Maintainer Paul Wolneykien in the sisyphus branch: Information

- Switch to bash5 (closes: 58516).
- Added --log-stderr to the synopsis in integrity-applier(8).
- Require qt6-declarative and remove libqt6-* from runtime dependencies
  (closes: 50671).
- ima_appraise control: Don't change 'lsm' command-line option if
  'selinux' option is present (thx IVK).
- An improved signal handling based on a shared handler.
- Fixed signal handling.
- Updated project URL.
- Fix: Own /usr/libexec/clickhouse-audit-export.
- Fix: Make clickhouse-audit-utils package noarch.
- Make auditd-plugin-clickhouse-lite support -V for version info.
- Fix: Output raw audit data in 'TabSeparatedRaw' format to prevent
  extra backslash escaping.
- Make clickhouse-audit-export use the new export scripts.
- Export raw audit records by subset of record IDs.
- Fixed build without dbtest.
- FIX: Filter by UID in all queries!
- Partition all the tables by start of month.
- Limit the process timeframe to 5 days.
- Added 'build_info(start_id=ID)' parametrized view.
- Added 'process_tree(start_id=ID)' parametrized view.
- Index 'process_parts' by PID.
- Minimize Boost dependencies.
- Don't use FINAL in queries: aggregate the data in-query.
- Fix: Do not count unsuccessful rpmbuild spawns.
- Divide views and tables onto three separated groups:
  1. the main AuditDataRaw table;
  2. the pstree tables and views;
  3. the rpmbuild tables and views.
- Refactor rpmbuild index: include target, package name and version
  and place into 'package_build_index' table.
- Add captions for Help and Accessibility buttons.
- Toggle screen reader using Ctrl+R keystroke.
- Added installer-a11yctl CLI util to control the accessibility
  components.
- Run the screen reader if specified in the kernel command line
  (use a11y=reader option for that).
- Adjust the ALSA configuration when starting the screen reader.
- Added the accessibility backend and popup.
- Added the "Accessibility options" button.
- Extract the 'binpacking' utility into the separate package.
- Require Python3 >= 3.10.
- Version 2.0.0 (initial build for Sisyphus).
- Select PHP version using %php_defver macro.
- Select PHP version using %php_defver macro.
- Select PHP version using %php_defver macro.
- Fix: Don't mask the exit status of icingacli setup.
- Select PHP version using %php_defver macro.
- Select PHP version using %php_defver macro.
- Make data processing independent of the current locale
  (Fixes: OVE-20251218-0001).
- Fixed sum_files.sh: Skip find in the case of an empty $INCLUDE.
- Untabify all help pages.
- checksumbot: Added --cb option to override CHKSUMBRANCH
  configuration option.
- checksumgen: Fixed shellcheck SC2317.
- checksumbot: Include checksumdiff report in the output.
- checksumbot: Include RPM names diff in the output.
- checksumbot: Added configuration option to include RPM package
  lists into the checksum repository.
- Added option to send checksumdiff statistic report to a file.
- Make checksumdiff report statistics in verbose mode.
- Make checksumdiff check the total record counters.
- checksumdiff: Verify per-task checksum files using one-line
  checksum views.
- Always replace per-task *.chksum files when checksumdiff.
- Make checksummerge support inplace file update.
- Note, that v0.3.0-alt1 fixes missing checksum data for *.ko.zst files
  by including *.ko.zst by default (Fixes: OVE-20251204-0001).
- Added a note about CWE-489 fixed in 5.3.0.
- setup.sh: Fix: Verify the actually written configuration.
- setup.sh: Fixed reading ${...} config values.
- checksumbot: Use apt.$BRANCH.$ARCH.conf for update and
  apt.$DISTROVER.$ARCH.conf for release.
- Let `make setup` accept CONFIG=path-to-config.
- Fix: Revert back to a non-override-values config.
- setup.sh: Added `Dir::Etc::parts "/var/empty";` to the default
  APT config.
- setup.sh: Added `Dir::Etc::main "/dev/null";` to the default
  APT config.
- Rebuild to reflect fixes since the broken version v1.5-alt2.1
  (Fixes: OVE-20251121-0001).
- Notify the users about new security updates (Fixes: OVE-20251117-0001).
- Display EOL.txt on validate if it exists.
- Updated expired GPG keys (Fixes: OVE-20251114-0001).
- Updated README.
- Added setup script for checksumbot (setup.sh).
- Added manual pages for 'checksumbot' and all new utils.
- Fixed -p, --prev option description in 'checksumgen'.
- Added the 'checksummerge' utility.
- Added new 'checksumdiff' utility.
- Reworked version of checksumbot (0.2.0): Rely on mkimage-profiles
  and 'alt-sp-common-update.tar' profile).
- New version 1.24.3.
- Fix: Add runtime dependency on libqt6-quickparticles (closes: 49690, 50671).
- Fixed library symlinks.
- Fixed library symlinks.
- Fixed library symlinks.
- Extract C-precompiled files into the separate 'modules-C' package.
- List all module files and directories using a script.
