<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="14">
<package pkgid="2a73879352209801600895470f06c3614e30dce8ffdd78407c5aed6afc7957489d0dd3243cf132f8e3e5eaced0add0226b39a1dd556ec2b585c445702c027afa" name="libtcnative-1-0" arch="aarch64">
  <version epoch="0" ver="1.3.8" rel="14.9"/>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1676376000">- Version update to version 1.2.36:
  * Update the recommended minimum version of APR to 1.7.2.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1t.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1687867200">- Version update to version 1.2.37:
  * Update: Update the recommended minimum version of APR to 1.7.4.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1u.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1692705600">- Version update to version 1.2.38:
  * Update: Align default pass phrase prompt with HTTPd.
  * Fix: 66669: Fix memory leak in SNI processing.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1v.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1696680000">- Version update to version 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates from
    unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to 3.0.11.</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1699963200">- Version update to version 1.2.38:
  * Align default pass phrase prompt with HTTPd.
  * #66669: Fix memory leak in SNI processing.
  * Update the recommended minimum version of OpenSSL to 1.1.1v.
  * Update the recommended minimum version of APR to 1.7.4.
  * Document the TLS rengotiation behaviour.
  * Add HOWTO-RELEASE.txt that describes the release process.
  * Refactor library initialization so it is compatible with Tomcat
    10.1.x onwards where a number of Java classes have been removed.
  * Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to
    allow clients to determine if the FIPS provider is being used
    when Tomcat Native is compiled against OpenSSL 3.x.
  * #66035: Fix crash when attempting to read TLS session ID after
    a handshake failure.
  * Enable download_deps.sh to be called from any directory.
  * Fix release script so it works with the current git layout.
  * #65441: Correct previous fix that enabled building to continue
    with OpenSSL 3.x.
  * #65659: Remove remaining reference to pkg-config which is no
    longer included in the Tomcat Native distribution.
  * #65181: Additional changes required to provided support for
    using OpenSSL Engines that use proprietary key formats.
  * #65329: Correct handling of WINVER in make file to use correct
    constant for Windows 7. Add constants for Windows 8, Windows 8.1
    and Windows 10. Rename WINNT to WIN2k as it is used for Windows
    2000 upwards, not Windows NT upwards.
  * Add a patch for APR that fixes an issue where some Windows
    systems in some configurations would only listen on IPv6
    addresses on dual stack systems even though configured to listen
    on both IPv6 and IPv4 addresses.
  * Correct a regression in the fix for 65181 that prevented an
    error message from being displayed if an invalid key file was
    provided and no OpenSSL Engine was configured.
  * #65181: Improve support for using OpenSSL Engines that use
    proprietary key formats.
  * Enable building to continue against OpenSSL 3.x and 1.1.1.
  * Incomplete name mangling fix for C++ compilers in tcn_api.h.
  * Improve OS-specific header include for native thread id.
  * Disable keylog callback support for LibreSSL.
  * Add support for SSLContext.addChainCertificateRaw() with
    LibreSSL 2.9.1 and up.
  * Add support for HP-UX's _lwp_self() in our ssl_thread_id(void).
  * Remove default option passed for rpath to linker on HP-UX.
  * Add an option to allow the OCSP responder check to be bypassed.
    Note that if OCSP is enabled, a missing responder is now treated
    as an error.
  * #64429: Fix compilation with LibreSSL.
  * #63671: libtcnative does not compile with OpenSSL &lt; 1.1.0 and
    APR w/o threading support.
  * Correct configure message for OpenSSL libdir.
  * #64260: Clean up install target.
  * #64315: configure output for OpenSSL wrong/incomplete sometimes.
  * Drop obsolete build time workarounds for HP-UX.
  * Add support for FreeBSD's pthread_getthreadid_np() in our
    ssl_thread_id(void).
  * #64316: Introduce tcn_get_thread_id(void) to reduce code
    duplication.
  * Fix linking against OpenSSL in non-standard locations on FreeBSD.
- Removed patch:
  * libtcnative-1-0-bsc1199170.patch
    + fix integrated</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1707825600">- Update to 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates
    from unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to
    3.0.11.
  * Change the hardcoded libopenssl-1_1-devel to libopenssl-devel
    for distributions that have the right version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1707825601">- Update to 1.3.0:
  * Update: Drop useless compile.optimize option.
  * Update: Align Java source compile configuration with Tomcat.
  * Fix: Fix version set in DLL header on Windows
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c.
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to
    3.5.2.
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1721822400">- Update to 1.3.1
  * Fix a crash on Windows when SSLContext.setCACertificate() is invoked
    with a null value for caCertificateFile and a non-null value for
    caCertificatePath
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant.
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings.
  * The windows binaries in this release have been built with OpenSSL
    3.0.14</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1727611200">- Fix build after removal of the default %%{java_home} define</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1774440000">- Update to 1.3.7: [bsc#1260322]
  1.3.7
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)
  1.3.6
  * Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL and
    SSL_CTX clean-up. (markt)
  * Fix: Fix unnecessarily large buffer allocation when filtering out NULL
    and export ciphers. Pull requests #35 and #37 provided by chenjp.
    (markt)
  * Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
  * Fix: Refactor setting of OCSP configuration defaults as they were only
    applied if the SSL_CONF_CTX was used. While one was always used with
    Tomcat versions aware of the OCSP configuration options, one was not
    always used with Tomcat versions unaware of the OCSP configuration
    options leading to OCSP verification being enabled by default when the
    expected behaviour was disabled by default. (markt)
  * Code: Improve performance for the rare case of handling large OCSP
    responses. (markt)
  1.3.5
  * Fix: Remove group write permissions from the files in the tar.gz
    source archive. (markt)
  * Fix: Clear an additional error in OCSP processing that was preventing
    OCSP soft fail working with Tomcat's APR/native connector. (markt)
  1.3.4
  * Fix: Correct logic error that prevented the configuration of TLS 1.3
    cipher suites. (markt)
  1.3.3
  * Fix: Refactor the addition of TLS 1.3 cipher suite configuration to
    avoid a regression when running a version of Tomcat that pre-dates
    this change. (markt)
  1.3.2
  * Update: Rename configure.in to modern autotools style configure.ac.
    (rjung)
  * Update: Fix incomplete updates for autotools generated files during
    "buildconf" execution. (rjung)
  * Update: Improve quoting in tcnative.m4. (rjung)
  * Update: Update the minimum version of autoconf for releasing to 2.68.
    (rjung)
  * Fix: Fix the autoconf warnings when creating a release. (markt)
  * Update: The Windows binaries are now built with OCSP support enabled
    by default. (markt)
  * Add: Include a nonce with OCSP requests and check the nonce, if any,
    in the OCSP response. (markt)
  * Add: Expand verification of OCSP responses. (markt)
  * Add: Add the ability to configure the OCSP checks to soft-fail - i.e.
    if the responder cannot be contacted or fails to respond in a timely
    manner the OCSP check will not fail. (markt)
  * Add: Add a configurable timeout to the writing of OCSP requests and
    reading of OCSP responses. (markt)
  * Add: Add the ability to control the OCSP verification flags. (markt)
  * Add: Configure TLS 1.3 connections from the provided ciphers list as
    well as connections using TLS 1.2 and earlier. Pull request provided
    by gastush. (markt)
  * Update: Update the Windows build environment to use Visual Studio
    2022. (markt)
  1.3.1
  * Fix: Fix a crash on Windows when SSLContext.setCACertificate() is
    invoked with a null value for caCertificateFile and a non-null value
    for caCertificatePath until properly addressed with
    https://github.com/openssl/openssl/issues/24416. (michaelo)
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant. (schultz)
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings. (schultz)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.14.
    (markt)
  1.3.0
  * Update: Drop useless compile.optimize option. (michaelo)
  * Update: Align Java source compile configuration with Tomcat.
    (michaelo)
  * Fix: Fix version set in DLL header on Windows. (michaelo)
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c. (michaelo)
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to 3.5.2.
    (markt)
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019. (markt)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.13.
    (markt)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Update to 1.3.8
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication when Tomcat is configured
    with a trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
</package>
<package pkgid="177604dda1a6e5630f888e973fd67a7eb7bcbd86786965781b3e734fba3ac763b0aab4dfa8688c6ee8235969a59813c34bf7a28620aa2698c9479444ff4d96de" name="libtcnative-1-0" arch="i586">
  <version epoch="0" ver="1.3.8" rel="14.9"/>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1676376000">- Version update to version 1.2.36:
  * Update the recommended minimum version of APR to 1.7.2.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1t.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1687867200">- Version update to version 1.2.37:
  * Update: Update the recommended minimum version of APR to 1.7.4.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1u.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1692705600">- Version update to version 1.2.38:
  * Update: Align default pass phrase prompt with HTTPd.
  * Fix: 66669: Fix memory leak in SNI processing.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1v.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1696680000">- Version update to version 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates from
    unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to 3.0.11.</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1699963200">- Version update to version 1.2.38:
  * Align default pass phrase prompt with HTTPd.
  * #66669: Fix memory leak in SNI processing.
  * Update the recommended minimum version of OpenSSL to 1.1.1v.
  * Update the recommended minimum version of APR to 1.7.4.
  * Document the TLS rengotiation behaviour.
  * Add HOWTO-RELEASE.txt that describes the release process.
  * Refactor library initialization so it is compatible with Tomcat
    10.1.x onwards where a number of Java classes have been removed.
  * Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to
    allow clients to determine if the FIPS provider is being used
    when Tomcat Native is compiled against OpenSSL 3.x.
  * #66035: Fix crash when attempting to read TLS session ID after
    a handshake failure.
  * Enable download_deps.sh to be called from any directory.
  * Fix release script so it works with the current git layout.
  * #65441: Correct previous fix that enabled building to continue
    with OpenSSL 3.x.
  * #65659: Remove remaining reference to pkg-config which is no
    longer included in the Tomcat Native distribution.
  * #65181: Additional changes required to provided support for
    using OpenSSL Engines that use proprietary key formats.
  * #65329: Correct handling of WINVER in make file to use correct
    constant for Windows 7. Add constants for Windows 8, Windows 8.1
    and Windows 10. Rename WINNT to WIN2k as it is used for Windows
    2000 upwards, not Windows NT upwards.
