Packages changed: MicroOS-release (20261104 -> 20261105) SDL3 (3.4.18 -> 3.4.20) cockpit (365 -> 370) firewalld (2.3.2 -> 2.5.2) ghostscript glibmm2_4 glycin-loaders (2.2.5 -> 2.2.6) inih (62 -> 63) kmod (34.2 -> 34.3) kwin6 libglycin (2.2.5 -> 2.2.6) nghttp2 (1.70.0 -> 1.71.0) nghttp3 (1.18.0 -> 1.19.0) python-tornado6 (6.5.10 -> 6.6) qpdf (12.4.1 -> 12.4.2) qt6-base qt6-declarative qt6-qt5compat rav1e rsync (3.5.1 -> 3.5.2) tpm2-0-tss (4.1.3 -> 4.2.1) tpm2.0-abrmd (3.0.0 -> 3.1.0) tpm2.0-tools (5.7 -> 5.8) === Details === ==== MicroOS-release ==== Version update (20261104 -> 20261105) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== SDL3 ==== Version update (3.4.18 -> 3.4.20) - Update to release 3.4.20 * Improved Wayland clipboard handling * Fixed color cursor alpha mask on X11 * Fixed a crash when Vulkan texture memory binding fails * Fixed transparent windows using the Vulkan renderer * Improved handling of Nintendo Switch controller calibration * Fixed Nintendo Switch controllers failing because of missing stick and IMU calibration * Fixed reports stopping on the Flydigi Vader 5 Pro while the Flydigi Space Station service is running * Added support for rumble and trigger rumble on the Flydigi Vader 5 Pro * Added support for the 8BitDo Ultimate 2C Wireless controller via HIDAPI ==== cockpit ==== Version update (365 -> 370) Subpackages: cockpit-bridge cockpit-networkmanager cockpit-packagekit cockpit-system cockpit-ws cockpit-ws-selinux - Update to 370 * 366 - Networkmanager: Don't activate new network connections by default - Networkmanager: Navigate to details page after creation - Translations and dependency updates * 367 - Translation updates * 368 - Limit concurrent connections bsc#1281994/CVE-2026-91149 - Harden cockpit-ws against trailing slash bsc#1281989/CVE-2026-91147 - Sanitize URLs from PackageKit CVE-2026-91148 - Interactive file chooser for SSH keys - Bug fixes and translation updates - Resolves RHEL-263070, RHEL-262891, RHEL-253609 for rhel-10.4 - Resolves RHEL-263066 for rhel-9.10 * 369 - Translations and dependency updates * 370 - systemd: Make chrony sources drop-in world-readable (RHEL-253609) - storaged: Recognize TPM2 key slots (RHEL-167807) - storaged: Support UTF-8 encoding for mount points ==== firewalld ==== Version update (2.3.2 -> 2.5.2) Subpackages: python313-firewall - Update to version 2.5.2: * fix(nftables): prerouting cannot reliably determine egress * fix(ci): git: use https protocol * fix(runtime-to-permanent): copy empty config fields * fix(firewall-cmd): don't shadow config import * fix(firewall): prefer values() over items() - Changes from version 2.5.1: * fix(check_config): do not check combined zone file name length * doc(firewall-cmd): remove duplicate --permanent * fix(firewall-cmd): avoid extra newline with empty message * fix(dispatch): OUTPUT and POSTROUTING should terminate with ACCEPT - Changes from version 2.5.0: * feat(firewall-config): support gnome automatic dark theme * feat(watcher): log warning if configuration changed * feat(service): add Solr - Changes from version 2.4.4 - 2.3.4: Please see https://github.com/firewalld/firewalld/releases - Update to version 2.3.4: * This is a bug fix only release. + fix(firewall-config): _load_store_append(): properly get runtime zone + fix(check-config): check combined zones + fix(firewall-cmd): dbus: wait for connection + fix(check_config): do not check combined zone file name length + fix(build): dist: add missing policy xmlschema + fix(firewall-cmd): use config.VERSION for --version + fix(firewall-cmd): handle no options when not running - Changes from version 2.3.3: * This is a bug fix only release. + fix(nftables): batch ipset elements in set_restore to avoid O(n²) insertion cost + fix(firewalld): spin trying to acquire dbus + fix(systemd): do not wait on dbus + fix(zone): forward: support timeout + fix(policy): support timeouts + fix(cli): policy: allow timeout with --ingress-zone/--egress-zone + fix(watcher): delete