupted or canceled, necessitating a
    "flatpak repair" to recover
  + More reliably detect the GTK theme
  + Fix history command unit test in some edge cases
  + Updated translations.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1647345600">- Update to version 1.12.7:
  + allow networked access to X11 and PulseAudio services if that
    is configured, and the application has network access
  + Absolute paths in WAYLAND_DISPLAY now work
  + Allow apps that were built with Flatpak 1.13.x to export
    AppStream metadata in share/metainfo
  + Most commands now work if /var/lib/flatpak exists but
    /var/lib/flatpak/repo does not, and will automatically populate
    the repo directory if possible
  + Consistently pass relative subpaths to libostree, working
    around a bug in libostree &lt; 2021.6 when used with GLib &gt;= 2.71
  + Fix some memory leaks in GVariant data processing</changelog>
</package>
</otherdata>