  * Add a patch for APR that fixes an issue where some Windows
    systems in some configurations would only listen on IPv6
    addresses on dual stack systems even though configured to listen
    on both IPv6 and IPv4 addresses.
  * Correct a regression in the fix for 65181 that prevented an
    error message from being displayed if an invalid key file was
    provided and no OpenSSL Engine was configured.
  * #65181: Improve support for using OpenSSL Engines that use
    proprietary key formats.
  * Enable building to continue against OpenSSL 3.x and 1.1.1.
  * Incomplete name mangling fix for C++ compilers in tcn_api.h.
  * Improve OS-specific header include for native thread id.
  * Disable keylog callback support for LibreSSL.
  * Add support for SSLContext.addChainCertificateRaw() with
    LibreSSL 2.9.1 and up.
  * Add support for HP-UX's _lwp_self() in our ssl_thread_id(void).
  * Remove default option passed for rpath to linker on HP-UX.
  * Add an option to allow the OCSP responder check to be bypassed.
    Note that if OCSP is enabled, a missing responder is now treated
    as an error.
  * #64429: Fix compilation with LibreSSL.
  * #63671: libtcnative does not compile with OpenSSL &lt; 1.1.0 and
    APR w/o threading support.
  * Correct configure message for OpenSSL libdir.
  * #64260: Clean up install target.
  * #64315: configure output for OpenSSL wrong/incomplete sometimes.
  * Drop obsolete build time workarounds for HP-UX.
  * Add support for FreeBSD's pthread_getthreadid_np() in our
    ssl_thread_id(void).
  * #64316: Introduce tcn_get_thread_id(void) to reduce code
    duplication.
  * Fix linking against OpenSSL in non-standard locations on FreeBSD.
- Removed patch:
  * libtcnative-1-0-bsc1199170.patch
    + fix integrated</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1707825600">- Update to 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates
    from unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to
    3.0.11.
  * Change the hardcoded libopenssl-1_1-devel to libopenssl-devel
    for distributions that have the right version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1707825601">- Update to 1.3.0:
  * Update: Drop useless compile.optimize option.
  * Update: Align Java source compile configuration with Tomcat.
  * Fix: Fix version set in DLL header on Windows
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c.
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to
    3.5.2.
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1721822400">- Update to 1.3.1
  * Fix a crash on Windows when SSLContext.setCACertificate() is invoked
    with a null value for caCertificateFile and a non-null value for
    caCertificatePath
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant.
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings.
  * The windows binaries in this release have been built with OpenSSL
    3.0.14</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1727611200">- Fix build after removal of the default %%{java_home} define</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1774440000">- Update to 1.3.7: [bsc#1260322]
  1.3.7
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)
  1.3.6
  * Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL and
    SSL_CTX clean-up. (markt)
  * Fix: Fix unnecessarily large buffer allocation when filtering out NULL
    and export ciphers. Pull requests #35 and #37 provided by chenjp.
    (markt)
  * Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
  * Fix: Refactor setting of OCSP configuration defaults as they were only
    applied if the SSL_CONF_CTX was used. While one was always used with
    Tomcat versions aware of the OCSP configuration options, one was not
    always used with Tomcat versions unaware of the OCSP configuration
    options leading to OCSP verification being enabled by default when the
    expected behaviour was disabled by default. (markt)
  * Code: Improve performance for the rare case of handling large OCSP
    responses. (markt)
  1.3.5
  * Fix: Remove group write permissions from the files in the tar.gz
    source archive. (markt)
  * Fix: Clear an additional error in OCSP processing that was preventing
    OCSP soft fail working with Tomcat's APR/native connector. (markt)
  1.3.4
  * Fix: Correct logic error that prevented the configuration of TLS 1.3
    cipher suites. (markt)
  1.3.3
  * Fix: Refactor the addition of TLS 1.3 cipher suite configuration to
    avoid a regression when running a version of Tomcat that pre-dates
    this change. (markt)
  1.3.2
  * Update: Rename configure.in to modern autotools style configure.ac.
    (rjung)
  * Update: Fix incomplete updates for autotools generated files during
    "buildconf" execution. (rjung)
  * Update: Improve quoting in tcnative.m4. (rjung)
  * Update: Update the minimum version of autoconf for releasing to 2.68.
    (rjung)
  * Fix: Fix the autoconf warnings when creating a release. (markt)
  * Update: The Windows binaries are now built with OCSP support enabled
    by default. (markt)
  * Add: Include a nonce with OCSP requests and check the nonce, if any,
    in the OCSP response. (markt)
  * Add: Expand verification of OCSP responses. (markt)
  * Add: Add the ability to configure the OCSP checks to soft-fail - i.e.
    if the responder cannot be contacted or fails to respond in a timely
    manner the OCSP check will not fail. (markt)
  * Add: Add a configurable timeout to the writing of OCSP requests and
    reading of OCSP responses. (markt)
  * Add: Add the ability to control the OCSP verification flags. (markt)
  * Add: Configure TLS 1.3 connections from the provided ciphers list as
    well as connections using TLS 1.2 and earlier. Pull request provided
    by gastush. (markt)
  * Update: Update the Windows build environment to use Visual Studio
    2022. (markt)
  1.3.1
  * Fix: Fix a crash on Windows when SSLContext.setCACertificate() is
    invoked with a null value for caCertificateFile and a non-null value
    for caCertificatePath until properly addressed with
    https://github.com/openssl/openssl/issues/24416. (michaelo)
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant. (schultz)
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings. (schultz)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.14.
    (markt)
  1.3.0
  * Update: Drop useless compile.optimize option. (michaelo)
  * Update: Align Java source compile configuration with Tomcat.
    (michaelo)
  * Fix: Fix version set in DLL header on Windows. (michaelo)
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c. (michaelo)
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to 3.5.2.
    (markt)
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019. (markt)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.13.
    (markt)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Update to 1.3.8
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication when Tomcat is configured
    with a trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
</package>
<package pkgid="df11ac8a4a93ccac9be34c7d246fc8f79f19da2514fe67642ba1929dc93f886e283fc10a200423e3c65114d54d2f52689c99484bb0e74f8b9b3133becfce74ba" name="libtcnative-1-0" arch="src">
  <version epoch="0" ver="1.3.8" rel="14.9"/>
  <changelog author="tchvatal@suse.com" date="1424865600">- Remove keyring file as there is new keyring and I didn't find it
  on the web</changelog>
  <changelog author="tchvatal@suse.com" date="1454500800">- Version update to version 1.2.4:
  * See changelog.html for in-depth upstream changes
  * This connector to properly work requires openssl 1.0.2 or newer
    so do not backport to other codestreams.</changelog>
  <changelog author="fstrba@suse.com" date="1511784000">- Version update to version 1.2.16:
  * See changelog.html for in-depth upstream changes
  * Fixes build breakage with newer version of openssl</changelog>
  <changelog author="Matei &lt;malbu@suse.com&gt;" date="1559822400">- Version update to version 1.2.21:
  * See changelog.html for in-depth upstream changes
  * Fix incompatibility with Tomcat (bsc#1130843)</changelog>
  <changelog author="Matei Albu &lt;malbu@suse.com&gt;" date="1565611200">- Version update to version 1.2.23:
  * See changelog.html for in-depth upstream changes</changelog>
  <changelog author="Matei Albu &lt;malbu@suse.com&gt;" date="1573128000">- Add GPG keyring.</changelog>
  <changelog author="pgajdos@suse.com" date="1659096000">- Fix for SG#63251, bsc#1199170 (thanks to ohollmann@suse.com)
- added patches
  fix https://github.com/apache/tomcat-native/commit/5ac1175a0cf24aae2a285b3f3fb877ff83aef0c0
  + libtcnative-1-0-bsc1199170.patch</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1659528000">- Version update to version 1.2.35:
  * See changelog.html for in-depth upstream changes
  * Docs: Document the TLS rengotiation behaviour.
  * Docs: Add HOWTO-RELEASE.txt that describes the release process.
  * Update: Update recommended OpenSSL version to 1.1.1q or later.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1665662400">- changed RPM URL to https://tomcat.apache.org/native-doc/</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1676376000">- Version update to version 1.2.36:
  * Update the recommended minimum version of APR to 1.7.2.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1t.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1687867200">- Version update to version 1.2.37:
  * Update: Update the recommended minimum version of APR to 1.7.4.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1u.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1692705600">- Version update to version 1.2.38:
  * Update: Align default pass phrase prompt with HTTPd.
  * Fix: 66669: Fix memory leak in SNI processing.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1v.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1696680000">- Version update to version 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates from
    unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to 3.0.11.</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1699963200">- Version update to version 1.2.38:
  * Align default pass phrase prompt with HTTPd.
  * #66669: Fix memory leak in SNI processing.
  * Update the recommended minimum version of OpenSSL to 1.1.1v.
  * Update the recommended minimum version of APR to 1.7.4.
  * Document the TLS rengotiation behaviour.
  * Add HOWTO-RELEASE.txt that describes the release process.
  * Refactor library initialization so it is compatible with Tomcat
    10.1.x onwards where a number of Java classes have been removed.
  * Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to
    allow clients to determine if the FIPS provider is being used
    when Tomcat Native is compiled against OpenSSL 3.x.
  * #66035: Fix crash when attempting to read TLS session ID after
    a handshake failure.
  * Enable download_deps.sh to be called from any directory.
  * Fix release script so it works with the current git layout.
  * #65441: Correct previous fix that enabled building to continue
    with OpenSSL 3.x.
  * #65659: Remove remaining reference to pkg-config which is no
    longer included in the Tomcat Native distribution.
  * #65181: Additional changes required to provided support for
    using OpenSSL Engines that use proprietary key formats.
  * #65329: Correct handling of WINVER in make file to use correct
    constant for Windows 7. Add constants for Windows 8, Windows 8.1
    and Windows 10. Rename WINNT to WIN2k as it is used for Windows
    2000 upwards, not Windows NT upwards.
  * Add a patch for APR that fixes an issue where some Windows
    systems in some configurations would only listen on IPv6
    addresses on dual stack systems even though configured to listen
    on both IPv6 and IPv4 addresses.
  * Correct a regression in the fix for 65181 that prevented an
    error message from being displayed if an invalid key file was
    provided and no OpenSSL Engine was configured.