timeout before calling callback + fix(watcher): disable while writing configuration + fix(watcher): clear timeouts on reload + fix(service): steam-streaming: add ports for VR + fix(bash): add completion for --service + fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings} + fix(rpm): drop dependency on dbus-x11 - Drop 0003-CVE-2026-4948-fix-dbus-setter-authorization.patch: fixed upstream. ==== ghostscript ==== - Ghostscript version 10.08.0 also fixes the following security issue (cf. the below entry dated "Tue Oct 13"): - CVE-2026-110133 "Heap buffer overflow in Ghostscript TrueType outliner due to nPointsTotal integer underflow during retry rollback" https://bugs.ghostscript.com/show_bug.cgi?id=709573 (bsc#1288957) ==== glibmm2_4 ==== - Update version dependencies according to meson.build. - Update URL to new home. ==== glycin-loaders ==== Version update (2.2.5 -> 2.2.6) - Update to version 2.2.6: * This release contains the following new component versions + libglycin 2.2.6 + libglycin-gtk4 2.2.6 * Fixed: meson: Fix build configuration failing if either libglycin or libglycin-gtk4 option being enabled. - Stop passing libglycin=true to meson setup in glycin-loaders.spec.inc following upstream changes yet again. ==== inih ==== Version update (62 -> 63) - Update to version 63 (CVE-2025-71450 bsc#1289163) * Report file read errors * Normalize CR LF line endings to just LF in test file * Fix multiline continuation names after no-value keys * Expose INI_MAX_SECTION and INI_MAX_NAME in ini.h * Assert on NULL arguments * Bug Fix: OOB Read in ini_parse_stream() ==== kmod ==== Version update (34.2 -> 34.3) Subpackages: libkmod2 - Update to release 34.3 * depmod gained an -m/--moduledir option. * Removed deprecated arguments for depmod: - -unresolved-error, --quiet, --root and --map. * Removed deprecated arguments for rmmod: -w. * Removed deprecated arguments for insmod: -p and -s. * Optimized index reading by lazily reading nodes on demand. ==== kwin6 ==== Subpackages: libkwin6 - Add upstream change (kde#527984, boo#1289320) * 0001-compositor-handle-possibly-missing-render-device.patch ==== libglycin ==== Version update (2.2.5 -> 2.2.6) - Update to version 2.2.6: * This release contains the following new component versions + libglycin 2.2.6 + libglycin-gtk4 2.2.6 * Fixed: meson: Fix build configuration failing if either libglycin or libglycin-gtk4 option being enabled. - Stop passing libglycin=true to meson setup in glycin-loaders.spec.inc following upstream changes yet again. ==== nghttp2 ==== Version update (1.70.0 -> 1.71.0) - Update to 1.71.0: * lib: add length check for CONTINUATION frames * lib: disallow HEADERS and PUSH_PROMISE in CONNECT streams * lib: fix priority update handling and update window upfront * lib: handle too large window size when consuming data * lib: fix signed integer overflow in nghttp2_session_get_stream_local_window_size and detect size_t overflow in nghttp2_nv_array_copy * lib: better map hasher and simplified map insertion * nghttpx: client TLS certificate validation based on RFC 9525 (CertLookupTree rewrite) and refactored Router * nghttpx: remove server push support * nghttpx: fix GSO disabled on QUIC connections and check QUIC version * Add option to limit the maximum outbound queue size - The library soname is unchanged at 14 ==== nghttp3 ==== Version update (1.18.0 -> 1.19.0) - Update to 1.19.0: * Extend minimum unsent bytes in anticipation of QMux * Clamp glitch rate-limiter burst and check priority field size, applying buffer limit early * Fix map key removal on table resize failure, improve map hasher and simplify insertion * Fix balloc alignment * Document NGHTTP3_ERR_INVALID_ARGUMENT for oversized header block submissions * Clean up QPACK opcode branching * Fix fuzzer ASAN failure * Extend test coverage for trailers in CONNECT streams - The library soname is unchanged at 9 ==== python-tornado6 ==== Version update (6.5.10 -> 6.6) - Update to 6.6.0 (CVE-2026-115927, bsc#1289050, CVE-2026-116577, bsc#1289064, CVE-2026-116578, bsc#1289058): [#] General changes - Python 3.15 is now supported. Python 3.9 and 3.10 are no longer supported; 3.11 is the minimum supported version. - Free-threaded python interpreters are now supported; prebuilt wheels are available for 3.14t and 3.15t. - Windows on ARM is now supported and prebuilt wheels are available. - Prebuilt wheels are now available for ``riscv64``, ``ppc64le``, and ``s390x`` architectures on Linux. These architectures are experimental and have limited support and testing. - PyPy 8.0 is now supported (for both Python 3.11 and 3.12). - Error messages have been improved in many places. - Improved handling of `asyncio.CancelledError` in various parts of the framework. [#] Feature highlights - New feature ``cross_origin_protection`` provides a new mechanism for protecting against XSRF and other cross-origin attacks. This feature is easier to use than ``xsrf_cookies`` and is expected to become the default in Tornado 6.7. [#] Deprecation notices - The ``host`` argument to the `.HTTPServerRequest` constructor is deprecated (since Tornado 6.5.2); use ``headers["Host"]`` instead. It will be removed in Tornado 6.7. - The ``start_line`` argument to the ``HTTPServerRequest`` constructor will become required in Tornado 6.7. The ``method``, ``uri``, and ``version`` arguments are deprecated and will be removed at the same time. All remaining arguments will become keyword-only. A `DeprecationWarning` is now emitted when ``start_line`` is not provided or when the ``host``, ``method``, or ``uri`` arguments are used. - ``tornado.auth.OpenIdMixin`` is deprecated and will be removed in Tornado 6.7 (this is a change in the timeline; it was previously scheduled for removal in Tornado 7.0). - ``tornado.util.TimeoutError``, ``tornado.gen.TimeoutError``, and ``tornado.ioloop.TimeoutError`` are deprecated. They are aliases for the builtin `TimeoutError`, which should be used instead. (No warning is emitted when these aliases are used.) - Calling `.GzipDecompressor.decompress` without a ``max_length`` argument (or with ``max_length=0``) is deprecated and emits a `DeprecationWarning`. In Tornado 7.0, ``max_length`` will be required. - The ``xsrf_cookies`` application setting is expected to be deprecated in Tornado 6.7 (with warnings) in favor of ``cross_origin_protection``. It will not be removed before Tornado 7.0. [#] Type annotation changes - `tornado.gen.multi` now has overload annotations to indicate that its return type depends on its inputs (list vs dict). - `.HTTPServerRequest.method` and ``uri`` attributes are now typed as ``str`` instead of ``str | None``. [#] tornado.curl_httpclient - The minimum supported version of libcurl is now 7.81 (which is the version shipped by Ubuntu 22.04 LTS). - Passing a coroutine as the ``streaming_callback`` argument now fails with a `TypeError`. (Coroutine streaming callbacks are only supported by ``simple_httpclient``.) [#] tornado.gen - `asyncio.CancelledError` is now handled correctly in coroutines, `.multi`, and `.chain_future`. - `.WaitIterator` now supports multiple copies of the same `.Future` object. - `.with_timeout` has a new ``message`` argument, which sets the message of the `TimeoutError`. It may be a string or a callable that returns a string (which is only called if the timeout expires). [#] tornado.http1connection - Invalid ``Host`` headers are now logged at the INFO level instead of as an uncaught exception. - Line folding in HTTP headers is no longer supported. This was deprecated in Tornado 6.5 but is being removed sooner than originally scheduled to avoid DoS risk. - Reading a request or response body now yields to the event loop periodically, so a peer that sends a body faster than it can be processed (especially with many tiny chunks in chunked encoding) can no longer block the event loop for the duration of the body. - Small chunks of a body using chunked encoding are now coalesced before being passed to ``data_received``, so the pieces seen by the application no longer correspond to the HTTP chunk boundaries. - A chunk in a chunked body that is not followed by ``\r\n`` is now reported as an `.HTTPInputError` instead of raising ``AssertionError`` (or being silently accepted when Python is run with ``-O``). - Gzipped bodies containing multiple members are now decompressed correctly. Trailing garbage at the end of a body or in between members is now an error instead of being silently ignored, as is a body that is truncated partway through a member. This applies both to responses received by ``simple_httpclient`` and to requests received by a server with ``decompress_request=True``. [#] tornado.httputil - If ``start_line`` is not passed to `.HTTPServerRequest`, missing ``method`` and ``uri`` arguments now default to ``GET`` and ``/`` (with a `DeprecationWarning`) instead of leaving these attributes as ``None``. - ``HTTPHeaders.__delitem__`` no longer raises `KeyError` at inappropriate times. [#] tornado.iostream - Fixed a socket leak when a timeout occurs during a TLS handshake, ... changelog too long, skipping 118 lines ... - Drop upstreamed patch run-multi-process-in-fresh-process.patch ==== qpdf ==== Version update (12.4.1 -> 12.4.2) - Update to version 12.4.2: * Enhancements - Improve validation of object ids and generation numbers when reading special objects (such as xref or hint streams) and during reconstruction of damaged files. - In –show-linearization, including a listing of all the object numbers that qpdf would assign to each part. Implementation of linearization is inconsistent across tools, so unless qpdf linearized the file, the computed part assignments are not likely to match what’s actually in the file. - Radically decrease memory usage and improve performance when linearizing certain types of files. * Bug fixes - Fix some very old, latent linearization bugs. These will change linearization output for some files. - Previous versions of qpdf incorrectly determined whether an object was shared. The correct behavior based on the specification and for correct performance is that an object is shared if it is accessed by more than one page. qpdf was treating it as shared if it was reachable from more than one starting point including non-page objects. This would cause objects that were referenced by both page and non-page objects to be placed in part 9, at the end of the file, rather than in the appropriate part based on which pages accessed the object. In practice, it is rare for objects to be accessed by both page and non-page objects, so this won’t affect the output of most files. - In some cases, the Pages tree was treated as a shared object and placed earlier in the file than necessary. This was harmless, but incorrect, and it was fixed as a side effect of the performance improvements. - If items in the Outlines dictionary are referenced by pages, the outlines hint table will be absent, and the outlines will appear in the groups of page objects, regardless of the document’s page mode. - Reject trailing characters in bounded numeric command-line option values instead of silently accepting their numeric prefixes. This is technically a breaking change, but if you were relying on qpdf’s behavior of accepting malformed arguments, it’s better to fix that. - Report a file whose only line is a PDF header as damaged instead of failing with a system error. Reading a line whose end-of-line run reaches the end of the file left the input source one byte before the start of that line, which at offset 0 is a seek to -1. * Build changes - Create binary release for additional platforms: - Windows arm64 - Linux aarch64 (arm64) AppImage - Linux aarch64 (arm64) stand-alone binaries - macOS stand-alone binaries (Apple silicon and Intel). These are not signed with an Apple Developer ID or notarized, so you will have to remove Apple’s quarantine attribute as described in the top-level README.md in the source distribution. - Add