<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="12">
<package pkgid="13c42d7ebdfc28ae029c444763c83a8164ac8b49f71c0402b929619b80878157" name="obs-api" arch="noarch">
    <version epoch="0" ver="2.6.92.git20160506.9e4baaa" rel="17.1"/>

<changelog author="adrian@suse.de" date="1333108800">- OBS 2.3 RC2, (version 2.2.992)
  - fixed regression in "none" repo type support
  - fixed database corruption for maintenance projects
  - fixes for webui patchinfo editor</changelog>
<changelog author="adrian@suse.de" date="1333540800">- OBS 2.3 RC3, (version 2.2.993)
  - fixed standalone obsworker installation
  - some init script fixes
  - minor webui fixes
  - _patchinfo creation fix on maintenance request accept</changelog>
<changelog author="adrian@suse.de" date="1334059200">- OBS 2.3 RC4, (version 2.2.994)
  - serialized diffing, protects the server against DoS</changelog>
<changelog author="adrian@suse.de" date="1334923200">- OBS 2.3 RC5, (version 2.2.995)
  - various documentation updates
  - fixed request diffing for "updatelink" requests
  - fixed various update and first start problems
  - fixed various crashes in webui
  - critical backend fix for sending data with trailing \0 after 8192 boundaries</changelog>
<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372766400">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>

</package>

<package pkgid="8731507a66e15bd91b8e1a457b2cfb19293867e6c413f082cfd6ef5a7df2ef05" name="obs-api-deps" arch="src">
    <version epoch="0" ver="2.6.92.git20160506.9e4baaa" rel="17.1"/>

<changelog author="adrian@suse.de" date="1333108800">- OBS 2.3 RC2, (version 2.2.992)
  - fixed regression in "none" repo type support
  - fixed database corruption for maintenance projects
  - fixes for webui patchinfo editor</changelog>
<changelog author="adrian@suse.de" date="1333540800">- OBS 2.3 RC3, (version 2.2.993)
  - fixed standalone obsworker installation
  - some init script fixes
  - minor webui fixes
  - _patchinfo creation fix on maintenance request accept</changelog>
<changelog author="adrian@suse.de" date="1334059200">- OBS 2.3 RC4, (version 2.2.994)
  - serialized diffing, protects the server against DoS</changelog>
<changelog author="adrian@suse.de" date="1334923200">- OBS 2.3 RC5, (version 2.2.995)
  - various documentation updates
  - fixed request diffing for "updatelink" requests
  - fixed various update and first start problems
  - fixed various crashes in webui
  - critical backend fix for sending data with trailing \0 after 8192 boundaries</changelog>
<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372766400">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- OBS 2.7.0 beta 1 release
  Please read the ReleaseNotes-2.7 file for details.</changelog>

</package>

<package pkgid="bccbaf5a7c6bd17a995a1f307d205d3fa66233c4ac9395b35cdf9bbc1b080c68" name="obs-api-testsuite-deps" arch="x86_64">
    <version epoch="0" ver="2.6.92.git20160506.9e4baaa" rel="17.1"/>

<changelog author="adrian@suse.de" date="1333108800">- OBS 2.3 RC2, (version 2.2.992)
  - fixed regression in "none" repo type support
  - fixed database corruption for maintenance projects
  - fixes for webui patchinfo editor</changelog>
<changelog author="adrian@suse.de" date="1333540800">- OBS 2.3 RC3, (version 2.2.993)
  - fixed standalone obsworker installation
  - some init script fixes
  - minor webui fixes
  - _patchinfo creation fix on maintenance request accept</changelog>
<changelog author="adrian@suse.de" date="1334059200">- OBS 2.3 RC4, (version 2.2.994)
  - serialized diffing, protects the server against DoS</changelog>
<changelog author="adrian@suse.de" date="1334923200">- OBS 2.3 RC5, (version 2.2.995)
  - various documentation updates
  - fixed request diffing for "updatelink" requests
  - fixed various update and first start problems
  - fixed various crashes in webui
  - critical backend fix for sending data with trailing \0 after 8192 boundaries</changelog>
<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372766400">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- OBS 2.7.0 beta 1 release
  Please read the ReleaseNotes-2.7 file for details.</changelog>