  * #65181: Improve support for using OpenSSL Engines that use
    proprietary key formats.
  * Enable building to continue against OpenSSL 3.x and 1.1.1.
  * Incomplete name mangling fix for C++ compilers in tcn_api.h.
  * Improve OS-specific header include for native thread id.
  * Disable keylog callback support for LibreSSL.
  * Add support for SSLContext.addChainCertificateRaw() with
    LibreSSL 2.9.1 and up.
  * Add support for HP-UX's _lwp_self() in our ssl_thread_id(void).
  * Remove default option passed for rpath to linker on HP-UX.
  * Add an option to allow the OCSP responder check to be bypassed.
    Note that if OCSP is enabled, a missing responder is now treated
    as an error.
  * #64429: Fix compilation with LibreSSL.
  * #63671: libtcnative does not compile with OpenSSL &lt; 1.1.0 and
    APR w/o threading support.
  * Correct configure message for OpenSSL libdir.
  * #64260: Clean up install target.
  * #64315: configure output for OpenSSL wrong/incomplete sometimes.
  * Drop obsolete build time workarounds for HP-UX.
  * Add support for FreeBSD's pthread_getthreadid_np() in our
    ssl_thread_id(void).
  * #64316: Introduce tcn_get_thread_id(void) to reduce code
    duplication.
  * Fix linking against OpenSSL in non-standard locations on FreeBSD.
- Removed patch:
  * libtcnative-1-0-bsc1199170.patch
    + fix integrated</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1707825600">- Update to 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates
    from unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to
    3.0.11.
  * Change the hardcoded libopenssl-1_1-devel to libopenssl-devel
    for distributions that have the right version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1707825601">- Update to 1.3.0:
  * Update: Drop useless compile.optimize option.
  * Update: Align Java source compile configuration with Tomcat.
  * Fix: Fix version set in DLL header on Windows
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c.
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to
    3.5.2.
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1721822400">- Update to 1.3.1
  * Fix a crash on Windows when SSLContext.setCACertificate() is invoked
    with a null value for caCertificateFile and a non-null value for
    caCertificatePath
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant.
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings.
  * The windows binaries in this release have been built with OpenSSL
    3.0.14</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1727611200">- Fix build after removal of the default %%{java_home} define</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1774440000">- Update to 1.3.7: [bsc#1260322]
  1.3.7
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)
  1.3.6
  * Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL and
    SSL_CTX clean-up. (markt)
  * Fix: Fix unnecessarily large buffer allocation when filtering out NULL
    and export ciphers. Pull requests #35 and #37 provided by chenjp.
    (markt)
  * Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
  * Fix: Refactor setting of OCSP configuration defaults as they were only
    applied if the SSL_CONF_CTX was used. While one was always used with
    Tomcat versions aware of the OCSP configuration options, one was not
    always used with Tomcat versions unaware of the OCSP configuration
    options leading to OCSP verification being enabled by default when the
    expected behaviour was disabled by default. (markt)
  * Code: Improve performance for the rare case of handling large OCSP
    responses. (markt)
  1.3.5
  * Fix: Remove group write permissions from the files in the tar.gz
    source archive. (markt)
  * Fix: Clear an additional error in OCSP processing that was preventing
    OCSP soft fail working with Tomcat's APR/native connector. (markt)
  1.3.4
  * Fix: Correct logic error that prevented the configuration of TLS 1.3
    cipher suites. (markt)
  1.3.3
  * Fix: Refactor the addition of TLS 1.3 cipher suite configuration to
    avoid a regression when running a version of Tomcat that pre-dates
    this change. (markt)
  1.3.2
  * Update: Rename configure.in to modern autotools style configure.ac.
    (rjung)
  * Update: Fix incomplete updates for autotools generated files during
    "buildconf" execution. (rjung)
  * Update: Improve quoting in tcnative.m4. (rjung)
  * Update: Update the minimum version of autoconf for releasing to 2.68.
    (rjung)
  * Fix: Fix the autoconf warnings when creating a release. (markt)
  * Update: The Windows binaries are now built with OCSP support enabled
    by default. (markt)
  * Add: Include a nonce with OCSP requests and check the nonce, if any,
    in the OCSP response. (markt)
  * Add: Expand verification of OCSP responses. (markt)
  * Add: Add the ability to configure the OCSP checks to soft-fail - i.e.
    if the responder cannot be contacted or fails to respond in a timely
    manner the OCSP check will not fail. (markt)
  * Add: Add a configurable timeout to the writing of OCSP requests and
    reading of OCSP responses. (markt)
  * Add: Add the ability to control the OCSP verification flags. (markt)
  * Add: Configure TLS 1.3 connections from the provided ciphers list as
    well as connections using TLS 1.2 and earlier. Pull request provided
    by gastush. (markt)
  * Update: Update the Windows build environment to use Visual Studio
    2022. (markt)
  1.3.1
  * Fix: Fix a crash on Windows when SSLContext.setCACertificate() is
    invoked with a null value for caCertificateFile and a non-null value
    for caCertificatePath until properly addressed with
    https://github.com/openssl/openssl/issues/24416. (michaelo)
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant. (schultz)
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings. (schultz)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.14.
    (markt)
  1.3.0
  * Update: Drop useless compile.optimize option. (michaelo)
  * Update: Align Java source compile configuration with Tomcat.
    (michaelo)
  * Fix: Fix version set in DLL header on Windows. (michaelo)
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c. (michaelo)
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to 3.5.2.
    (markt)
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019. (markt)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.13.
    (markt)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Update to 1.3.8
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication when Tomcat is configured
    with a trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
</package>
<package pkgid="d0cbe924cc134443a6df6ad155c35c6b3d36a7654a54257466c25cc2040ea294edd750006b957f30ba26c1bc8fd32039eca48ff10f236cf6d6ae28061fe27c75" name="libtcnative-1-0" arch="x86_64">
  <version epoch="0" ver="1.3.8" rel="14.9"/>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1676376000">- Version update to version 1.2.36:
  * Update the recommended minimum version of APR to 1.7.2.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1t.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1687867200">- Version update to version 1.2.37:
  * Update: Update the recommended minimum version of APR to 1.7.4.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1u.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1692705600">- Version update to version 1.2.38:
  * Update: Align default pass phrase prompt with HTTPd.
  * Fix: 66669: Fix memory leak in SNI processing.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1v.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1696680000">- Version update to version 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates from
    unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to 3.0.11.</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1699963200">- Version update to version 1.2.38:
  * Align default pass phrase prompt with HTTPd.
  * #66669: Fix memory leak in SNI processing.
  * Update the recommended minimum version of OpenSSL to 1.1.1v.
  * Update the recommended minimum version of APR to 1.7.4.
  * Document the TLS rengotiation behaviour.
  * Add HOWTO-RELEASE.txt that describes the release process.
  * Refactor library initialization so it is compatible with Tomcat
    10.1.x onwards where a number of Java classes have been removed.
  * Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to
    allow clients to determine if the FIPS provider is being used
    when Tomcat Native is compiled against OpenSSL 3.x.
  * #66035: Fix crash when attempting to read TLS session ID after
    a handshake failure.
  * Enable download_deps.sh to be called from any directory.
  * Fix release script so it works with the current git layout.
  * #65441: Correct previous fix that enabled building to continue
    with OpenSSL 3.x.
  * #65659: Remove remaining reference to pkg-config which is no
    longer included in the Tomcat Native distribution.
  * #65181: Additional changes required to provided support for
    using OpenSSL Engines that use proprietary key formats.
  * #65329: Correct handling of WINVER in make file to use correct
    constant for Windows 7. Add constants for Windows 8, Windows 8.1
    and Windows 10. Rename WINNT to WIN2k as it is used for Windows
    2000 upwards, not Windows NT upwards.
  * Add a patch for APR that fixes an issue where some Windows
    systems in some configurations would only listen on IPv6
    addresses on dual stack systems even though configured to listen
    on both IPv6 and IPv4 addresses.
  * Correct a regression in the fix for 65181 that prevented an
    error message from being displayed if an invalid key file was
    provided and no OpenSSL Engine was configured.
  * #65181: Improve support for using OpenSSL Engines that use
    proprietary key formats.
  * Enable building to continue against OpenSSL 3.x and 1.1.1.
  * Incomplete name mangling fix for C++ compilers in tcn_api.h.
  * Improve OS-specific header include for native thread id.
  * Disable keylog callback support for LibreSSL.
  * Add support for SSLContext.addChainCertificateRaw() with
    LibreSSL 2.9.1 and up.
  * Add support for HP-UX's _lwp_self() in our ssl_thread_id(void).
  * Remove default option passed for rpath to linker on HP-UX.
  * Add an option to allow the OCSP responder check to be bypassed.
    Note that if OCSP is enabled, a missing responder is now treated
    as an error.
  * #64429: Fix compilation with LibreSSL.
  * #63671: libtcnative does not compile with OpenSSL &lt; 1.1.0 and
    APR w/o threading support.
  * Correct configure message for OpenSSL libdir.
  * #64260: Clean up install target.
  * #64315: configure output for OpenSSL wrong/incomplete sometimes.
  * Drop obsolete build time workarounds for HP-UX.
  * Add support for FreeBSD's pthread_getthreadid_np() in our
    ssl_thread_id(void).
  * #64316: Introduce tcn_get_thread_id(void) to reduce code
    duplication.
  * Fix linking against OpenSSL in non-standard locations on FreeBSD.
- Removed patch:
  * libtcnative-1-0-bsc1199170.patch
    + fix integrated</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1707825600">- Update to 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates
    from unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to
    3.0.11.
  * Change the hardcoded libopenssl-1_1-devel to libopenssl-devel
    for distributions that have the right version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1707825601">- Update to 1.3.0:
  * Update: Drop useless compile.optimize option.
  * Update: Align Java source compile configuration with Tomcat.
  * Fix: Fix version set in DLL header on Windows
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c.
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to
    3.5.2.
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1721822400">- Update to 1.3.1
  * Fix a crash on Windows when SSLContext.setCACertificate() is invoked
    with a null value for caCertificateFile and a non-null value for
    caCertificatePath
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant.
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings.