cmake flags STATIC_JPEG and STATIC_OPENSSL which link jpeg and openssl statically. This is to make it easier to create binary distributions without dependencies on libraries that are less likely to be present on the system. On some platforms, the static libraries will have to be built with position-independent code, so this may not work seamlessly in all environment. It is used to create the macOS binaries included in qpdf releases. - Add cmake flag STATIC_EXTRA_LIBS to pass additional static libraries when linking qpdf. This is useful if you are trying to link statically with libraries that are not automatically detected as dependencies. ==== qt6-base ==== Subpackages: libQt6Concurrent6 libQt6Core6 libQt6DBus6 libQt6Gui6 libQt6Network6 libQt6OpenGL6 libQt6OpenGLWidgets6 libQt6PrintSupport6 libQt6Sql6 libQt6Test6 libQt6WaylandClient6 libQt6Widgets6 libQt6WlShellIntegration6 libQt6Xml6 qt6-network-tls qt6-networkinformation-connman qt6-networkinformation-glib qt6-networkinformation-nm qt6-printsupport-cups qt6-sql-sqlite qt6-wayland - Update qt6-waylandclient-private-devel dependencies ==== qt6-declarative ==== Subpackages: libQt6LabsAnimation6 libQt6LabsFolderListModel6 libQt6LabsPlatform6 libQt6LabsQmlModels6 libQt6LabsSettings6 libQt6LabsSharedImage6 libQt6LabsStyleKit6 libQt6LabsSynchronizer6 libQt6LabsWavefrontMesh6 libQt6Qml6 libQt6QmlCore6 libQt6QmlDesignSupport6 libQt6QmlLocalStorage6 libQt6QmlMeta6 libQt6QmlModels6 libQt6QmlNetwork6 libQt6QmlWorkerScript6 libQt6QmlXmlListModel6 libQt6Quick6 libQt6QuickControls2-6 libQt6QuickControls2Impl6 libQt6QuickDialogs2-6 libQt6QuickDialogs2QuickImpl6 libQt6QuickDialogs2Utils6 libQt6QuickEffects6 libQt6QuickLayouts6 libQt6QuickParticles6 libQt6QuickShapes6 libQt6QuickTemplates2-6 libQt6QuickTest6 libQt6QuickVectorImage6 libQt6QuickWidgets6 qt6-declarative-imports - Add upstream change (boo#1287613, QTBUG-150769) * 0001-QQuickItemView-don-t-leave-dangling-entries-in-unreq.patch ==== qt6-qt5compat ==== Subpackages: libQt6Core5Compat6 qt6-qt5compat-imports - Add upstream changes (CVE-2026-100140, boo#1289130) * CVE-2026-100140-qt5compat-6.12-0001.diff * CVE-2026-100140-qt5compat-6.12-0002.diff * CVE-2026-100140-qt5compat-6.12-0003.diff * CVE-2026-100140-qt5compat-6.12-0004.diff ==== rav1e ==== - Add rav1e-Make-object-order-deterministic.patch: Make object order deterministic (bsc#1289073, gh#medek/nasm-rs#47) ==== rsync ==== Version update (3.5.1 -> 3.5.2) - Update to 3.5.2 - Security fixes: - Bounded strong-checksum work when a malicious receiver supplies weak checksums that collide with consecutive rolling windows (CVE-2026-119741, bsc#1289289). - Bug fixes: - Fixed interrupted `--append` and `--inplace` transfers writing the final 256 KiB buffer twice. An interrupted destination now remains a clean prefix which the next transfer can resume or repair. - Fixed uploads through `rrsync` when the destination file already exists. - Fixed poor matching performance on large sparse and repeated-block files when duplicate checksum chains exhausted the search limit. - Prevented the `--inplace` matcher from advancing its aligned basis index beyond the available checksum entries. This avoids signed overflow on large source files when the peer supplies a small block count. - Recovered from failed hard-link creation without aborting or hanging the generator. - Prevented an out-of-bounds write while invalidating a sender checksum after a file read error when the negotiated checksum length is zero. - Fixed a daemon receiver stack overflow when queued deletion output reached `--max-alloc`. - Fixed a `--files-from` pull from a subdirectory of a daemon module, which read each listed file from the module root instead. - Fixed password files whose first line is empty. - Escaped terminal control characters in filenames and diagnostics written to standard output, standard error and log files. - Restored daemon startup from accepted named Unix sockets on standard input. - Fixed forward-DNS hostname