</package>

<package pkgid="5779501c33826468803da5967e11ecf3c628bb5e0e9e747dc0bee791c66f8364" name="obs-common" arch="noarch">
    <version epoch="0" ver="2.6.92.git20160506.9e4baaa" rel="17.1"/>

<changelog author="adrian@suse.de" date="1333108800">- OBS 2.3 RC2, (version 2.2.992)
  - fixed regression in "none" repo type support
  - fixed database corruption for maintenance projects
  - fixes for webui patchinfo editor</changelog>
<changelog author="adrian@suse.de" date="1333540800">- OBS 2.3 RC3, (version 2.2.993)
  - fixed standalone obsworker installation
  - some init script fixes
  - minor webui fixes
  - _patchinfo creation fix on maintenance request accept</changelog>
<changelog author="adrian@suse.de" date="1334059200">- OBS 2.3 RC4, (version 2.2.994)
  - serialized diffing, protects the server against DoS</changelog>
<changelog author="adrian@suse.de" date="1334923200">- OBS 2.3 RC5, (version 2.2.995)
  - various documentation updates
  - fixed request diffing for "updatelink" requests
  - fixed various update and first start problems
  - fixed various crashes in webui
  - critical backend fix for sending data with trailing \0 after 8192 boundaries</changelog>
<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372766400">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>

</package>

<package pkgid="694c5f56997a926da1c9587c3c03ba6576939db01cb2c29841c00d1cf574a706" name="obs-devel" arch="noarch">
    <version epoch="0" ver="2.6.92.git20160506.9e4baaa" rel="17.1"/>

<changelog author="adrian@suse.de" date="1333108800">- OBS 2.3 RC2, (version 2.2.992)
  - fixed regression in "none" repo type support
  - fixed database corruption for maintenance projects
  - fixes for webui patchinfo editor</changelog>
<changelog author="adrian@suse.de" date="1333540800">- OBS 2.3 RC3, (version 2.2.993)
  - fixed standalone obsworker installation
  - some init script fixes
  - minor webui fixes
  - _patchinfo creation fix on maintenance request accept</changelog>
<changelog author="adrian@suse.de" date="1334059200">- OBS 2.3 RC4, (version 2.2.994)
  - serialized diffing, protects the server against DoS</changelog>
<changelog author="adrian@suse.de" date="1334923200">- OBS 2.3 RC5, (version 2.2.995)
  - various documentation updates
  - fixed request diffing for "updatelink" requests
  - fixed various update and first start problems
  - fixed various crashes in webui
  - critical backend fix for sending data with trailing \0 after 8192 boundaries</changelog>
<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372766400">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>

</package>

<package pkgid="15ffc369e6f5e97ea8b22c2016a7f4275d7b555a73ae8a70d7db9fd188f709ba" name="obs-productconverter" arch="noarch">
    <version epoch="0" ver="2.6.92.git20160506.9e4baaa" rel="17.1"/>

<changelog author="adrian@suse.de" date="1333108800">- OBS 2.3 RC2, (version 2.2.992)
  - fixed regression in "none" repo type support
  - fixed database corruption for maintenance projects
  - fixes for webui patchinfo editor</changelog>
<changelog author="adrian@suse.de" date="1333540800">- OBS 2.3 RC3, (version 2.2.993)
  - fixed standalone obsworker installation
  - some init script fixes
  - minor webui fixes
  - _patchinfo creation fix on maintenance request accept</changelog>
<changelog author="adrian@suse.de" date="1334059200">- OBS 2.3 RC4, (version 2.2.994)
  - serialized diffing, protects the server against DoS</changelog>
<changelog author="adrian@suse.de" date="1334923200">- OBS 2.3 RC5, (version 2.2.995)
  - various documentation updates
  - fixed request diffing for "updatelink" requests
  - fixed various update and first start problems
  - fixed various crashes in webui
  - critical backend fix for sending data with trailing \0 after 8192 boundaries</changelog>
<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372766400">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>