  * The windows binaries in this release have been built with OpenSSL
    3.0.14</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1727611200">- Fix build after removal of the default %%{java_home} define</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1774440000">- Update to 1.3.7: [bsc#1260322]
  1.3.7
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)
  1.3.6
  * Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL and
    SSL_CTX clean-up. (markt)
  * Fix: Fix unnecessarily large buffer allocation when filtering out NULL
    and export ciphers. Pull requests #35 and #37 provided by chenjp.
    (markt)
  * Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
  * Fix: Refactor setting of OCSP configuration defaults as they were only
    applied if the SSL_CONF_CTX was used. While one was always used with
    Tomcat versions aware of the OCSP configuration options, one was not
    always used with Tomcat versions unaware of the OCSP configuration
    options leading to OCSP verification being enabled by default when the
    expected behaviour was disabled by default. (markt)
  * Code: Improve performance for the rare case of handling large OCSP
    responses. (markt)
  1.3.5
  * Fix: Remove group write permissions from the files in the tar.gz
    source archive. (markt)
  * Fix: Clear an additional error in OCSP processing that was preventing
    OCSP soft fail working with Tomcat's APR/native connector. (markt)
  1.3.4
  * Fix: Correct logic error that prevented the configuration of TLS 1.3
    cipher suites. (markt)
  1.3.3
  * Fix: Refactor the addition of TLS 1.3 cipher suite configuration to
    avoid a regression when running a version of Tomcat that pre-dates
    this change. (markt)
  1.3.2
  * Update: Rename configure.in to modern autotools style configure.ac.
    (rjung)
  * Update: Fix incomplete updates for autotools generated files during
    "buildconf" execution. (rjung)
  * Update: Improve quoting in tcnative.m4. (rjung)
  * Update: Update the minimum version of autoconf for releasing to 2.68.
    (rjung)
  * Fix: Fix the autoconf warnings when creating a release. (markt)
  * Update: The Windows binaries are now built with OCSP support enabled
    by default. (markt)
  * Add: Include a nonce with OCSP requests and check the nonce, if any,
    in the OCSP response. (markt)
  * Add: Expand verification of OCSP responses. (markt)
  * Add: Add the ability to configure the OCSP checks to soft-fail - i.e.
    if the responder cannot be contacted or fails to respond in a timely
    manner the OCSP check will not fail. (markt)
  * Add: Add a configurable timeout to the writing of OCSP requests and
    reading of OCSP responses. (markt)
  * Add: Add the ability to control the OCSP verification flags. (markt)
  * Add: Configure TLS 1.3 connections from the provided ciphers list as
    well as connections using TLS 1.2 and earlier. Pull request provided
    by gastush. (markt)
  * Update: Update the Windows build environment to use Visual Studio
    2022. (markt)
  1.3.1
  * Fix: Fix a crash on Windows when SSLContext.setCACertificate() is
    invoked with a null value for caCertificateFile and a non-null value
    for caCertificatePath until properly addressed with
    https://github.com/openssl/openssl/issues/24416. (michaelo)
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant. (schultz)
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings. (schultz)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.14.
    (markt)
  1.3.0
  * Update: Drop useless compile.optimize option. (michaelo)
  * Update: Align Java source compile configuration with Tomcat.
    (michaelo)
  * Fix: Fix version set in DLL header on Windows. (michaelo)
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c. (michaelo)
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to 3.5.2.
    (markt)
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019. (markt)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.13.
    (markt)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Update to 1.3.8
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication when Tomcat is configured
    with a trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
</package>
<package pkgid="3dc465169c34caa14f93fb45df7c514bc427ab6c4780bf1b314cbdd65ea0a9831dc2e29d9a5b24be6a9756c5f0e3b3a289ea434b9d2dfdc0f1ee3f0ea16d40e3" name="libtcnative-1-0-devel" arch="aarch64">
  <version epoch="0" ver="1.3.8" rel="14.9"/>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1676376000">- Version update to version 1.2.36:
  * Update the recommended minimum version of APR to 1.7.2.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1t.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1687867200">- Version update to version 1.2.37:
  * Update: Update the recommended minimum version of APR to 1.7.4.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1u.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1692705600">- Version update to version 1.2.38:
  * Update: Align default pass phrase prompt with HTTPd.
  * Fix: 66669: Fix memory leak in SNI processing.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1v.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1696680000">- Version update to version 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates from
    unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to 3.0.11.</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1699963200">- Version update to version 1.2.38:
  * Align default pass phrase prompt with HTTPd.
  * #66669: Fix memory leak in SNI processing.
  * Update the recommended minimum version of OpenSSL to 1.1.1v.
  * Update the recommended minimum version of APR to 1.7.4.
  * Document the TLS rengotiation behaviour.
  * Add HOWTO-RELEASE.txt that describes the release process.
  * Refactor library initialization so it is compatible with Tomcat
    10.1.x onwards where a number of Java classes have been removed.
  * Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to
    allow clients to determine if the FIPS provider is being used
    when Tomcat Native is compiled against OpenSSL 3.x.
  * #66035: Fix crash when attempting to read TLS session ID after
    a handshake failure.
  * Enable download_deps.sh to be called from any directory.
  * Fix release script so it works with the current git layout.
  * #65441: Correct previous fix that enabled building to continue
    with OpenSSL 3.x.
  * #65659: Remove remaining reference to pkg-config which is no
    longer included in the Tomcat Native distribution.
  * #65181: Additional changes required to provided support for
    using OpenSSL Engines that use proprietary key formats.
  * #65329: Correct handling of WINVER in make file to use correct
    constant for Windows 7. Add constants for Windows 8, Windows 8.1
    and Windows 10. Rename WINNT to WIN2k as it is used for Windows
    2000 upwards, not Windows NT upwards.
  * Add a patch for APR that fixes an issue where some Windows
    systems in some configurations would only listen on IPv6
    addresses on dual stack systems even though configured to listen
    on both IPv6 and IPv4 addresses.
  * Correct a regression in the fix for 65181 that prevented an
    error message from being displayed if an invalid key file was
    provided and no OpenSSL Engine was configured.
  * #65181: Improve support for using OpenSSL Engines that use
    proprietary key formats.
  * Enable building to continue against OpenSSL 3.x and 1.1.1.
  * Incomplete name mangling fix for C++ compilers in tcn_api.h.
  * Improve OS-specific header include for native thread id.
  * Disable keylog callback support for LibreSSL.
  * Add support for SSLContext.addChainCertificateRaw() with
    LibreSSL 2.9.1 and up.
  * Add support for HP-UX's _lwp_self() in our ssl_thread_id(void).
  * Remove default option passed for rpath to linker on HP-UX.
  * Add an option to allow the OCSP responder check to be bypassed.
    Note that if OCSP is enabled, a missing responder is now treated
    as an error.
  * #64429: Fix compilation with LibreSSL.
  * #63671: libtcnative does not compile with OpenSSL &lt; 1.1.0 and
    APR w/o threading support.
  * Correct configure message for OpenSSL libdir.
  * #64260: Clean up install target.
  * #64315: configure output for OpenSSL wrong/incomplete sometimes.
  * Drop obsolete build time workarounds for HP-UX.
  * Add support for FreeBSD's pthread_getthreadid_np() in our
    ssl_thread_id(void).
  * #64316: Introduce tcn_get_thread_id(void) to reduce code
    duplication.
  * Fix linking against OpenSSL in non-standard locations on FreeBSD.
- Removed patch:
  * libtcnative-1-0-bsc1199170.patch
    + fix integrated</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1707825600">- Update to 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates
    from unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to
    3.0.11.
  * Change the hardcoded libopenssl-1_1-devel to libopenssl-devel
    for distributions that have the right version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1707825601">- Update to 1.3.0:
  * Update: Drop useless compile.optimize option.
  * Update: Align Java source compile configuration with Tomcat.
  * Fix: Fix version set in DLL header on Windows
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c.
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to
    3.5.2.
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1721822400">- Update to 1.3.1
  * Fix a crash on Windows when SSLContext.setCACertificate() is invoked
    with a null value for caCertificateFile and a non-null value for
    caCertificatePath
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant.
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings.
  * The windows binaries in this release have been built with OpenSSL
    3.0.14</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1727611200">- Fix build after removal of the default %%{java_home} define</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1774440000">- Update to 1.3.7: [bsc#1260322]
  1.3.7
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)
  1.3.6
  * Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL and
    SSL_CTX clean-up. (markt)
  * Fix: Fix unnecessarily large buffer allocation when filtering out NULL
    and export ciphers. Pull requests #35 and #37 provided by chenjp.
    (markt)
  * Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
  * Fix: Refactor setting of OCSP configuration defaults as they were only
    applied if the SSL_CONF_CTX was used. While one was always used with
    Tomcat versions aware of the OCSP configuration options, one was not
    always used with Tomcat versions unaware of the OCSP configuration
    options leading to OCSP verification being enabled by default when the
    expected behaviour was disabled by default. (markt)
  * Code: Improve performance for the rare case of handling large OCSP
    responses. (markt)
  1.3.5
  * Fix: Remove group write permissions from the files in the tar.gz
    source archive. (markt)
  * Fix: Clear an additional error in OCSP processing that was preventing
    OCSP soft fail working with Tomcat's APR/native connector. (markt)
  1.3.4
  * Fix: Correct logic error that prevented the configuration of TLS 1.3
    cipher suites. (markt)
  1.3.3
  * Fix: Refactor the addition of TLS 1.3 cipher suite configuration to
    avoid a regression when running a version of Tomcat that pre-dates
    this change. (markt)
  1.3.2
  * Update: Rename configure.in to modern autotools style configure.ac.
    (rjung)
  * Update: Fix incomplete updates for autotools generated files during
    "buildconf" execution. (rjung)
  * Update: Improve quoting in tcnative.m4. (rjung)
  * Update: Update the minimum version of autoconf for releasing to 2.68.