entries in daemon `hosts allow` and `hosts deny` lists for IPv6 peers. - Preserved Unix symlink permissions on systems which require `fchmodat()` to change the mode of a symlink rather than its target. - Enhancements: - Added `--nice` to adjust CPU and I/O scheduling priorities for local and remote rsync processes. - Added `--delay-symlinks` to defer creating new and changed symlinks until other transferred files are in place. It implies `--no-inc-recursive` and requires protocol 29 or newer. ==== tpm2-0-tss ==== Version update (4.1.3 -> 4.2.1) Subpackages: libtss2-esys0 libtss2-fapi-common libtss2-fapi1 libtss2-mu0 libtss2-rc0 libtss2-sys1 libtss2-tcti-device0 libtss2-tctildr0 - New subpackage libtss2-tcti-null0 - New subpackage libtss2-tcti-spi-ltt2go0 (add libusb-1.0 dependency) - Update to 4.2.1 + TEST: use SHA-256 in EVP signing integration test + TCTI: validate the response header length + TCTI: add missing size checks for response buffers + FAPI: fix quoting of empty event logs + FAPI: check the number of branches for policy lists + FAPI: validate key size before extracting the public key + FAPI: add a missing bounds check on PCR_Select deserialization + FAPI: check buffer size in RSASSA and RSAPSS signature conversion + FAPI: reject eventlog entries with an empty template value + FAPI: bound eventlog entry name reads by the template size + FAPI: verify the eventlog digest window fits the template buffer + FAPI: fix file leak on read error + FAPI: fix tests failing with physical TPMs + ESYS: fix compilation without SM4 support + ESYS: fix OpenSSL 3.X engine context handling for internal crypto + FAPI: fix buffer overflow in ifapi_set_auth_primary + SYS: harden the response size checks + SYS: validate the length of no-session responses + SYS: validate the length of encrypted parameter responses + SYS: validate the length of response authorization parameters + SYS: use response size instead of buffer size during unmarshalling + MU: bound subtype unmarshalling to the TPM2B size field + IO: retry poll calls on EINTR and EAGAIN + CI: allow CI runs from different repositories + CI: preserve existing LD_LIBRARY_PATH + CI: update container images - Update to 4.2.0 + Fixed * Fix: In some calloc calls the parameters number of elements and size were swapped. * configure.ac: Fix test of == to = to be POSIX compliant * FAPI: Add check whether auth values exist for hierarchies. * Fixed headers given iwyu output * Remove use of which in favor of command -v * TCTI: Fix leak if Tss2_TctiLdr_Initialize fails. * FAPI: Fix usage of imported external PEM keys for PolicyAuthorize. * test: skip tcti-spidev on 32bit architectures with 64bit time_t * TCTI: fix incomplete teardown in tcti-mssim. * FAPI: Fix Fapi_GetPlatformCertificates without certificates. * test: Fix incomplete teardown in error cased. * configure: install tmpfiles.d and sysusers.d in libdir * FAPI: Fixed leak in Fapi_Sign * FAPI: Fix Fapi_GetPlatformCertificates without certificates does not return TSS2_FAPI_RC_NO_CERT. * FAPI: Fix instantiation of policyduplication select when object name or public data is used. * FAPI: Fix nv object authorization for policy authorize nv. * TCTI: Fixed possible “Resource temporarily unavailable” (EAGAIN) errors * TESTS: Fixed use of PCR16 * TCTI: Separate namespaces for internal struct * ESYS: Fix variable usage in logging message * Fix CodeQL complaints * ESYS: Fix usage of handles in Esys_AC_Send * FAPI: Fix segmentation fault in policy callbacks. * FAPI: Add proper OOM handling for profile realloc. * FAPI: add missing NULL check after malloc in encode_ek_public. * FAPI: memset zero is called in the async functions for the command state to ensure the correct cleanup in error cases. * tests: Switch to latest cmocka layout * FAPI: Fix get_booleal_from_json * ESYS: Fix handling of TPM_RH_NULL handles with sessions + Added * Add clang-format to CI * Add clang-tidy to CI * Add a .clang-tidy file and applied changes to all source