- Build so-named library and install it into /usr/lib64/.
- Run gsc with -warnings and check for undefined symbols.
- Fix: Generate an incremental link file.
- Run gsc with -warnings and check for undefined symbols.
- Fix: Generate an incremental link file.
- Build so-named library and install it into /usr/lib64/.
- Run gsc with -warnings and check for undefined symbols.
- Fix: Generate an incremental link file.
- Build so-named library and install it into /usr/lib64/.
- Build without RPATH.
- New version 0.17.0.
- New version 0.13.1.
- New version 2.12.5.
- Fixed --fpm-socket-path setup CLI flag (thx Jan Schuppik).
- Fix: Make /etc/icingaweb2/setup.token be owned by 'icingaweb2' group.
- Fix: Filter out task repositories by default.
- Updated the manual page.
- Updated the README file.
- Switch license to GNU GPL v2.
- Removed list_rpms.sh.
- Added the manual page.
- Remove old (probably, wrong) openssl.cnf "HOME" fix.
- Add GOST provider options to the control script.
- Install all built files (including the provider).
- Updated the README file.
- Write integrity-applier messages to log file in --auto mode.
- Don't require ima_appraise=fix in order to sign files.
- Read and write the command-line options from/to state dir in --auto mode.
- Directly use the main config instead of evm_mode file when applying
  and checking EVM.
- Use independent openssl.cnf for certificate generation.
- Fix: Document the GOST_PARAMSET configuration option.
- Fix: Don't insert GOST kernel modules whin signing the files.
- integrity-sign: Improve the check for incompatible options.
- Added -B | --basename command-line option.
- Add command-line and configuration options to control overwrite
  of existing signatures.
- Fix: Check access to the private key when signing the files.
- integrity-sign: Don't write messages to log file by default.
- Don't generate a new certificate without -U | --update option.
- Update the main manual page (trusted keyring + configuration
  options).
- Added integrity-sign(8) manual page.
- Don't load any keys into userspace when signing the files.
- Added -U | --update option.
- Better messaging on verification mode: N/A (reason), BAD, OK.
- Improved --verify mode: Search for keys loaded into the IMA keyring
- Make the initrd script not abort on key related errors by default.
- Introduce SECONDARY_SUFFIX option to load CA certs.
- Added CERT_BASENAME configuration option.
- Allow to sign files using only the private key.
- Optionally, protect the keys and keyrings.
- Use `keyctl id` to search for a keyring ID.
- Add IMA_KEYRING configuration option.
- Add support for --cert and --key options.
- Initialize kmk-user in EVM mode only.
- Fix: Specify that v0.7.5-alt1 closes 48556.
- Fix: Use standalone OpenSSL configuration.
- Write /tmp/integrity.log at initrd stage for debug purposes.
- Fixed reconfiguration error for bootloaders other than GRUB.
- New version 2.14.6 (fixes: CVE-2025-48057, CVE-2024-49369).
- New version 0.16.0.
- New version 0.12.1.
- New version 2.12.4 (fixes: CVE-2025-27405, CVE-2025-27404,
  CVE-2025-30164, CVE-2025-27609).
- New version 0.22.0.
- New version 1.11.5 (fixes: CVE-2024-24820, CVE-2025-23203).
- Added tests.
- Fixed RPM signature key listing.
- Replace --isodir with --pkglist option.
- Display warning when the todo list is empty.
- Fixed delsed generation.
- Fix/improve the baselist grep (closes: 54438).
- Fix: Sort the todo list.
- Fixed prevlist grep patterns: use fixed strings.
- Fixed \t (tab) in query format string.
- Fix: Own /usr/libexec/checksumgen.
- Fixed a vulnerability where an attacker can make the notification
  service unit crash by an attempt to run a damaged file from a
  background process (Fixes: OVE-20250522-0001).
- README files updated.
- Restart both services on failure.
- Fix: Don't exit on write failure (closes: 54267).
- Add -n | --no-fakeroot option.
- Added the first basic unit-test.
- Fixed RPM-list check in repo mode
- Renamed to 'checksumgen'.
- Support a list of RPM filenames in -l | --rpmlist argument.
- Parallel multiprocessing of RPM packages.
- Fix: Don't send error messages and warnings to STDOUT (closes: 53897).
- Updated to v2.27.8.
- Set upstream to https://github.com/intel/ethernet-linux-i40e.
- Build for kernel-image-6.12-6.12.21-alt1.
- Initial build for Sisyphus.
- Build for kernel-image-6.12-6.12.21-alt1.
- Updated to git@00cd158.
- Build for kernel-image-6.12-6.12.21-alt1.
- Add kernel 6.14(+) support (thx clnhub).
- Build for kernel-image-6.12-6.12.21-alt1.
- Updated up to v9.015.00.
- Build for kernel-image-6.12-6.12.21-alt1.
- Updated to git@98cff1d.
- Build for kernel-image-6.12-6.12.21-alt1.
- Updated to git@132dcf0 (support for kernel 6.13 and 6.14, thx morrownr).
- Build for kernel-image-6.12-6.12.21-alt1.
- Fixed Wint-conversion error on aarch64 (thx Vitaly Chikunov).
- Build for kernel-image-6.12-6.12.21-alt1.