    (rjung)
  * Fix: Fix the autoconf warnings when creating a release. (markt)
  * Update: The Windows binaries are now built with OCSP support enabled
    by default. (markt)
  * Add: Include a nonce with OCSP requests and check the nonce, if any,
    in the OCSP response. (markt)
  * Add: Expand verification of OCSP responses. (markt)
  * Add: Add the ability to configure the OCSP checks to soft-fail - i.e.
    if the responder cannot be contacted or fails to respond in a timely
    manner the OCSP check will not fail. (markt)
  * Add: Add a configurable timeout to the writing of OCSP requests and
    reading of OCSP responses. (markt)
  * Add: Add the ability to control the OCSP verification flags. (markt)
  * Add: Configure TLS 1.3 connections from the provided ciphers list as
    well as connections using TLS 1.2 and earlier. Pull request provided
    by gastush. (markt)
  * Update: Update the Windows build environment to use Visual Studio
    2022. (markt)
  1.3.1
  * Fix: Fix a crash on Windows when SSLContext.setCACertificate() is
    invoked with a null value for caCertificateFile and a non-null value
    for caCertificatePath until properly addressed with
    https://github.com/openssl/openssl/issues/24416. (michaelo)
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant. (schultz)
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings. (schultz)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.14.
    (markt)
  1.3.0
  * Update: Drop useless compile.optimize option. (michaelo)
  * Update: Align Java source compile configuration with Tomcat.
    (michaelo)
  * Fix: Fix version set in DLL header on Windows. (michaelo)
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c. (michaelo)
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to 3.5.2.
    (markt)
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019. (markt)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.13.
    (markt)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Update to 1.3.8
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication when Tomcat is configured
    with a trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
</package>
<package pkgid="11c23aab37c3f267d1fd8a85b0d95f878c6a32004c00ce35eb6f7f209d313a9a55094d2b7389ae6d4bb9b0b30b19f5ddae6d48075cd92b518bd3f017980efae4" name="libtcnative-1-0-devel" arch="i586">
  <version epoch="0" ver="1.3.8" rel="14.9"/>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1676376000">- Version update to version 1.2.36:
  * Update the recommended minimum version of APR to 1.7.2.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1t.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1687867200">- Version update to version 1.2.37:
  * Update: Update the recommended minimum version of APR to 1.7.4.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1u.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1692705600">- Version update to version 1.2.38:
  * Update: Align default pass phrase prompt with HTTPd.
  * Fix: 66669: Fix memory leak in SNI processing.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1v.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1696680000">- Version update to version 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates from
    unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to 3.0.11.</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1699963200">- Version update to version 1.2.38:
  * Align default pass phrase prompt with HTTPd.
  * #66669: Fix memory leak in SNI processing.
  * Update the recommended minimum version of OpenSSL to 1.1.1v.
  * Update the recommended minimum version of APR to 1.7.4.
  * Document the TLS rengotiation behaviour.
  * Add HOWTO-RELEASE.txt that describes the release process.
  * Refactor library initialization so it is compatible with Tomcat
    10.1.x onwards where a number of Java classes have been removed.
  * Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to
    allow clients to determine if the FIPS provider is being used
    when Tomcat Native is compiled against OpenSSL 3.x.
  * #66035: Fix crash when attempting to read TLS session ID after
    a handshake failure.
  * Enable download_deps.sh to be called from any directory.
  * Fix release script so it works with the current git layout.
  * #65441: Correct previous fix that enabled building to continue
    with OpenSSL 3.x.
  * #65659: Remove remaining reference to pkg-config which is no
    longer included in the Tomcat Native distribution.
  * #65181: Additional changes required to provided support for
    using OpenSSL Engines that use proprietary key formats.
  * #65329: Correct handling of WINVER in make file to use correct
    constant for Windows 7. Add constants for Windows 8, Windows 8.1
    and Windows 10. Rename WINNT to WIN2k as it is used for Windows
    2000 upwards, not Windows NT upwards.
  * Add a patch for APR that fixes an issue where some Windows
    systems in some configurations would only listen on IPv6
    addresses on dual stack systems even though configured to listen
    on both IPv6 and IPv4 addresses.
  * Correct a regression in the fix for 65181 that prevented an
    error message from being displayed if an invalid key file was
    provided and no OpenSSL Engine was configured.
  * #65181: Improve support for using OpenSSL Engines that use
    proprietary key formats.
  * Enable building to continue against OpenSSL 3.x and 1.1.1.
  * Incomplete name mangling fix for C++ compilers in tcn_api.h.
  * Improve OS-specific header include for native thread id.
  * Disable keylog callback support for LibreSSL.
  * Add support for SSLContext.addChainCertificateRaw() with
    LibreSSL 2.9.1 and up.
  * Add support for HP-UX's _lwp_self() in our ssl_thread_id(void).
  * Remove default option passed for rpath to linker on HP-UX.
  * Add an option to allow the OCSP responder check to be bypassed.
    Note that if OCSP is enabled, a missing responder is now treated
    as an error.
  * #64429: Fix compilation with LibreSSL.
  * #63671: libtcnative does not compile with OpenSSL &lt; 1.1.0 and
    APR w/o threading support.
  * Correct configure message for OpenSSL libdir.
  * #64260: Clean up install target.
  * #64315: configure output for OpenSSL wrong/incomplete sometimes.
  * Drop obsolete build time workarounds for HP-UX.
  * Add support for FreeBSD's pthread_getthreadid_np() in our
    ssl_thread_id(void).
  * #64316: Introduce tcn_get_thread_id(void) to reduce code
    duplication.
  * Fix linking against OpenSSL in non-standard locations on FreeBSD.
- Removed patch:
  * libtcnative-1-0-bsc1199170.patch
    + fix integrated</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1707825600">- Update to 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates
    from unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to
    3.0.11.
  * Change the hardcoded libopenssl-1_1-devel to libopenssl-devel
    for distributions that have the right version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1707825601">- Update to 1.3.0:
  * Update: Drop useless compile.optimize option.
  * Update: Align Java source compile configuration with Tomcat.
  * Fix: Fix version set in DLL header on Windows
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c.
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to
    3.5.2.
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1721822400">- Update to 1.3.1
  * Fix a crash on Windows when SSLContext.setCACertificate() is invoked
    with a null value for caCertificateFile and a non-null value for
    caCertificatePath
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant.
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings.
  * The windows binaries in this release have been built with OpenSSL
    3.0.14</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1727611200">- Fix build after removal of the default %%{java_home} define</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1774440000">- Update to 1.3.7: [bsc#1260322]
  1.3.7
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)
  1.3.6
  * Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL and
    SSL_CTX clean-up. (markt)
  * Fix: Fix unnecessarily large buffer allocation when filtering out NULL
    and export ciphers. Pull requests #35 and #37 provided by chenjp.
    (markt)
  * Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
  * Fix: Refactor setting of OCSP configuration defaults as they were only
    applied if the SSL_CONF_CTX was used. While one was always used with
    Tomcat versions aware of the OCSP configuration options, one was not
    always used with Tomcat versions unaware of the OCSP configuration
    options leading to OCSP verification being enabled by default when the
    expected behaviour was disabled by default. (markt)
  * Code: Improve performance for the rare case of handling large OCSP
    responses. (markt)
  1.3.5
  * Fix: Remove group write permissions from the files in the tar.gz
    source archive. (markt)
  * Fix: Clear an additional error in OCSP processing that was preventing
    OCSP soft fail working with Tomcat's APR/native connector. (markt)
  1.3.4
  * Fix: Correct logic error that prevented the configuration of TLS 1.3
    cipher suites. (markt)
  1.3.3
  * Fix: Refactor the addition of TLS 1.3 cipher suite configuration to
    avoid a regression when running a version of Tomcat that pre-dates
    this change. (markt)
  1.3.2
  * Update: Rename configure.in to modern autotools style configure.ac.
    (rjung)
  * Update: Fix incomplete updates for autotools generated files during
    "buildconf" execution. (rjung)
  * Update: Improve quoting in tcnative.m4. (rjung)
  * Update: Update the minimum version of autoconf for releasing to 2.68.
    (rjung)
  * Fix: Fix the autoconf warnings when creating a release. (markt)
  * Update: The Windows binaries are now built with OCSP support enabled
    by default. (markt)
  * Add: Include a nonce with OCSP requests and check the nonce, if any,
    in the OCSP response. (markt)
  * Add: Expand verification of OCSP responses. (markt)
  * Add: Add the ability to configure the OCSP checks to soft-fail - i.e.
    if the responder cannot be contacted or fails to respond in a timely
    manner the OCSP check will not fail. (markt)
  * Add: Add a configurable timeout to the writing of OCSP requests and
    reading of OCSP responses. (markt)
  * Add: Add the ability to control the OCSP verification flags. (markt)
  * Add: Configure TLS 1.3 connections from the provided ciphers list as
    well as connections using TLS 1.2 and earlier. Pull request provided
    by gastush. (markt)
  * Update: Update the Windows build environment to use Visual Studio
    2022. (markt)
  1.3.1
  * Fix: Fix a crash on Windows when SSLContext.setCACertificate() is
    invoked with a null value for caCertificateFile and a non-null value
    for caCertificatePath until properly addressed with
    https://github.com/openssl/openssl/issues/24416. (michaelo)
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant. (schultz)
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings. (schultz)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.14.
    (markt)
  1.3.0
  * Update: Drop useless compile.optimize option. (michaelo)
  * Update: Align Java source compile configuration with Tomcat.
    (michaelo)
  * Fix: Fix version set in DLL header on Windows. (michaelo)
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c. (michaelo)
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to 3.5.2.
    (markt)
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019. (markt)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.13.
    (markt)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Update to 1.3.8
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication when Tomcat is configured
    with a trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
</package>
<package pkgid="fc419253827c1ad932614dc6971b7d4b49daedd70e9283a07f9c0ce20ab5c1f0054e00145259b668068dd1a0ce33022e40db5820c1741f81f9d46a8bee61c00b" name="libtcnative-1-0-devel" arch="x86_64">
  <version epoch="0" ver="1.3.8" rel="14.9"/>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1676376000">- Version update to version 1.2.36:
  * Update the recommended minimum version of APR to 1.7.2.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1t.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1687867200">- Version update to version 1.2.37:
  * Update: Update the recommended minimum version of APR to 1.7.4.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1u.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1692705600">- Version update to version 1.2.38:
  * Update: Align default pass phrase prompt with HTTPd.
  * Fix: 66669: Fix memory leak in SNI processing.
  * Update: Update the recommended minimum version of OpenSSL to 1.1.1v.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1696680000">- Version update to version 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates from
    unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to 3.0.11.</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1699963200">- Version update to version 1.2.38:
  * Align default pass phrase prompt with HTTPd.