code * Add udev rules to create tcm device * FAPI: Support storing EK Certificate chains in NVRAM. * FAPI: KDF scheme KDF2 added. * tcti: add interface config option for spi-ftdi. * Complete license information (including non-code) with REUSE * Add REUSE tool to CI * FAPI: Add new profiles for high range EKs * FAPI: Create FAPI NV objects for existing NV indexes * Enable ARM64 build on Windows * FAPI: Allow usage of restricted keys in Fapi_Sign . * FAPI: Nuvoton certificates added. * MU: add TPM2_ST_ATTEST_NV_DIGEST attestation type support * OpenSSL 4.0 compatible macro usage ==== tpm2.0-abrmd ==== Version update (3.0.0 -> 3.1.0) Subpackages: libtss2-tcti-tabrmd0 tpm2.0-abrmd-selinux - Update to 3.1.0 + Security * several fixes to address GHSA-v78x-j5fh-w6pr + Fixed * Simplify TSS version discovery in the build * Typo in the SELinux interface file * scan-build warnings and API compatibility for arm32 in the test suite + Added * FreeBSD support * SELinux policy calls init_nnp_daemon_domain to enable systemd hardening * SELinux tabrmd_rw_unix_stream_sockets interface * SELinux file context entry for /usr/bin/tpm2-abrmd + Changed * Makefile.am: Removed use of deprecated ACLOCAL_AMFLAGS * bootstrap: Set AC_CONFIG_AUX_DIR to source root * CI: general updates to github CI, moved FreeBSD CI from Cirrus to github * Replace old LGTM workflow with CodeQL - Drop 1229047-fix-bin-sbin-selinux.patch, merged upstream - Refresh harden_tpm2-abrmd.service.patch: drop the tabrmd.te hunk (init_nnp_daemon_domain), merged upstream ==== tpm2.0-tools ==== Version update (5.7 -> 5.8) - Spec cleanup: + Drop unneeded BuildRequires: tpm2.0-abrmd-devel, libuuid-devel, gcc-c++ and libtool + Simplify the test bcond and run the test suite sequentially + Remove the dead pandoc block, fix URL and keyring comment - Update to 5.8: + CVE-2026-75504, CVE-2026-73991, CVE-2026-75503 + Fixed * tpm2_makecredential: fix wrong tcg ek templates * tpm2_checkquote: Fix memory leaks, malloced buffer not always freed * tpm2_checkquote: Fix missing error checking * tpm2_getekcertificate: Fix curl_easy_setopt type warnings * tpm2_makecredential: Fix usage of name parameter. * tpm2_quote/checkquote: Fix usage of little endian serialization. * tpm2_eventlog: parse vendor_db as EFI_SIGNATURE_DATA * tpm2_eventlog: Fix parsing on big-endian systems * tpm2_clockrateadjust: Fix segfault. * tpm2_policy: Do not overflow list of policy digests * tpm2_eventlog: Fix pretty print for efivar 39 * tpm2_encode: Fix setting emptyAuth in generated pem file. * tpm2_eventlog_yaml.c Fix output of BlobDescription. * tpm2_getrandom: Fix --force parameter * tpm2_getekcertificate: fix impl to prioritize low range certificate * Options: Add option to allow usage of password session. * tpm2_createpolicy: flush session for trial policy. * tpm2_evictcontrol.c: Fix segfault for output of handle ESYS_TR_NONE * pcr commands: Fix session leaks * tools, test: Fix several missing NULL checks after malloc * tpm2_util: fix buffer overflow in string validation checks. * tpm2_getekcertificate: ensure curl buffer grows to required size. * tpm2_getekcertificate: fix heap buffer overflow. + Added * tpm2_quote/checkquote: Add new serialization format is added (-F marshaled). * tpm2_loadexternal: Add option rsa_exponent_zero * tpm2_createek: Add high range templates for rsa20248 and eccp256 * tpm2_certify: Add parameter qualifying-data. * pcr commands: session support added. * tpm2_getekcertificate: add option --x509-trunc * tpm2_getekcertificate: Provide option -u for certs in NV ram. * tpm2_gettestresult: Fix handling of test result. * tpm2_checkquote: Fix usage of more than 7 PCRs * tpm2_send: Validate command_size before computing data_size. * tpm2_send: Avoid unintended stdio closing a file * tpm2_util: Allow file names with whitspace characters. * tools: fix out-of-bounds write with too many aux sessions. * tss2_sign: Add new parameter from which the digest is computed. * OpenSSL use 4.0 compatible macros