</package>

<package pkgid="87850213f639a3618971aca23d2d263f15ff0331c034940f5a9928c8ecb62a8c" name="obs-server" arch="noarch">
    <version epoch="0" ver="2.6.92.git20160506.9e4baaa" rel="17.1"/>

<changelog author="adrian@suse.de" date="1333108800">- OBS 2.3 RC2, (version 2.2.992)
  - fixed regression in "none" repo type support
  - fixed database corruption for maintenance projects
  - fixes for webui patchinfo editor</changelog>
<changelog author="adrian@suse.de" date="1333540800">- OBS 2.3 RC3, (version 2.2.993)
  - fixed standalone obsworker installation
  - some init script fixes
  - minor webui fixes
  - _patchinfo creation fix on maintenance request accept</changelog>
<changelog author="adrian@suse.de" date="1334059200">- OBS 2.3 RC4, (version 2.2.994)
  - serialized diffing, protects the server against DoS</changelog>
<changelog author="adrian@suse.de" date="1334923200">- OBS 2.3 RC5, (version 2.2.995)
  - various documentation updates
  - fixed request diffing for "updatelink" requests
  - fixed various update and first start problems
  - fixed various crashes in webui
  - critical backend fix for sending data with trailing \0 after 8192 boundaries</changelog>
<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372766400">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>

</package>

<package pkgid="03d6d7dccb7cb86d3717eac5bc96872597501bd5216e0c362fd8c25cfb6d027b" name="obs-server" arch="src">
    <version epoch="0" ver="2.6.92.git20160506.9e4baaa" rel="17.1"/>

<changelog author="adrian@suse.de" date="1333108800">- OBS 2.3 RC2, (version 2.2.992)
  - fixed regression in "none" repo type support
  - fixed database corruption for maintenance projects
  - fixes for webui patchinfo editor</changelog>
<changelog author="adrian@suse.de" date="1333540800">- OBS 2.3 RC3, (version 2.2.993)
  - fixed standalone obsworker installation
  - some init script fixes
  - minor webui fixes
  - _patchinfo creation fix on maintenance request accept</changelog>
<changelog author="adrian@suse.de" date="1334059200">- OBS 2.3 RC4, (version 2.2.994)
  - serialized diffing, protects the server against DoS</changelog>
<changelog author="adrian@suse.de" date="1334923200">- OBS 2.3 RC5, (version 2.2.995)
  - various documentation updates
  - fixed request diffing for "updatelink" requests
  - fixed various update and first start problems
  - fixed various crashes in webui
  - critical backend fix for sending data with trailing \0 after 8192 boundaries</changelog>
<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372766400">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>

</package>

<package pkgid="fa1732238ae2dfa0e8292450d159086e60b86c5233e506ff27a40cffb430d654" name="obs-source_service" arch="noarch">
    <version epoch="0" ver="2.6.92.git20160506.9e4baaa" rel="17.1"/>

<changelog author="adrian@suse.de" date="1333108800">- OBS 2.3 RC2, (version 2.2.992)
  - fixed regression in "none" repo type support
  - fixed database corruption for maintenance projects
  - fixes for webui patchinfo editor</changelog>
<changelog author="adrian@suse.de" date="1333540800">- OBS 2.3 RC3, (version 2.2.993)
  - fixed standalone obsworker installation
  - some init script fixes
  - minor webui fixes
  - _patchinfo creation fix on maintenance request accept</changelog>
<changelog author="adrian@suse.de" date="1334059200">- OBS 2.3 RC4, (version 2.2.994)
  - serialized diffing, protects the server against DoS</changelog>
<changelog author="adrian@suse.de" date="1334923200">- OBS 2.3 RC5, (version 2.2.995)
  - various documentation updates
  - fixed request diffing for "updatelink" requests
  - fixed various update and first start problems
  - fixed various crashes in webui
  - critical backend fix for sending data with trailing \0 after 8192 boundaries</changelog>
<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372766400">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>