  * #66669: Fix memory leak in SNI processing.
  * Update the recommended minimum version of OpenSSL to 1.1.1v.
  * Update the recommended minimum version of APR to 1.7.4.
  * Document the TLS rengotiation behaviour.
  * Add HOWTO-RELEASE.txt that describes the release process.
  * Refactor library initialization so it is compatible with Tomcat
    10.1.x onwards where a number of Java classes have been removed.
  * Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to
    allow clients to determine if the FIPS provider is being used
    when Tomcat Native is compiled against OpenSSL 3.x.
  * #66035: Fix crash when attempting to read TLS session ID after
    a handshake failure.
  * Enable download_deps.sh to be called from any directory.
  * Fix release script so it works with the current git layout.
  * #65441: Correct previous fix that enabled building to continue
    with OpenSSL 3.x.
  * #65659: Remove remaining reference to pkg-config which is no
    longer included in the Tomcat Native distribution.
  * #65181: Additional changes required to provided support for
    using OpenSSL Engines that use proprietary key formats.
  * #65329: Correct handling of WINVER in make file to use correct
    constant for Windows 7. Add constants for Windows 8, Windows 8.1
    and Windows 10. Rename WINNT to WIN2k as it is used for Windows
    2000 upwards, not Windows NT upwards.
  * Add a patch for APR that fixes an issue where some Windows
    systems in some configurations would only listen on IPv6
    addresses on dual stack systems even though configured to listen
    on both IPv6 and IPv4 addresses.
  * Correct a regression in the fix for 65181 that prevented an
    error message from being displayed if an invalid key file was
    provided and no OpenSSL Engine was configured.
  * #65181: Improve support for using OpenSSL Engines that use
    proprietary key formats.
  * Enable building to continue against OpenSSL 3.x and 1.1.1.
  * Incomplete name mangling fix for C++ compilers in tcn_api.h.
  * Improve OS-specific header include for native thread id.
  * Disable keylog callback support for LibreSSL.
  * Add support for SSLContext.addChainCertificateRaw() with
    LibreSSL 2.9.1 and up.
  * Add support for HP-UX's _lwp_self() in our ssl_thread_id(void).
  * Remove default option passed for rpath to linker on HP-UX.
  * Add an option to allow the OCSP responder check to be bypassed.
    Note that if OCSP is enabled, a missing responder is now treated
    as an error.
  * #64429: Fix compilation with LibreSSL.
  * #63671: libtcnative does not compile with OpenSSL &lt; 1.1.0 and
    APR w/o threading support.
  * Correct configure message for OpenSSL libdir.
  * #64260: Clean up install target.
  * #64315: configure output for OpenSSL wrong/incomplete sometimes.
  * Drop obsolete build time workarounds for HP-UX.
  * Add support for FreeBSD's pthread_getthreadid_np() in our
    ssl_thread_id(void).
  * #64316: Introduce tcn_get_thread_id(void) to reduce code
    duplication.
  * Fix linking against OpenSSL in non-standard locations on FreeBSD.
- Removed patch:
  * libtcnative-1-0-bsc1199170.patch
    + fix integrated</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1707825600">- Update to 1.2.39:
  * Fix: 67061: If the insecure optionalNoCA certificate verification
    mode is used, disable OCSP if enabled else client certificates
    from unknown certificate authorities will be rejected.
  * Update: Update the recommended minimum version of OpenSSL to
    3.0.11.
  * Change the hardcoded libopenssl-1_1-devel to libopenssl-devel
    for distributions that have the right version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1707825601">- Update to 1.3.0:
  * Update: Drop useless compile.optimize option.
  * Update: Align Java source compile configuration with Tomcat.
  * Fix: Fix version set in DLL header on Windows
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c.
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to
    3.5.2.
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019.</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1721822400">- Update to 1.3.1
  * Fix a crash on Windows when SSLContext.setCACertificate() is invoked
    with a null value for caCertificateFile and a non-null value for
    caCertificatePath
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant.
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings.
  * The windows binaries in this release have been built with OpenSSL
    3.0.14</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1727611200">- Fix build after removal of the default %%{java_home} define</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1774440000">- Update to 1.3.7: [bsc#1260322]
  1.3.7
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)
  1.3.6
  * Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL and
    SSL_CTX clean-up. (markt)
  * Fix: Fix unnecessarily large buffer allocation when filtering out NULL
    and export ciphers. Pull requests #35 and #37 provided by chenjp.
    (markt)
  * Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
  * Fix: Refactor setting of OCSP configuration defaults as they were only
    applied if the SSL_CONF_CTX was used. While one was always used with
    Tomcat versions aware of the OCSP configuration options, one was not
    always used with Tomcat versions unaware of the OCSP configuration
    options leading to OCSP verification being enabled by default when the
    expected behaviour was disabled by default. (markt)
  * Code: Improve performance for the rare case of handling large OCSP
    responses. (markt)
  1.3.5
  * Fix: Remove group write permissions from the files in the tar.gz
    source archive. (markt)
  * Fix: Clear an additional error in OCSP processing that was preventing
    OCSP soft fail working with Tomcat's APR/native connector. (markt)
  1.3.4
  * Fix: Correct logic error that prevented the configuration of TLS 1.3
    cipher suites. (markt)
  1.3.3
  * Fix: Refactor the addition of TLS 1.3 cipher suite configuration to
    avoid a regression when running a version of Tomcat that pre-dates
    this change. (markt)
  1.3.2
  * Update: Rename configure.in to modern autotools style configure.ac.
    (rjung)
  * Update: Fix incomplete updates for autotools generated files during
    "buildconf" execution. (rjung)
  * Update: Improve quoting in tcnative.m4. (rjung)
  * Update: Update the minimum version of autoconf for releasing to 2.68.
    (rjung)
  * Fix: Fix the autoconf warnings when creating a release. (markt)
  * Update: The Windows binaries are now built with OCSP support enabled
    by default. (markt)
  * Add: Include a nonce with OCSP requests and check the nonce, if any,
    in the OCSP response. (markt)
  * Add: Expand verification of OCSP responses. (markt)
  * Add: Add the ability to configure the OCSP checks to soft-fail - i.e.
    if the responder cannot be contacted or fails to respond in a timely
    manner the OCSP check will not fail. (markt)
  * Add: Add a configurable timeout to the writing of OCSP requests and
    reading of OCSP responses. (markt)
  * Add: Add the ability to control the OCSP verification flags. (markt)
  * Add: Configure TLS 1.3 connections from the provided ciphers list as
    well as connections using TLS 1.2 and earlier. Pull request provided
    by gastush. (markt)
  * Update: Update the Windows build environment to use Visual Studio
    2022. (markt)
  1.3.1
  * Fix: Fix a crash on Windows when SSLContext.setCACertificate() is
    invoked with a null value for caCertificateFile and a non-null value
    for caCertificatePath until properly addressed with
    https://github.com/openssl/openssl/issues/24416. (michaelo)
  * Add: Use ERR_error_string_n with a definite buffer length as a named
    constant. (schultz)
  * Add: Ensure local reference capacity is available when creating new
    arrays and Strings. (schultz)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.14.
    (markt)
  1.3.0
  * Update: Drop useless compile.optimize option. (michaelo)
  * Update: Align Java source compile configuration with Tomcat.
    (michaelo)
  * Fix: Fix version set in DLL header on Windows. (michaelo)
  * Update: Remove an unreachable if condition around CRLs in
    sslcontext.c. (michaelo)
  * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
    the default verify paths are no longer set. Only the explicitly
    configured trust store, if any, will be used. (michaelo)
  * Update: Update the minimum supported version of LibreSSL to 3.5.2.
    (markt)
  * Design: Remove NPN support as NPN was never standardised and browser
    support was removed in 2019. (markt)
  * Update: Update the recommended minimum version of OpenSSL to 3.0.13.
    (markt)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Update to 1.3.8
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication when Tomcat is configured
    with a trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
</package>
<package pkgid="9f06a5bf4673c0383ebf64da816df162f1f4e7d80b26de1e4eee6ae6bea9a4105d4807aff1396a075084755ddb4c69c9e95f88dc1801131e728483ff52b7821f" name="libtcnative-2-0" arch="aarch64">
  <version epoch="0" ver="2.0.15" rel="4.10"/>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770292800">- The first release in SUSE (2.0.12)
  * fix of enhancenment request (bsc#1232390)</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770638400">- Add conflict to previous devel version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1775217600">- Update to Tomcat Native 2.0.14
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1775563200">- Upgrade to version 2.0.14
  * Changes of 2.0.14
    + Code: Refactor access to ASN1_OCTET_STRING to use setters to
    fix errors when building against the latest OpenSSL 4.0.x code
    + Fix: Fix the handling of OCSP requests with multiple responder
    URIs
    + Fix: Fix the handling of TRY_AGAIN responses to OCSP requests
    when soft fail is disabled.
  * Changes of 2.0.13
    + Code: Due to various refactorings, the 2.0.x code no longer
    compiles with LibreSSL. Without a volunteer to maintain
    LibreSSL support, the LibreSSL code will be removed no earlier
    than 30 September 2026
    + Fix: Remove group write permissions from the files in the
    tar.gz source archive
    + Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL
    and SSL_CTX clean-up
    + Fix: Fix unnecessarily large buffer allocation when filtering
    out NULL and export ciphers. Pull requests #35 and #37
    provided by chenjp
    + Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
    + Fix: Refactor setting of OCSP configuration defaults as they
    were only applied if the SSL_CONF_CTX was used. While one was
    always used with Tomcat versions aware of the OCSP
    configuration options, one was not always used with Tomcat
    versions unaware of the OCSP configuration options leading to
    OCSP verification being enabled by default when the expected
    behaviour was disabled by default
    + Code: Improve performance for the rare case of handling large
    OCSP responses
    + Fix: 69939: Fix the cause of a crash with OpenSSL 3.0.x when a
    certificate PEM file does not contain explicit DH parameters
    + Fix: Refactor extraction of ECDH curve name from the
    Certificate to avoid deprecated OpenSSL methods.