Maintainer Paul Wolneykien in the sisyphus branch: Information

Last changes

#415180 sent by Paul Wolneykien

#414733 sent by Paul Wolneykien

#414273 sent by Paul Wolneykien

#409198 sent by Paul Wolneykien

#407276 sent by Paul Wolneykien

#407210 sent by Paul Wolneykien

#407097 sent by Paul Wolneykien

#407095 sent by Paul Wolneykien

#406484 sent by Paul Wolneykien

#405862 sent by Paul Wolneykien

#405670 sent by Paul Wolneykien

#405659 sent by Paul Wolneykien

#404081 sent by Paul Wolneykien

#403204 sent by Paul Wolneykien

#403137 sent by Paul Wolneykien

#403120 sent by Paul Wolneykien

#401813 sent by Paul Wolneykien

#401281 sent by Paul Wolneykien

#401105 sent by Paul Wolneykien

#400676 sent by Paul Wolneykien

#400329 sent by Paul Wolneykien

#400091 sent by Paul Wolneykien

#400083 sent by Paul Wolneykien

#395478 sent by Paul Wolneykien

#393729 sent by Paul Wolneykien

#393682 sent by Paul Wolneykien

#392847 sent by Paul Wolneykien

#392547 sent by Paul Wolneykien

#383344 sent by Paul Wolneykien

#392380 sent by Paul Wolneykien

#390061 sent by Paul Wolneykien

#391299 sent by Paul Wolneykien

#385641 sent by Paul Wolneykien

#385517 sent by Paul Wolneykien

#385366 sent by Paul Wolneykien

#384950 sent by Paul Wolneykien

#384886 sent by Paul Wolneykien

#384826 sent by Paul Wolneykien

#384706 sent by Paul Wolneykien

#384212 sent by Paul Wolneykien

#382256 sent by Paul Wolneykien

#380846 sent by Paul Wolneykien

#380387 sent by Paul Wolneykien

#379911 sent by Paul Wolneykien

#379941 sent by Paul Wolneykien

#379899 sent by Paul Wolneykien

#379895 sent by Paul Wolneykien

#379915 sent by Paul Wolneykien

#379939 sent by Paul Wolneykien

#380041 sent by Paul Wolneykien