</package>

<package pkgid="6a11719ed3d365af0d009880f775c4605a56dd733b604b7a96c61bb246da0001" name="obs-tests-appliance" arch="noarch">
    <version epoch="0" ver="2.6.92.git20160506.9e4baaa" rel="17.1"/>

<changelog author="adrian@suse.de" date="1333108800">- OBS 2.3 RC2, (version 2.2.992)
  - fixed regression in "none" repo type support
  - fixed database corruption for maintenance projects
  - fixes for webui patchinfo editor</changelog>
<changelog author="adrian@suse.de" date="1333540800">- OBS 2.3 RC3, (version 2.2.993)
  - fixed standalone obsworker installation
  - some init script fixes
  - minor webui fixes
  - _patchinfo creation fix on maintenance request accept</changelog>
<changelog author="adrian@suse.de" date="1334059200">- OBS 2.3 RC4, (version 2.2.994)
  - serialized diffing, protects the server against DoS</changelog>
<changelog author="adrian@suse.de" date="1334923200">- OBS 2.3 RC5, (version 2.2.995)
  - various documentation updates
  - fixed request diffing for "updatelink" requests
  - fixed various update and first start problems
  - fixed various crashes in webui
  - critical backend fix for sending data with trailing \0 after 8192 boundaries</changelog>
<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372766400">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>

</package>

<package pkgid="ac0d10befd225a8010531d67f9b236a33dcd543b044942bb683d47ad75fb565c" name="obs-utils" arch="noarch">
    <version epoch="0" ver="2.6.92.git20160506.9e4baaa" rel="17.1"/>

<changelog author="adrian@suse.de" date="1333108800">- OBS 2.3 RC2, (version 2.2.992)
  - fixed regression in "none" repo type support
  - fixed database corruption for maintenance projects
  - fixes for webui patchinfo editor</changelog>
<changelog author="adrian@suse.de" date="1333540800">- OBS 2.3 RC3, (version 2.2.993)
  - fixed standalone obsworker installation
  - some init script fixes
  - minor webui fixes
  - _patchinfo creation fix on maintenance request accept</changelog>
<changelog author="adrian@suse.de" date="1334059200">- OBS 2.3 RC4, (version 2.2.994)
  - serialized diffing, protects the server against DoS</changelog>
<changelog author="adrian@suse.de" date="1334923200">- OBS 2.3 RC5, (version 2.2.995)
  - various documentation updates
  - fixed request diffing for "updatelink" requests
  - fixed various update and first start problems
  - fixed various crashes in webui
  - critical backend fix for sending data with trailing \0 after 8192 boundaries</changelog>
<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372766400">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>

</package>

<package pkgid="49a2cf231d33472cef1a5b4f234c0a761bee93757b83da9b278415349dd708ea" name="obs-worker" arch="noarch">
    <version epoch="0" ver="2.6.92.git20160506.9e4baaa" rel="17.1"/>