    + Fix: Refactor the native implementation of SSL.getTime() to
    avoid the Y2038 problem in SSL_SESSION_get_time() when running
    on a version of OpenSSL that includes the new
    SSL_SESSION_get_time_ex() method.
- Build against libopenssl-3-devel and not against the meta-package
  libopenssl-devel. This allows buiding on distributions where the
  openssl-3 exists, but is not default
- Added patch:
  * apr163.patch
    + Allow building and running against libapr-1 1.6.3</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Upgrade to version 2.0.15
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication Tomcat is configured with a
    trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1781611201">- Upgrade to version 2.0.15
  * Changes of 2.0.15
    + Fix a memory leak when parsing certificates. Pull request #44
    provided by chenjp.
    + Fix two potential memory leaks on error paths identified by
    Copilot.
    + Fix: 69988: Fix post handshake authentication Tomcat is
    configured with a trust store using JSSE style configuration.
    + Fix: 70102: Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys.</changelog>
</package>
<package pkgid="f4c7c9743a62c7d05c0dc0f8ad3bed9a2b4211649b9ba84331114082e5847d1f899078926afef64b498216ebda2dc7f4ab3e65400349c582ce4050e06c8a9df2" name="libtcnative-2-0" arch="i586">
  <version epoch="0" ver="2.0.15" rel="4.10"/>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770292800">- The first release in SUSE (2.0.12)
  * fix of enhancenment request (bsc#1232390)</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770638400">- Add conflict to previous devel version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1775217600">- Update to Tomcat Native 2.0.14
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1775563200">- Upgrade to version 2.0.14
  * Changes of 2.0.14
    + Code: Refactor access to ASN1_OCTET_STRING to use setters to
    fix errors when building against the latest OpenSSL 4.0.x code
    + Fix: Fix the handling of OCSP requests with multiple responder
    URIs
    + Fix: Fix the handling of TRY_AGAIN responses to OCSP requests
    when soft fail is disabled.
  * Changes of 2.0.13
    + Code: Due to various refactorings, the 2.0.x code no longer
    compiles with LibreSSL. Without a volunteer to maintain
    LibreSSL support, the LibreSSL code will be removed no earlier
    than 30 September 2026
    + Fix: Remove group write permissions from the files in the
    tar.gz source archive
    + Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL
    and SSL_CTX clean-up
    + Fix: Fix unnecessarily large buffer allocation when filtering
    out NULL and export ciphers. Pull requests #35 and #37
    provided by chenjp
    + Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
    + Fix: Refactor setting of OCSP configuration defaults as they
    were only applied if the SSL_CONF_CTX was used. While one was
    always used with Tomcat versions aware of the OCSP
    configuration options, one was not always used with Tomcat
    versions unaware of the OCSP configuration options leading to
    OCSP verification being enabled by default when the expected
    behaviour was disabled by default
    + Code: Improve performance for the rare case of handling large
    OCSP responses
    + Fix: 69939: Fix the cause of a crash with OpenSSL 3.0.x when a
    certificate PEM file does not contain explicit DH parameters
    + Fix: Refactor extraction of ECDH curve name from the
    Certificate to avoid deprecated OpenSSL methods.
    + Fix: Refactor the native implementation of SSL.getTime() to
    avoid the Y2038 problem in SSL_SESSION_get_time() when running
    on a version of OpenSSL that includes the new
    SSL_SESSION_get_time_ex() method.
- Build against libopenssl-3-devel and not against the meta-package
  libopenssl-devel. This allows buiding on distributions where the
  openssl-3 exists, but is not default
- Added patch:
  * apr163.patch
    + Allow building and running against libapr-1 1.6.3</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Upgrade to version 2.0.15
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication Tomcat is configured with a
    trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1781611201">- Upgrade to version 2.0.15
  * Changes of 2.0.15
    + Fix a memory leak when parsing certificates. Pull request #44
    provided by chenjp.
    + Fix two potential memory leaks on error paths identified by
    Copilot.
    + Fix: 69988: Fix post handshake authentication Tomcat is
    configured with a trust store using JSSE style configuration.
    + Fix: 70102: Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys.</changelog>
</package>
<package pkgid="bc742cfbf8a773e6419dab1e470828e9ef1067f7ed4776e521d82bc50d6f43851c2ec9b1b25143be3930aee444b2344358507b07c56b371f7a4db62d727e50e3" name="libtcnative-2-0" arch="src">
  <version epoch="0" ver="2.0.15" rel="4.10"/>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770292800">- The first release in SUSE (2.0.12)
  * fix of enhancenment request (bsc#1232390)</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770638400">- Add conflict to previous devel version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1775217600">- Update to Tomcat Native 2.0.14
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1775563200">- Upgrade to version 2.0.14
  * Changes of 2.0.14
    + Code: Refactor access to ASN1_OCTET_STRING to use setters to
    fix errors when building against the latest OpenSSL 4.0.x code
    + Fix: Fix the handling of OCSP requests with multiple responder
    URIs
    + Fix: Fix the handling of TRY_AGAIN responses to OCSP requests
    when soft fail is disabled.
  * Changes of 2.0.13
    + Code: Due to various refactorings, the 2.0.x code no longer
    compiles with LibreSSL. Without a volunteer to maintain
    LibreSSL support, the LibreSSL code will be removed no earlier
    than 30 September 2026
    + Fix: Remove group write permissions from the files in the
    tar.gz source archive
    + Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL
    and SSL_CTX clean-up
    + Fix: Fix unnecessarily large buffer allocation when filtering
    out NULL and export ciphers. Pull requests #35 and #37
    provided by chenjp
    + Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
    + Fix: Refactor setting of OCSP configuration defaults as they
    were only applied if the SSL_CONF_CTX was used. While one was
    always used with Tomcat versions aware of the OCSP
    configuration options, one was not always used with Tomcat
    versions unaware of the OCSP configuration options leading to
    OCSP verification being enabled by default when the expected
    behaviour was disabled by default
    + Code: Improve performance for the rare case of handling large
    OCSP responses
    + Fix: 69939: Fix the cause of a crash with OpenSSL 3.0.x when a
    certificate PEM file does not contain explicit DH parameters
    + Fix: Refactor extraction of ECDH curve name from the
    Certificate to avoid deprecated OpenSSL methods.
    + Fix: Refactor the native implementation of SSL.getTime() to
    avoid the Y2038 problem in SSL_SESSION_get_time() when running
    on a version of OpenSSL that includes the new
    SSL_SESSION_get_time_ex() method.
- Build against libopenssl-3-devel and not against the meta-package
  libopenssl-devel. This allows buiding on distributions where the
  openssl-3 exists, but is not default
- Added patch:
  * apr163.patch
    + Allow building and running against libapr-1 1.6.3</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Upgrade to version 2.0.15
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication Tomcat is configured with a
    trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1781611201">- Upgrade to version 2.0.15
  * Changes of 2.0.15
    + Fix a memory leak when parsing certificates. Pull request #44
    provided by chenjp.
    + Fix two potential memory leaks on error paths identified by
    Copilot.
    + Fix: 69988: Fix post handshake authentication Tomcat is
    configured with a trust store using JSSE style configuration.
    + Fix: 70102: Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys.</changelog>
</package>
<package pkgid="011314864790fddcfbc7a038575ee4280a7d4d6520e297f34d78524d575f0d259ed7822ed9bd1e1acd05384bd6704c6d416c93bf5b9737316193483d5de4f0d9" name="libtcnative-2-0" arch="x86_64">
  <version epoch="0" ver="2.0.15" rel="4.10"/>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770292800">- The first release in SUSE (2.0.12)
  * fix of enhancenment request (bsc#1232390)</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770638400">- Add conflict to previous devel version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1775217600">- Update to Tomcat Native 2.0.14
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1775563200">- Upgrade to version 2.0.14
  * Changes of 2.0.14
    + Code: Refactor access to ASN1_OCTET_STRING to use setters to
    fix errors when building against the latest OpenSSL 4.0.x code
    + Fix: Fix the handling of OCSP requests with multiple responder
    URIs
    + Fix: Fix the handling of TRY_AGAIN responses to OCSP requests
    when soft fail is disabled.
  * Changes of 2.0.13
    + Code: Due to various refactorings, the 2.0.x code no longer
    compiles with LibreSSL. Without a volunteer to maintain
    LibreSSL support, the LibreSSL code will be removed no earlier
    than 30 September 2026
    + Fix: Remove group write permissions from the files in the
    tar.gz source archive
    + Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL
    and SSL_CTX clean-up
    + Fix: Fix unnecessarily large buffer allocation when filtering
    out NULL and export ciphers. Pull requests #35 and #37
    provided by chenjp
    + Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
    + Fix: Refactor setting of OCSP configuration defaults as they
    were only applied if the SSL_CONF_CTX was used. While one was
    always used with Tomcat versions aware of the OCSP
    configuration options, one was not always used with Tomcat
    versions unaware of the OCSP configuration options leading to
    OCSP verification being enabled by default when the expected
    behaviour was disabled by default
    + Code: Improve performance for the rare case of handling large
    OCSP responses
    + Fix: 69939: Fix the cause of a crash with OpenSSL 3.0.x when a
    certificate PEM file does not contain explicit DH parameters
    + Fix: Refactor extraction of ECDH curve name from the
    Certificate to avoid deprecated OpenSSL methods.
    + Fix: Refactor the native implementation of SSL.getTime() to
    avoid the Y2038 problem in SSL_SESSION_get_time() when running
    on a version of OpenSSL that includes the new
    SSL_SESSION_get_time_ex() method.
- Build against libopenssl-3-devel and not against the meta-package
  libopenssl-devel. This allows buiding on distributions where the
  openssl-3 exists, but is not default
- Added patch:
  * apr163.patch
    + Allow building and running against libapr-1 1.6.3</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Upgrade to version 2.0.15
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication Tomcat is configured with a
    trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1781611201">- Upgrade to version 2.0.15
  * Changes of 2.0.15
    + Fix a memory leak when parsing certificates. Pull request #44
    provided by chenjp.
    + Fix two potential memory leaks on error paths identified by
    Copilot.
    + Fix: 69988: Fix post handshake authentication Tomcat is
    configured with a trust store using JSSE style configuration.
    + Fix: 70102: Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys.</changelog>
</package>
<package pkgid="d0223273c6001ab89db416cf9e05b1e5325a140dc2da00b0d61fa1900eda09ec2c0c9cd4a77a427c4cf2b8ad907a4916fa83d0746bca30fcc47a5147ace1dc52" name="libtcnative-2-0-devel" arch="aarch64">
  <version epoch="0" ver="2.0.15" rel="4.10"/>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770292800">- The first release in SUSE (2.0.12)
  * fix of enhancenment request (bsc#1232390)</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770638400">- Add conflict to previous devel version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1775217600">- Update to Tomcat Native 2.0.14
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1775563200">- Upgrade to version 2.0.14
  * Changes of 2.0.14
    + Code: Refactor access to ASN1_OCTET_STRING to use setters to
    fix errors when building against the latest OpenSSL 4.0.x code
    + Fix: Fix the handling of OCSP requests with multiple responder
    URIs
    + Fix: Fix the handling of TRY_AGAIN responses to OCSP requests
    when soft fail is disabled.
  * Changes of 2.0.13
    + Code: Due to various refactorings, the 2.0.x code no longer
    compiles with LibreSSL. Without a volunteer to maintain
    LibreSSL support, the LibreSSL code will be removed no earlier
    than 30 September 2026
    + Fix: Remove group write permissions from the files in the
    tar.gz source archive
    + Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL
    and SSL_CTX clean-up
    + Fix: Fix unnecessarily large buffer allocation when filtering
    out NULL and export ciphers. Pull requests #35 and #37
    provided by chenjp
    + Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
    + Fix: Refactor setting of OCSP configuration defaults as they
    were only applied if the SSL_CONF_CTX was used. While one was
    always used with Tomcat versions aware of the OCSP
    configuration options, one was not always used with Tomcat
    versions unaware of the OCSP configuration options leading to
    OCSP verification being enabled by default when the expected
    behaviour was disabled by default
    + Code: Improve performance for the rare case of handling large
    OCSP responses
    + Fix: 69939: Fix the cause of a crash with OpenSSL 3.0.x when a
    certificate PEM file does not contain explicit DH parameters
    + Fix: Refactor extraction of ECDH curve name from the
    Certificate to avoid deprecated OpenSSL methods.
    + Fix: Refactor the native implementation of SSL.getTime() to
    avoid the Y2038 problem in SSL_SESSION_get_time() when running
    on a version of OpenSSL that includes the new
    SSL_SESSION_get_time_ex() method.
- Build against libopenssl-3-devel and not against the meta-package
  libopenssl-devel. This allows buiding on distributions where the
  openssl-3 exists, but is not default
- Added patch:
  * apr163.patch
    + Allow building and running against libapr-1 1.6.3</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Upgrade to version 2.0.15
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication Tomcat is configured with a
    trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1781611201">- Upgrade to version 2.0.15
  * Changes of 2.0.15
    + Fix a memory leak when parsing certificates. Pull request #44
    provided by chenjp.
    + Fix two potential memory leaks on error paths identified by
    Copilot.
    + Fix: 69988: Fix post handshake authentication Tomcat is
    configured with a trust store using JSSE style configuration.
    + Fix: 70102: Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys.</changelog>
</package>
<package pkgid="74ffc0317c2b94da1c46e7191b1bc870387ad3a45ce87ed7890e66508ddc1493adbd40def0fe4273e30864df800b095b33b2e9b876556f74f5da38198408ae16" name="libtcnative-2-0-devel" arch="i586">
  <version epoch="0" ver="2.0.15" rel="4.10"/>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770292800">- The first release in SUSE (2.0.12)
  * fix of enhancenment request (bsc#1232390)</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770638400">- Add conflict to previous devel version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1775217600">- Update to Tomcat Native 2.0.14
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1775563200">- Upgrade to version 2.0.14
  * Changes of 2.0.14
    + Code: Refactor access to ASN1_OCTET_STRING to use setters to
    fix errors when building against the latest OpenSSL 4.0.x code
    + Fix: Fix the handling of OCSP requests with multiple responder
    URIs
    + Fix: Fix the handling of TRY_AGAIN responses to OCSP requests
    when soft fail is disabled.
  * Changes of 2.0.13
    + Code: Due to various refactorings, the 2.0.x code no longer
    compiles with LibreSSL. Without a volunteer to maintain
    LibreSSL support, the LibreSSL code will be removed no earlier
    than 30 September 2026
    + Fix: Remove group write permissions from the files in the
    tar.gz source archive
    + Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL
    and SSL_CTX clean-up
    + Fix: Fix unnecessarily large buffer allocation when filtering
    out NULL and export ciphers. Pull requests #35 and #37
    provided by chenjp
    + Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
    + Fix: Refactor setting of OCSP configuration defaults as they
    were only applied if the SSL_CONF_CTX was used. While one was
    always used with Tomcat versions aware of the OCSP
    configuration options, one was not always used with Tomcat
    versions unaware of the OCSP configuration options leading to
    OCSP verification being enabled by default when the expected
    behaviour was disabled by default
    + Code: Improve performance for the rare case of handling large
    OCSP responses
    + Fix: 69939: Fix the cause of a crash with OpenSSL 3.0.x when a
    certificate PEM file does not contain explicit DH parameters
    + Fix: Refactor extraction of ECDH curve name from the
    Certificate to avoid deprecated OpenSSL methods.
    + Fix: Refactor the native implementation of SSL.getTime() to
    avoid the Y2038 problem in SSL_SESSION_get_time() when running
    on a version of OpenSSL that includes the new
    SSL_SESSION_get_time_ex() method.
- Build against libopenssl-3-devel and not against the meta-package
  libopenssl-devel. This allows buiding on distributions where the
  openssl-3 exists, but is not default
- Added patch:
  * apr163.patch
    + Allow building and running against libapr-1 1.6.3</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Upgrade to version 2.0.15
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication Tomcat is configured with a
    trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1781611201">- Upgrade to version 2.0.15
  * Changes of 2.0.15
    + Fix a memory leak when parsing certificates. Pull request #44
    provided by chenjp.
    + Fix two potential memory leaks on error paths identified by
    Copilot.
    + Fix: 69988: Fix post handshake authentication Tomcat is
    configured with a trust store using JSSE style configuration.
    + Fix: 70102: Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys.</changelog>
</package>
<package pkgid="f31e3d7227e6591e9f26c00fd6ff9a442d0a20fc8c01de8bd7529c643695c698b2195f28722174e9b1b84231e733759022decfad857837ff42f5aabb9aff23d9" name="libtcnative-2-0-devel" arch="x86_64">
  <version epoch="0" ver="2.0.15" rel="4.10"/>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770292800">- The first release in SUSE (2.0.12)
  * fix of enhancenment request (bsc#1232390)</changelog>
  <changelog author="Michele Bussolotto &lt;michele.bussolotto@suse.com&gt;" date="1770638400">- Add conflict to previous devel version</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1775217600">- Update to Tomcat Native 2.0.14
  * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
    errors when building against the latest OpenSSL 4.0.x code. (markt)
  * Fix: Fix the handling of OCSP requests with multiple responder URIs.
    (jfclere)
  * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
    soft fail is disabled. (jfclere)</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1775563200">- Upgrade to version 2.0.14
  * Changes of 2.0.14
    + Code: Refactor access to ASN1_OCTET_STRING to use setters to
    fix errors when building against the latest OpenSSL 4.0.x code
    + Fix: Fix the handling of OCSP requests with multiple responder
    URIs
    + Fix: Fix the handling of TRY_AGAIN responses to OCSP requests
    when soft fail is disabled.
  * Changes of 2.0.13
    + Code: Due to various refactorings, the 2.0.x code no longer
    compiles with LibreSSL. Without a volunteer to maintain
    LibreSSL support, the LibreSSL code will be removed no earlier
    than 30 September 2026
    + Fix: Remove group write permissions from the files in the
    tar.gz source archive
    + Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL
    and SSL_CTX clean-up
    + Fix: Fix unnecessarily large buffer allocation when filtering
    out NULL and export ciphers. Pull requests #35 and #37
    provided by chenjp
    + Fix: Fix a potential memory leak if an invalid OpenSSLConf is
    provided. Pull request #36 provided by chenjp. (markt)
    + Fix: Refactor setting of OCSP configuration defaults as they
    were only applied if the SSL_CONF_CTX was used. While one was
    always used with Tomcat versions aware of the OCSP
    configuration options, one was not always used with Tomcat
    versions unaware of the OCSP configuration options leading to
    OCSP verification being enabled by default when the expected
    behaviour was disabled by default
    + Code: Improve performance for the rare case of handling large
    OCSP responses
    + Fix: 69939: Fix the cause of a crash with OpenSSL 3.0.x when a
    certificate PEM file does not contain explicit DH parameters
    + Fix: Refactor extraction of ECDH curve name from the
    Certificate to avoid deprecated OpenSSL methods.
    + Fix: Refactor the native implementation of SSL.getTime() to
    avoid the Y2038 problem in SSL_SESSION_get_time() when running
    on a version of OpenSSL that includes the new
    SSL_SESSION_get_time_ex() method.
- Build against libopenssl-3-devel and not against the meta-package
  libopenssl-devel. This allows buiding on distributions where the
  openssl-3 exists, but is not default
- Added patch:
  * apr163.patch
    + Allow building and running against libapr-1 1.6.3</changelog>
  <changelog author="Fridrich Strba &lt;fstrba@suse.com&gt;" date="1781611200">- Upgrade to version 2.0.15
  * Changes
    + Fix a memory leak when parsing certificates
    + Fix two potential memory leaks on error paths identified by
    Copilot
    + Fix post handshake authentication Tomcat is configured with a
    trust store using JSSE style configuration
    + Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys</changelog>
  <changelog author="Bj&#xF6;rn Voigt &lt;bjoernv@arcor.de&gt;" date="1781611201">- Upgrade to version 2.0.15
  * Changes of 2.0.15
    + Fix a memory leak when parsing certificates. Pull request #44
    provided by chenjp.
    + Fix two potential memory leaks on error paths identified by
    Copilot.
    + Fix: 69988: Fix post handshake authentication Tomcat is
    configured with a trust store using JSSE style configuration.
    + Fix: 70102: Correct expected size of tickets when calling
    SSLContext.setSessionTicketKeys.</changelog>
</package>
</otherdata>