<changelog author="adrian@suse.de" date="1333108800">- OBS 2.3 RC2, (version 2.2.992)
  - fixed regression in "none" repo type support
  - fixed database corruption for maintenance projects
  - fixes for webui patchinfo editor</changelog>
<changelog author="adrian@suse.de" date="1333540800">- OBS 2.3 RC3, (version 2.2.993)
  - fixed standalone obsworker installation
  - some init script fixes
  - minor webui fixes
  - _patchinfo creation fix on maintenance request accept</changelog>
<changelog author="adrian@suse.de" date="1334059200">- OBS 2.3 RC4, (version 2.2.994)
  - serialized diffing, protects the server against DoS</changelog>
<changelog author="adrian@suse.de" date="1334923200">- OBS 2.3 RC5, (version 2.2.995)
  - various documentation updates
  - fixed request diffing for "updatelink" requests
  - fixed various update and first start problems
  - fixed various crashes in webui
  - critical backend fix for sending data with trailing \0 after 8192 boundaries</changelog>
<changelog author="adrian@suse.de" date="1338465600">- update to OBS 2.3.1
  Feature backports:
  ==================
  * Support remote product build tree building
  * Make kiwi support packages configurable. Defaults are:
    Substitute: kiwi-setup:image kiwi createrepo tar
    Substitute: kiwi-setup:product kiwi
  Changes:
  ========
  * Support Order: handling also during preinstall (for Fedora 17)
  * Added Fedora-17 default target
  * bnc and fate issue tags are also accepted with whitespace: bnc #123
    (This requires to run migrations on api).
  * Increased timeouts for OBS inter connects
  Bugfixes:
  =========
  * Use right architecture on spec file parsing when project configuration contains a "Target:" line
  * Fixed warning messages about 'nextstate' in dispatcher
  * Fixed urls in webui to www.open-build-service.org
  * Init script fixes for automatic deployment of workers
  * Fixed debian handling for exporting sources</changelog>
<changelog author="adrian@suse.de" date="1340971200">- update to OBS 2.3.2
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * support xz compressed kiwi images
  * documentation and theming updates
  * do not leave out sourceaccess protected package on branching (bnc#766119)
  Bugfixes:
  =========
  * fixed dieing source ajax source when doing OBS interconnect
  * removal of not expandable _link files is working now
  * package meta data on project copy takes all elements now, except
    person, group and devel.
  * initial webui database setup on appliance works now
  * no error when using appliance without OBS LVM volume group
  * webui is able to store OBS configuration now.</changelog>
<changelog author="adrian@suse.de" date="1370865600">- starting OBS pre-2.5 snapshots
- require the createrepo version which got used in the testsuite</changelog>
<changelog author="adrian@suse.de" date="1372766400">- fix build
- drop lighttpd configs
- environment/*rb files are non-noreplace now, all config options
  went into options.yml and configuration.xml</changelog>
<changelog author="adrian@suse.de" date="1415102400">- update to OBS 2.6 Beta 1 (2.5.90)</changelog>
<changelog author="adrian@suse.de" date="1418385600">- update to OBS 2.6 RC 1 (2.5.95)</changelog>
<changelog author="adrian@suse.de" date="1423051200">- OBS 2.6.0 release
  - details are in the release notes</changelog>
<changelog author="adrian@suse.de" date="1426161600">- OBS 2.6.1 release
  Feature backports:
  ==================
  * support static links for vmx/vmdk files
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * api: fix handling of special chars in maintenance package names
  * api: do not allow to overwrite existing groups via wrong route
  * api: fix first time login when using LDAP
  * webui: fix user icon fetching as done by google bot
  * webui: fix display issues (github issues obs#320, obs#711, obs#806)
  * backend: fix arbitrary command execution in service daemon (CVE-2015-0778)
  * backend: fix lxc support in worker
  * backend: fix event handling when using multiple backend servers
  * backend: fix publishing of vmx files</changelog>
<changelog author="adrian@suse.de" date="1428494400">- OBS 2.6.2 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * dispatcher sends no armv7 jobs to aarch64 build hosts anymore
  Bugfixes:
  =========
  * webui: depends on rubygem-redcarpet 3.2.3, fixes possible XSS attack (boo#926328)</changelog>
<changelog author="adrian@suse.de" date="1439380800">- OBS 2.6.3 release
  Feature backports:
  ==================
  * backend: support using docker as build environment (not secure)
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * backend: validate results of external patch command. could be used
    to modify packages without sufficiant permissions (bnc#941099, CVE-2015-0796)
  * backend: fixing create pattern call in publisher
  * backend: fix handling of host specific bsconfig.* files</changelog>
<changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
<changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
<changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
<changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
<changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
<changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>

</package>

</otherdata>